xtremerat | f52f4935da34453ba53515f9ba5a4319db809bd78738c428ec77b5e022eebb5f

General

Target
50360644b896ef4c6a742b9a411cb0f5_JaffaCakes118.exe
Size 108KB
Sample240716-1vdfjsvdpd
SHA256 f52f4935da34453ba53515f9ba5a4319db809bd78738c428ec77b5e022eebb5f
MD5 50360644b896ef4c6a742b9a411cb0f5
SHA1 73b2f8bdb9dfa1aedf716957b8105956adc16f4c
SHA512 bd9c2d36283e74f0b42fffeb7d52f16c3baf815715c967ef3b472fd147becbd0325bd3e1cbfa798f708c36efbd1c532edf67f451bcfdd2317413567411043410
SSDEEP 1536:EXrkdcEfn8tb1TPMRcCPzyf9y2OSPYbWrvh91lq:EyvA37Pg2L1Q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Detect XtremeRAT payload 5 IoCs

resource	yara_rule
behavioral2/memory/336-5-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/336-6-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/2196-10-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/336-11-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/2196-13-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

Active Setup

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{412Y7WL6-02XI-4H63-NPMG-565156ASWMGS}	50360644b896ef4c6a742b9a411cb0f5_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{412Y7WL6-02XI-4H63-NPMG-565156ASWMGS}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	50360644b896ef4c6a742b9a411cb0f5_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	50360644b896ef4c6a742b9a411cb0f5_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	50360644b896ef4c6a742b9a411cb0f5_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3536 set thread context of 336	3536	50360644b896ef4c6a742b9a411cb0f5_JaffaCakes118.exe	84

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InstallDir\Server.exe	50360644b896ef4c6a742b9a411cb0f5_JaffaCakes118.exe
File created	C:\Windows\InstallDir\Server.exe	50360644b896ef4c6a742b9a411cb0f5_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3536	50360644b896ef4c6a742b9a411cb0f5_JaffaCakes118.exe
2196	notepad.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 336	3536	50360644b896ef4c6a742b9a411cb0f5_JaffaCakes118.exe	84
PID 3536 wrote to memory of 336	3536	50360644b896ef4c6a742b9a411cb0f5_JaffaCakes118.exe	84
PID 3536 wrote to memory of 336	3536	50360644b896ef4c6a742b9a411cb0f5_JaffaCakes118.exe	84
PID 3536 wrote to memory of 336	3536	50360644b896ef4c6a742b9a411cb0f5_JaffaCakes118.exe	84
PID 3536 wrote to memory of 336	3536	50360644b896ef4c6a742b9a411cb0f5_JaffaCakes118.exe	84
PID 3536 wrote to memory of 336	3536	50360644b896ef4c6a742b9a411cb0f5_JaffaCakes118.exe	84
PID 3536 wrote to memory of 336	3536	50360644b896ef4c6a742b9a411cb0f5_JaffaCakes118.exe	84
PID 3536 wrote to memory of 336	3536	50360644b896ef4c6a742b9a411cb0f5_JaffaCakes118.exe	84
PID 336 wrote to memory of 2196	336	50360644b896ef4c6a742b9a411cb0f5_JaffaCakes118.exe	86
PID 336 wrote to memory of 2196	336	50360644b896ef4c6a742b9a411cb0f5_JaffaCakes118.exe	86
PID 336 wrote to memory of 2196	336	50360644b896ef4c6a742b9a411cb0f5_JaffaCakes118.exe	86
PID 336 wrote to memory of 2196	336	50360644b896ef4c6a742b9a411cb0f5_JaffaCakes118.exe	86