xtremerat | 417433446e6af8f85f20fe4e88053697deaea76a647fecf43f20fa9ce6f05180

General

Target
4c001cf55926249d45973c56ee919865_JaffaCakes118.exe
Size 404KB
Sample240716-ae41fsydre
SHA256 417433446e6af8f85f20fe4e88053697deaea76a647fecf43f20fa9ce6f05180
MD5 4c001cf55926249d45973c56ee919865
SHA1 2d5df1081784fccd76bbc2ea3eb80d857a2a369e
SHA512 323ad4c0ff65d5bbb4fd2dd54ee485c1a9a2ae04fc1c330d6f61863b43aaa63840bc7902005f1746dac5afc3c0365fd4d9f459436cad8ef3ae6e46650f08f113
SSDEEP 1536:z1zETwPGSmhCmW7yCHys/vzbgNJRA9YbU1Vu0goPYFcspmZfiJG9i3gZBUv:z1dGSk7Cys2JqabU1VVJPYispEfiqBU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Extracted

Family

xtremerat

C2

gfhgfhjfj.no-ip.info

Signatures

Detect XtremeRAT payload 7 IoCs

resource	yara_rule
behavioral2/memory/1960-3-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/1960-4-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/1960-5-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/1960-7-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/1476-8-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/1960-9-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/1476-10-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2872 set thread context of 1960	2872	4c001cf55926249d45973c56ee919865_JaffaCakes118.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2896	1476	WerFault.exe	87
1604	1476	WerFault.exe	87

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2872	4c001cf55926249d45973c56ee919865_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 1960	2872	4c001cf55926249d45973c56ee919865_JaffaCakes118.exe	85
PID 2872 wrote to memory of 1960	2872	4c001cf55926249d45973c56ee919865_JaffaCakes118.exe	85
PID 2872 wrote to memory of 1960	2872	4c001cf55926249d45973c56ee919865_JaffaCakes118.exe	85
PID 2872 wrote to memory of 1960	2872	4c001cf55926249d45973c56ee919865_JaffaCakes118.exe	85
PID 2872 wrote to memory of 1960	2872	4c001cf55926249d45973c56ee919865_JaffaCakes118.exe	85
PID 2872 wrote to memory of 1960	2872	4c001cf55926249d45973c56ee919865_JaffaCakes118.exe	85
PID 2872 wrote to memory of 1960	2872	4c001cf55926249d45973c56ee919865_JaffaCakes118.exe	85
PID 2872 wrote to memory of 1960	2872	4c001cf55926249d45973c56ee919865_JaffaCakes118.exe	85
PID 2872 wrote to memory of 1960	2872	4c001cf55926249d45973c56ee919865_JaffaCakes118.exe	85
PID 2872 wrote to memory of 1960	2872	4c001cf55926249d45973c56ee919865_JaffaCakes118.exe	85
PID 2872 wrote to memory of 1960	2872	4c001cf55926249d45973c56ee919865_JaffaCakes118.exe	85
PID 2872 wrote to memory of 1960	2872	4c001cf55926249d45973c56ee919865_JaffaCakes118.exe	85
PID 2872 wrote to memory of 1960	2872	4c001cf55926249d45973c56ee919865_JaffaCakes118.exe	85
PID 1960 wrote to memory of 1476	1960	4c001cf55926249d45973c56ee919865_JaffaCakes118.exe	87
PID 1960 wrote to memory of 1476	1960	4c001cf55926249d45973c56ee919865_JaffaCakes118.exe	87
PID 1960 wrote to memory of 1476	1960	4c001cf55926249d45973c56ee919865_JaffaCakes118.exe	87
PID 1960 wrote to memory of 1476	1960	4c001cf55926249d45973c56ee919865_JaffaCakes118.exe	87
PID 1960 wrote to memory of 1412	1960	4c001cf55926249d45973c56ee919865_JaffaCakes118.exe	89
PID 1960 wrote to memory of 1412	1960	4c001cf55926249d45973c56ee919865_JaffaCakes118.exe	89
PID 1960 wrote to memory of 1412	1960	4c001cf55926249d45973c56ee919865_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\4c001cf55926249d45973c56ee919865_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4c001cf55926249d45973c56ee919865_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Users\Admin\AppData\Local\Temp\4c001cf55926249d45973c56ee919865_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\4c001cf55926249d45973c56ee919865_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:1476
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 484
      4⤵
      Program crash
      PID:2896
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 500
      4⤵
      Program crash
      PID:1604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:1412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1476 -ip 1476
1⤵
PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1476 -ip 1476
1⤵
PID:468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1476-8-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/1476-10-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/1960-3-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/1960-4-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/1960-5-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/1960-7-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/1960-9-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/2872-0-0x0000000000400000-0x0000000000465000-memory.dmp

Download

memory/2872-6-0x0000000000400000-0x0000000000465000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads