xtremerat | e1b5864fad55155ea7d5f2cce750927ed1c027a675e775a9a67db8c0d3b50da8

General

Target
54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe
Size 249KB
Sample240717-z5zabsshmg
SHA256 e1b5864fad55155ea7d5f2cce750927ed1c027a675e775a9a67db8c0d3b50da8
MD5 54d36d7af43725550fdd099ea1efd443
SHA1 4fb5178727a10fe58bdfbf1c3628e3a9e1c69d9a
SHA512 d8406d336352ebe9c6f4ecbb829386a3f716beb81890696c2a144b879cd3cbeafad3811d3b0564b98497434f2c16309a4c2059ad6ad3d3ec8aca1011d8367d7f
SSDEEP 6144:85r1lTtmuoca6EBp27UMTqGC+xZQ5p7IN:OzTtmuoca6cp4ql+Sp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Extracted

Family

xtremerat

C2

claud222.no-ip.biz
✦㔘踀Partiesclaud222.no-ip.biz

Signatures

Detect XtremeRAT payload 5 IoCs

resource	yara_rule
behavioral2/memory/3468-9-0x0000000010000000-0x00000000100C3000-memory.dmp	family_xtremerat
behavioral2/memory/3468-7-0x0000000010000000-0x00000000100C3000-memory.dmp	family_xtremerat
behavioral2/memory/3128-10-0x0000000010000000-0x00000000100C3000-memory.dmp	family_xtremerat
behavioral2/memory/3468-11-0x0000000010000000-0x00000000100C3000-memory.dmp	family_xtremerat
behavioral2/memory/3128-12-0x0000000010000000-0x00000000100C3000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3468-3-0x0000000010000000-0x00000000100C3000-memory.dmp	upx
behavioral2/memory/3468-6-0x0000000010000000-0x00000000100C3000-memory.dmp	upx
behavioral2/memory/3468-9-0x0000000010000000-0x00000000100C3000-memory.dmp	upx
behavioral2/memory/3468-7-0x0000000010000000-0x00000000100C3000-memory.dmp	upx
behavioral2/memory/3128-10-0x0000000010000000-0x00000000100C3000-memory.dmp	upx
behavioral2/memory/3468-11-0x0000000010000000-0x00000000100C3000-memory.dmp	upx
behavioral2/memory/3128-12-0x0000000010000000-0x00000000100C3000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3784 set thread context of 3468	3784	54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe	91

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2536	3128	WerFault.exe	92
5040	3128	WerFault.exe	92

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3784	54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3784 wrote to memory of 3468	3784	54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe	91
PID 3784 wrote to memory of 3468	3784	54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe	91
PID 3784 wrote to memory of 3468	3784	54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe	91
PID 3784 wrote to memory of 3468	3784	54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe	91
PID 3784 wrote to memory of 3468	3784	54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe	91
PID 3784 wrote to memory of 3468	3784	54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe	91
PID 3784 wrote to memory of 3468	3784	54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe	91
PID 3784 wrote to memory of 3468	3784	54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe	91
PID 3468 wrote to memory of 3128	3468	54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe	92
PID 3468 wrote to memory of 3128	3468	54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe	92
PID 3468 wrote to memory of 3128	3468	54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe	92
PID 3468 wrote to memory of 3128	3468	54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe	92
PID 3468 wrote to memory of 1296	3468	54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe	93
PID 3468 wrote to memory of 1296	3468	54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe	93
PID 3468 wrote to memory of 1296	3468	54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe	93

C:\Users\Admin\AppData\Local\Temp\54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Users\Admin\AppData\Local\Temp\54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\54d36d7af43725550fdd099ea1efd443_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:3128
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 484
      4⤵
      Program crash
      PID:2536
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 492
      4⤵
      Program crash
      PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:1296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3128 -ip 3128
1⤵
PID:1840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3128 -ip 3128
1⤵
PID:3588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3128-10-0x0000000010000000-0x00000000100C3000-memory.dmp

Download

memory/3128-12-0x0000000010000000-0x00000000100C3000-memory.dmp

Download

memory/3468-3-0x0000000010000000-0x00000000100C3000-memory.dmp

Download

memory/3468-6-0x0000000010000000-0x00000000100C3000-memory.dmp

Download

memory/3468-9-0x0000000010000000-0x00000000100C3000-memory.dmp

Download

memory/3468-7-0x0000000010000000-0x00000000100C3000-memory.dmp

Download

memory/3468-11-0x0000000010000000-0x00000000100C3000-memory.dmp

Download

memory/3784-0-0x0000000074792000-0x0000000074793000-memory.dmp

Download

memory/3784-1-0x0000000074790000-0x0000000074D41000-memory.dmp

Download

memory/3784-2-0x0000000074790000-0x0000000074D41000-memory.dmp

Download

memory/3784-8-0x0000000074790000-0x0000000074D41000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads