xtremerat | 7b549fb19246fd999a7781dd854b9a4325adcac1bb158b9043519a0cebaffd10

General

Target
5a20504cee20faa9b49cc17601a028f5_JaffaCakes118.exe
Size 111KB
Sample240719-c49y4ssbla
SHA256 7b549fb19246fd999a7781dd854b9a4325adcac1bb158b9043519a0cebaffd10
MD5 5a20504cee20faa9b49cc17601a028f5
SHA1 f542fc73657ffd41ac5958e84a07115bf336c6d3
SHA512 2a22fc88da4b963c06b9ed0561cf42cd8935581e7a31857aaa806bd02d10d1791e155014e58576a0db227e8090578ca50765d8cc4b10a802205eb50494afdddc
SSDEEP 1536:gZW7LhSyuZh5IZpScr01+ga3XVMWB9fMcqhyLFkr/nyTkBXQmbUmb6:gkLcoScg1banKdBkZkr/nfBXQqUW6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

Detect XtremeRAT payload 8 IoCs

resource	yara_rule
behavioral2/memory/1544-3-0x0000000010000000-0x0000000010047000-memory.dmp	family_xtremerat
behavioral2/memory/1544-4-0x0000000010000000-0x0000000010047000-memory.dmp	family_xtremerat
behavioral2/memory/1544-7-0x0000000010000000-0x0000000010047000-memory.dmp	family_xtremerat
behavioral2/memory/1544-8-0x0000000010000000-0x0000000010047000-memory.dmp	family_xtremerat
behavioral2/memory/3928-9-0x0000000010000000-0x0000000010047000-memory.dmp	family_xtremerat
behavioral2/memory/3288-10-0x0000000010000000-0x0000000010047000-memory.dmp	family_xtremerat
behavioral2/memory/1544-11-0x0000000010000000-0x0000000010047000-memory.dmp	family_xtremerat
behavioral2/memory/3928-12-0x0000000010000000-0x0000000010047000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 620 set thread context of 1544	620	5a20504cee20faa9b49cc17601a028f5_JaffaCakes118.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1972	3288	WerFault.exe	88
208	3928	WerFault.exe	86
1668	3288	WerFault.exe	88
3192	3928	WerFault.exe	86

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
620	5a20504cee20faa9b49cc17601a028f5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 1544	620	5a20504cee20faa9b49cc17601a028f5_JaffaCakes118.exe	84
PID 620 wrote to memory of 1544	620	5a20504cee20faa9b49cc17601a028f5_JaffaCakes118.exe	84
PID 620 wrote to memory of 1544	620	5a20504cee20faa9b49cc17601a028f5_JaffaCakes118.exe	84
PID 620 wrote to memory of 1544	620	5a20504cee20faa9b49cc17601a028f5_JaffaCakes118.exe	84
PID 620 wrote to memory of 1544	620	5a20504cee20faa9b49cc17601a028f5_JaffaCakes118.exe	84
PID 620 wrote to memory of 1544	620	5a20504cee20faa9b49cc17601a028f5_JaffaCakes118.exe	84
PID 620 wrote to memory of 1544	620	5a20504cee20faa9b49cc17601a028f5_JaffaCakes118.exe	84
PID 620 wrote to memory of 1544	620	5a20504cee20faa9b49cc17601a028f5_JaffaCakes118.exe	84
PID 620 wrote to memory of 1544	620	5a20504cee20faa9b49cc17601a028f5_JaffaCakes118.exe	84
PID 620 wrote to memory of 1544	620	5a20504cee20faa9b49cc17601a028f5_JaffaCakes118.exe	84
PID 620 wrote to memory of 1544	620	5a20504cee20faa9b49cc17601a028f5_JaffaCakes118.exe	84
PID 620 wrote to memory of 1544	620	5a20504cee20faa9b49cc17601a028f5_JaffaCakes118.exe	84
PID 620 wrote to memory of 1544	620	5a20504cee20faa9b49cc17601a028f5_JaffaCakes118.exe	84
PID 1544 wrote to memory of 3928	1544	5a20504cee20faa9b49cc17601a028f5_JaffaCakes118.exe	86
PID 1544 wrote to memory of 3928	1544	5a20504cee20faa9b49cc17601a028f5_JaffaCakes118.exe	86
PID 1544 wrote to memory of 3928	1544	5a20504cee20faa9b49cc17601a028f5_JaffaCakes118.exe	86
PID 1544 wrote to memory of 3928	1544	5a20504cee20faa9b49cc17601a028f5_JaffaCakes118.exe	86
PID 1544 wrote to memory of 3288	1544	5a20504cee20faa9b49cc17601a028f5_JaffaCakes118.exe	88
PID 1544 wrote to memory of 3288	1544	5a20504cee20faa9b49cc17601a028f5_JaffaCakes118.exe	88
PID 1544 wrote to memory of 3288	1544	5a20504cee20faa9b49cc17601a028f5_JaffaCakes118.exe	88
PID 1544 wrote to memory of 3288	1544	5a20504cee20faa9b49cc17601a028f5_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\5a20504cee20faa9b49cc17601a028f5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5a20504cee20faa9b49cc17601a028f5_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:620
- C:\Users\Admin\AppData\Local\Temp\5a20504cee20faa9b49cc17601a028f5_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\5a20504cee20faa9b49cc17601a028f5_JaffaCakes118.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:3928
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 480
      4⤵
      Program crash
      PID:208
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 488
      4⤵
      Program crash
      PID:3192
- - C:\Windows\SysWOW64\notepad.exe
    notepad.exe
    3⤵
    PID:3288
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 480
      4⤵
      Program crash
      PID:1972
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 488
      4⤵
      Program crash
      PID:1668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3928 -ip 3928
1⤵
PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3288 -ip 3288
1⤵
PID:2292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3288 -ip 3288
1⤵
PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3928 -ip 3928
1⤵
PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/620-0-0x0000000000400000-0x000000000046A000-memory.dmp

Download

memory/620-6-0x0000000000400000-0x000000000046A000-memory.dmp

Download

memory/1544-3-0x0000000010000000-0x0000000010047000-memory.dmp

Download

memory/1544-4-0x0000000010000000-0x0000000010047000-memory.dmp

Download

memory/1544-7-0x0000000010000000-0x0000000010047000-memory.dmp

Download

memory/1544-8-0x0000000010000000-0x0000000010047000-memory.dmp

Download

memory/1544-11-0x0000000010000000-0x0000000010047000-memory.dmp

Download

memory/3288-10-0x0000000010000000-0x0000000010047000-memory.dmp

Download

memory/3928-9-0x0000000010000000-0x0000000010047000-memory.dmp

Download

memory/3928-12-0x0000000010000000-0x0000000010047000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads