xtremerat | bd78819965d792d7f010f502397bbdad55ac60300dcf5b01b326253944de18b4

General

Target

62f6b55f3fde6ee912563ac18897e451_JaffaCakes118.exe
Size

844KB
MD5

62f6b55f3fde6ee912563ac18897e451
SHA1

90e56bc7fd62deca734fa471bc5aa41eca1c2110
SHA256

bd78819965d792d7f010f502397bbdad55ac60300dcf5b01b326253944de18b4
SHA512

9dd730b9cad395c6a54dfba1cc9812b942c68f73c5a5048926188162de2efc5e340bfffc8fd6aeddb6ac1c0f9fe1b2eb660cbe7dd2a3ff16dccebc10eeabc9e0
SSDEEP

3072:b1M6fRXfyp23XxVVqG1l7fGpI9D2cH97x0LEXzO3j3Zqe6KaYKOT9KlRTmbmQkom:Z//vwE8nfVndQfUThTnBEa

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Extracted

Family

xtremerat

C2

memozzz.no-ip.org

Signatures

Detect XtremeRAT payload 6 IoCs

resource	yara_rule
behavioral2/memory/3068-7-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral2/memory/3068-8-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral2/memory/3624-9-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral2/memory/1676-10-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral2/memory/3068-11-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral2/memory/3624-14-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3068-3-0x0000000010000000-0x0000000010048000-memory.dmp	upx
behavioral2/memory/3068-5-0x0000000010000000-0x0000000010048000-memory.dmp	upx
behavioral2/memory/3068-7-0x0000000010000000-0x0000000010048000-memory.dmp	upx
behavioral2/memory/3068-8-0x0000000010000000-0x0000000010048000-memory.dmp	upx
behavioral2/memory/3624-9-0x0000000010000000-0x0000000010048000-memory.dmp	upx
behavioral2/memory/1676-10-0x0000000010000000-0x0000000010048000-memory.dmp	upx
behavioral2/memory/3068-11-0x0000000010000000-0x0000000010048000-memory.dmp	upx
behavioral2/memory/3624-14-0x0000000010000000-0x0000000010048000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4532 set thread context of 3068	4532	62f6b55f3fde6ee912563ac18897e451_JaffaCakes118.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1372	1676	WerFault.exe	89
5060	3624	WerFault.exe	88
112	1676	WerFault.exe	89
4480	3624	WerFault.exe	88

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4532	62f6b55f3fde6ee912563ac18897e451_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 3068	4532	62f6b55f3fde6ee912563ac18897e451_JaffaCakes118.exe	86
PID 4532 wrote to memory of 3068	4532	62f6b55f3fde6ee912563ac18897e451_JaffaCakes118.exe	86
PID 4532 wrote to memory of 3068	4532	62f6b55f3fde6ee912563ac18897e451_JaffaCakes118.exe	86
PID 4532 wrote to memory of 3068	4532	62f6b55f3fde6ee912563ac18897e451_JaffaCakes118.exe	86
PID 4532 wrote to memory of 3068	4532	62f6b55f3fde6ee912563ac18897e451_JaffaCakes118.exe	86
PID 4532 wrote to memory of 3068	4532	62f6b55f3fde6ee912563ac18897e451_JaffaCakes118.exe	86
PID 4532 wrote to memory of 3068	4532	62f6b55f3fde6ee912563ac18897e451_JaffaCakes118.exe	86
PID 4532 wrote to memory of 3068	4532	62f6b55f3fde6ee912563ac18897e451_JaffaCakes118.exe	86
PID 3068 wrote to memory of 3624	3068	62f6b55f3fde6ee912563ac18897e451_JaffaCakes118.exe	88
PID 3068 wrote to memory of 3624	3068	62f6b55f3fde6ee912563ac18897e451_JaffaCakes118.exe	88
PID 3068 wrote to memory of 3624	3068	62f6b55f3fde6ee912563ac18897e451_JaffaCakes118.exe	88
PID 3068 wrote to memory of 3624	3068	62f6b55f3fde6ee912563ac18897e451_JaffaCakes118.exe	88
PID 3068 wrote to memory of 1676	3068	62f6b55f3fde6ee912563ac18897e451_JaffaCakes118.exe	89
PID 3068 wrote to memory of 1676	3068	62f6b55f3fde6ee912563ac18897e451_JaffaCakes118.exe	89
PID 3068 wrote to memory of 1676	3068	62f6b55f3fde6ee912563ac18897e451_JaffaCakes118.exe	89
PID 3068 wrote to memory of 1676	3068	62f6b55f3fde6ee912563ac18897e451_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\62f6b55f3fde6ee912563ac18897e451_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\62f6b55f3fde6ee912563ac18897e451_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Users\Admin\AppData\Local\Temp\62f6b55f3fde6ee912563ac18897e451_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\62f6b55f3fde6ee912563ac18897e451_JaffaCakes118.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:3624
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 480
      4⤵
      Program crash
      PID:5060
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 488
      4⤵
      Program crash
      PID:4480
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:1676
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 476
      4⤵
      Program crash
      PID:1372
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 500
      4⤵
      Program crash
      PID:112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3624 -ip 3624
1⤵
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1676 -ip 1676
1⤵
PID:1504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1676 -ip 1676
1⤵
PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3624 -ip 3624
1⤵
PID:748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1676-10-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/3068-3-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/3068-5-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/3068-7-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/3068-8-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/3068-11-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/3624-9-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/3624-14-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/4532-0-0x0000000000400000-0x00000000004D3000-memory.dmp

Filesize
844KB

Download
memory/4532-6-0x0000000000400000-0x00000000004D3000-memory.dmp

Filesize
844KB

Download

Analysis

Sharing