xtremerat | 58fec54f8d625d5bb7b4347d3ae06b7efe6f008db3e44b7b38cf8314c7b72fb5

General

Target

290cfa288bb1366ad9c3c16772f571bd_JaffaCakes118.exe
Size

425KB
MD5

290cfa288bb1366ad9c3c16772f571bd
SHA1

6894221c0fca1a5baff2752870c18c74a5bc99d2
SHA256

58fec54f8d625d5bb7b4347d3ae06b7efe6f008db3e44b7b38cf8314c7b72fb5
SHA512

a8ce71ad9a5a304f7f33869610645a85f78f2ad1d61995ffea757024193130d294bcb871b3021fb66e4bec6582a9312cc60d80ae533ee65df26b935711f0f538
SSDEEP

12288:y2u4sum+hlTEqUZoYX+KdC3R+kFifVucdSSEc:GKmGlTEZo8eRpFifMtc

Score

10^/10

xtremerat discovery persistence rat spyware upx

Malware Config

Extracted

Family

xtremerat

C2

eminn115.zapto.org

Signatures

Detect XtremeRAT payload 6 IoCs

resource	yara_rule
behavioral1/memory/2744-56-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral1/memory/2636-64-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral1/memory/3016-67-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral1/memory/3016-69-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral1/memory/2636-71-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral1/memory/3016-72-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{85WBO231-28H5-XP66-720W-F8NHJ8873J2S}\StubPath = "C:\\Windows\\system32\\InstallDir\\svchost.exe restart"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{85WBO231-28H5-XP66-720W-F8NHJ8873J2S}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{85WBO231-28H5-XP66-720W-F8NHJ8873J2S}\StubPath = "C:\\Windows\\system32\\InstallDir\\svchost.exe"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{85WBO231-28H5-XP66-720W-F8NHJ8873J2S}	explorer.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\svchost.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\svchost.exe"	explorer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\InstallDir\svchost.exe	explorer.exe
File created	C:\Windows\SysWOW64\InstallDir\svchost.exe	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2208 set thread context of 2744	2208	290cfa288bb1366ad9c3c16772f571bd_JaffaCakes118.exe	30

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2744-49-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/2744-55-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/2744-56-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/2744-53-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/2744-50-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/2636-64-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/3016-67-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/3016-69-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/2636-71-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/3016-72-0x0000000010000000-0x000000001004D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	290cfa288bb1366ad9c3c16772f571bd_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	290cfa288bb1366ad9c3c16772f571bd_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

NTFS ADS 3 IoCs

description	ioc	Process
File created	C:\ProgramData:$SS_DESCRIPTOR_SBXNV9VVGV1BF1646XBHV2FJW016YRF47TPBJNGFSVF7VB4VP4GF	290cfa288bb1366ad9c3c16772f571bd_JaffaCakes118.exe
File created	C:\ProgramData\DYA_AOTCDGIILGPMOMALC\1.0.0:$SS_DESCRIPTOR_SBXNV9VVGV1BF1646XBHV2FJW016YRF47TPBJNGFSVF7VB4VP4GF	290cfa288bb1366ad9c3c16772f571bd_JaffaCakes118.exe
File created	C:\Users\Public\Desktop:$SS_DESCRIPTOR_SBXNV9VVGV1BF1646XBHV2FJW016YRF47TPBJNGFSVF7VB4VP4GF	290cfa288bb1366ad9c3c16772f571bd_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2208	290cfa288bb1366ad9c3c16772f571bd_JaffaCakes118.exe
3016	explorer.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2744	2208	290cfa288bb1366ad9c3c16772f571bd_JaffaCakes118.exe	30
PID 2208 wrote to memory of 2744	2208	290cfa288bb1366ad9c3c16772f571bd_JaffaCakes118.exe	30
PID 2208 wrote to memory of 2744	2208	290cfa288bb1366ad9c3c16772f571bd_JaffaCakes118.exe	30
PID 2208 wrote to memory of 2744	2208	290cfa288bb1366ad9c3c16772f571bd_JaffaCakes118.exe	30
PID 2208 wrote to memory of 2744	2208	290cfa288bb1366ad9c3c16772f571bd_JaffaCakes118.exe	30
PID 2208 wrote to memory of 2744	2208	290cfa288bb1366ad9c3c16772f571bd_JaffaCakes118.exe	30
PID 2208 wrote to memory of 2744	2208	290cfa288bb1366ad9c3c16772f571bd_JaffaCakes118.exe	30
PID 2208 wrote to memory of 2744	2208	290cfa288bb1366ad9c3c16772f571bd_JaffaCakes118.exe	30
PID 2744 wrote to memory of 2636	2744	290cfa288bb1366ad9c3c16772f571bd_JaffaCakes118.exe	31
PID 2744 wrote to memory of 2636	2744	290cfa288bb1366ad9c3c16772f571bd_JaffaCakes118.exe	31
PID 2744 wrote to memory of 2636	2744	290cfa288bb1366ad9c3c16772f571bd_JaffaCakes118.exe	31
PID 2744 wrote to memory of 2636	2744	290cfa288bb1366ad9c3c16772f571bd_JaffaCakes118.exe	31
PID 2744 wrote to memory of 2636	2744	290cfa288bb1366ad9c3c16772f571bd_JaffaCakes118.exe	31
PID 2744 wrote to memory of 3016	2744	290cfa288bb1366ad9c3c16772f571bd_JaffaCakes118.exe	32
PID 2744 wrote to memory of 3016	2744	290cfa288bb1366ad9c3c16772f571bd_JaffaCakes118.exe	32
PID 2744 wrote to memory of 3016	2744	290cfa288bb1366ad9c3c16772f571bd_JaffaCakes118.exe	32
PID 2744 wrote to memory of 3016	2744	290cfa288bb1366ad9c3c16772f571bd_JaffaCakes118.exe	32
PID 2744 wrote to memory of 3016	2744	290cfa288bb1366ad9c3c16772f571bd_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\290cfa288bb1366ad9c3c16772f571bd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\290cfa288bb1366ad9c3c16772f571bd_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Users\Admin\AppData\Local\Temp\290cfa288bb1366ad9c3c16772f571bd_JaffaCakes118.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:2636
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Active Setup

1

T1547.014

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Active Setup

1

T1547.014

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\DYA_AOTCDGIILGPMOMALC\1.0.0\Data\app.dat

Filesize
971B

MD5
bc927f9c98623eb2f1beefde02085316

SHA1
1421822873d453d24f874a10d7d1293f463b7f39

SHA256
3fc2933b01a45913d9599df921784bbc85ff754b265b289a24e15e5a5fdf4717

SHA512
bf1ba87f836d7e2f8b2d30eecf9052959395d7d94493e4a5e66f24c0f3ea4ea529b3da03be2024c86d3479310130d7f6421c13aa45ecaa5929d070c2c082782e

Download Submit
C:\ProgramData\DYA_AOTCDGIILGPMOMALC\1.0.0\Data\updates.dat

Filesize
971B

MD5
1672edcaa69fcd6696d210fc27d84760

SHA1
237db715a17c381a2380a34b9f8f7c487745d12e

SHA256
f03b737036e9bd0994ccf00e196a9e13906a60bdeae5fbe39cfb5d84928c78d8

SHA512
ec640b23882c32ee0cd76b6aafa9c5e65bbf65a15d9a8ed2ae95364a2f1c40bce3202cafa7adebda9f39d69f299fb9aee86a3683ce1b67664bddb49d4982371c

Download Submit
C:\Users\Admin\AppData\Roaming\DYA_AOTCDGIILGPMOMALC\1.0.0\Data\dya.dat

Filesize
971B

MD5
954c62ee6376d7502831ae39831caadc

SHA1
75860379a9f0ae31e3b21fc9fc839f3f534c792b

SHA256
1d7e0004629ce379e7c39f3416111cede15f1badb5d232dad40c56371f647ef7

SHA512
d8dbd31c6c4e09035a88e1ceea90d54a37c8472b955c1db9fc06fd0bc0c1712c2047060d1aabc5f34205015de8e081dea536bcdb3ab4bfb56679c6281c98d1af

Download Submit
C:\Windows\SysWOW64\InstallDir\svchost.exe

Filesize
425KB

MD5
290cfa288bb1366ad9c3c16772f571bd

SHA1
6894221c0fca1a5baff2752870c18c74a5bc99d2

SHA256
58fec54f8d625d5bb7b4347d3ae06b7efe6f008db3e44b7b38cf8314c7b72fb5

SHA512
a8ce71ad9a5a304f7f33869610645a85f78f2ad1d61995ffea757024193130d294bcb871b3021fb66e4bec6582a9312cc60d80ae533ee65df26b935711f0f538

Download Submit
memory/2208-60-0x0000000000400000-0x00000000004ABB0C-memory.dmp

Filesize
686KB

Download
memory/2208-1-0x000000000040A000-0x00000000004A7000-memory.dmp

Filesize
628KB

Download
memory/2208-43-0x0000000000400000-0x00000000004ABB0C-memory.dmp

Filesize
686KB

Download
memory/2208-44-0x0000000000400000-0x00000000004ABB0C-memory.dmp

Filesize
686KB

Download
memory/2208-47-0x0000000000400000-0x00000000004ABB0C-memory.dmp

Filesize
686KB

Download
memory/2208-0-0x0000000000400000-0x00000000004ABB0C-memory.dmp

Filesize
686KB

Download
memory/2208-59-0x000000000040A000-0x00000000004A7000-memory.dmp

Filesize
628KB

Download
memory/2636-64-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2636-71-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2744-56-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2744-53-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2744-57-0x0000000000400000-0x00000000004ABB0C-memory.dmp

Filesize
686KB

Download
memory/2744-55-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2744-51-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2744-50-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2744-49-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2744-48-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/3016-67-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/3016-69-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/3016-72-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads