xtremerat | 9ad895c6c959ef97efe53a5ac2b2f1a3c335dffabaf919faf5083b16e10d5450

General

Target

6585a16b111cd1a1d4992050a6207735_JaffaCakes118.exe
Size

297KB
MD5

6585a16b111cd1a1d4992050a6207735
SHA1

817cd0f83fd70a49d0c7336175f507cf4b989058
SHA256

9ad895c6c959ef97efe53a5ac2b2f1a3c335dffabaf919faf5083b16e10d5450
SHA512

0fa51be1433d2060ec09748826ac03c230b8b638d661af09266b909533ce147e2a450188ab9a73e332ee20928f94ae8e5f62e7285dbfbb788ba119871f1a1e3c
SSDEEP

6144:nhWxjk0EdatAbulIY24ku3n6DJRMqw6B+HaBZz0mfA:nOjk0gatIMkh51z+

Score

10^/10

xtremerat discovery persistence rat spyware

Malware Config

Extracted

Family

xtremerat

C2

2hask.no-ip.biz

Signatures

Detect XtremeRAT payload 6 IoCs

resource	yara_rule
behavioral2/memory/5068-0-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral2/memory/5068-1-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral2/memory/5068-2-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral2/memory/5068-3-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral2/memory/4712-4-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral2/memory/5068-5-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 456 set thread context of 5068	456	6585a16b111cd1a1d4992050a6207735_JaffaCakes118.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
100	456	WerFault.exe	83
3404	456	WerFault.exe	83
1808	4712	WerFault.exe	93
4764	4712	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6585a16b111cd1a1d4992050a6207735_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6585a16b111cd1a1d4992050a6207735_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 5068	456	6585a16b111cd1a1d4992050a6207735_JaffaCakes118.exe	90
PID 456 wrote to memory of 5068	456	6585a16b111cd1a1d4992050a6207735_JaffaCakes118.exe	90
PID 456 wrote to memory of 5068	456	6585a16b111cd1a1d4992050a6207735_JaffaCakes118.exe	90
PID 456 wrote to memory of 5068	456	6585a16b111cd1a1d4992050a6207735_JaffaCakes118.exe	90
PID 456 wrote to memory of 5068	456	6585a16b111cd1a1d4992050a6207735_JaffaCakes118.exe	90
PID 456 wrote to memory of 5068	456	6585a16b111cd1a1d4992050a6207735_JaffaCakes118.exe	90
PID 456 wrote to memory of 5068	456	6585a16b111cd1a1d4992050a6207735_JaffaCakes118.exe	90
PID 456 wrote to memory of 5068	456	6585a16b111cd1a1d4992050a6207735_JaffaCakes118.exe	90
PID 456 wrote to memory of 5068	456	6585a16b111cd1a1d4992050a6207735_JaffaCakes118.exe	90
PID 456 wrote to memory of 5068	456	6585a16b111cd1a1d4992050a6207735_JaffaCakes118.exe	90
PID 456 wrote to memory of 5068	456	6585a16b111cd1a1d4992050a6207735_JaffaCakes118.exe	90
PID 456 wrote to memory of 5068	456	6585a16b111cd1a1d4992050a6207735_JaffaCakes118.exe	90
PID 456 wrote to memory of 5068	456	6585a16b111cd1a1d4992050a6207735_JaffaCakes118.exe	90
PID 5068 wrote to memory of 4712	5068	6585a16b111cd1a1d4992050a6207735_JaffaCakes118.exe	93
PID 5068 wrote to memory of 4712	5068	6585a16b111cd1a1d4992050a6207735_JaffaCakes118.exe	93
PID 5068 wrote to memory of 4712	5068	6585a16b111cd1a1d4992050a6207735_JaffaCakes118.exe	93
PID 5068 wrote to memory of 4712	5068	6585a16b111cd1a1d4992050a6207735_JaffaCakes118.exe	93

C:\Users\Admin\AppData\Local\Temp\6585a16b111cd1a1d4992050a6207735_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6585a16b111cd1a1d4992050a6207735_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 384
  2⤵
  - Program crash
  PID:100
- C:\Users\Admin\AppData\Local\Temp\6585a16b111cd1a1d4992050a6207735_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\6585a16b111cd1a1d4992050a6207735_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    NOTEPAD.EXE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4712
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 480
      4⤵
      Program crash
      PID:1808
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 488
      4⤵
      Program crash
      PID:4764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 140
  2⤵
  - Program crash
  PID:3404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 456 -ip 456
1⤵
PID:4160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 456 -ip 456
1⤵
PID:1476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4712 -ip 4712
1⤵
PID:652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4712 -ip 4712
1⤵
PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/456-6-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4712-4-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/5068-0-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/5068-1-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/5068-2-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/5068-3-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/5068-5-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download

Analysis

Sharing