xtremerat | 4676808324eee00c7f4e07a2e39bf148b18728511d56b72ccce7b96ead559445

General

Target

82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe
Size

4.9MB
MD5

82d4848af83cbe287d12dab83a5cc2cb
SHA1

b81f86207a4a115e764cfd6e2f484d1989536423
SHA256

4676808324eee00c7f4e07a2e39bf148b18728511d56b72ccce7b96ead559445
SHA512

0f2e5607915529ae156bb2b42e5b37459151bce98220c2bd5a244adbe96e5f78c2479efac8d3d126a3e07b8157f0030ffdf0d2e9b5561c366ec4642b841b6ae1
SSDEEP

98304:zMIUCd4ys7sl28GQ0vQ8nWvrQbCH1bM65wfdIkzyIn9OhbFvZvnjgXWD:g8dmM2BvRn4hY1IkRavZP9

Score

10^/10

xtremerat discovery persistence rat spyware upx

Malware Config

Signatures

Detect XtremeRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2888-5-0x0000000000C80000-0x0000000001164000-memory.dmp	family_xtremerat
behavioral1/memory/2756-17-0x0000000000C80000-0x0000000001164000-memory.dmp	family_xtremerat
behavioral1/memory/2888-20-0x0000000000C80000-0x0000000001164000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Xtremerat family
xtremerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

Processes:

82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

842XtremeRAT.exe

pid process

2884 842XtremeRAT.exe
Loads dropped DLL 1 IoCs

Processes:

82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe

pid process

2756 82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe

pid	process
2884	842XtremeRAT.exe

pid	process
2756	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\842XtremeRAT.exe	upx
behavioral1/memory/2884-16-0x0000000000400000-0x0000000000F20000-memory.dmp	upx
behavioral1/memory/2884-21-0x0000000000400000-0x0000000000F20000-memory.dmp	upx
behavioral1/memory/2884-23-0x0000000000400000-0x0000000000F20000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

Processes:

82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\InstallDir\Server.exe	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe
File created	C:\Windows\InstallDir\Server.exe	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

NOTEPAD.EXE842XtremeRAT.exe82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exeexplorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	842XtremeRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

876 NOTEPAD.EXE
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

explorer.exe842XtremeRAT.exe

pid process

2888 explorer.exe
2884 842XtremeRAT.exe
2884 842XtremeRAT.exe

pid	process
876	NOTEPAD.EXE

pid	process
2888	explorer.exe
2884	842XtremeRAT.exe
2884	842XtremeRAT.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe

description	pid	process	target process
PID 2756 wrote to memory of 2824	2756	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	iexplore.exe
PID 2756 wrote to memory of 2824	2756	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	iexplore.exe
PID 2756 wrote to memory of 2824	2756	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	iexplore.exe
PID 2756 wrote to memory of 2824	2756	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	iexplore.exe
PID 2756 wrote to memory of 2888	2756	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	explorer.exe
PID 2756 wrote to memory of 2888	2756	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	explorer.exe
PID 2756 wrote to memory of 2888	2756	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	explorer.exe
PID 2756 wrote to memory of 2888	2756	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	explorer.exe
PID 2756 wrote to memory of 2888	2756	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	explorer.exe
PID 2756 wrote to memory of 2884	2756	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	842XtremeRAT.exe
PID 2756 wrote to memory of 2884	2756	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	842XtremeRAT.exe
PID 2756 wrote to memory of 2884	2756	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	842XtremeRAT.exe
PID 2756 wrote to memory of 2884	2756	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	842XtremeRAT.exe
PID 2756 wrote to memory of 876	2756	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	NOTEPAD.EXE
PID 2756 wrote to memory of 876	2756	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	NOTEPAD.EXE
PID 2756 wrote to memory of 876	2756	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	NOTEPAD.EXE
PID 2756 wrote to memory of 876	2756	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	NOTEPAD.EXE

C:\Users\Admin\AppData\Local\Temp\82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:2824
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2888
- C:\Users\Admin\AppData\Local\Temp\842XtremeRAT.exe
  "C:\Users\Admin\AppData\Local\Temp\842XtremeRAT.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2884
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\849new1.ini
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Active Setup

1

T1547.014

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Active Setup

1

T1547.014

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\849new1.ini

Filesize
1000B

MD5
428d20769489d1153dd08c709d063a8c

SHA1
fdc30097a680d82b7eb07d90ea5171870000e81f

SHA256
8d14d760731b774e8630f2988dde4dff3a0af7517cc8a01c49b9ea321b722f6b

SHA512
9b128c8ef1d8cb295059bb7fd997b3be71f5ee376435705d5ce19c968471721f1c22dfb6841bab47e6abad1e57b848cf80913bfeee708ecc50019e7c323b4379

Download Submit
\Users\Admin\AppData\Local\Temp\842XtremeRAT.exe

Filesize
4.8MB

MD5
bec89e4fbab9bcbb28c581d98b0e3074

SHA1
0cb0979815b8ac1b63b4be8f0813be702a238598

SHA256
f5742189e3724c9578e3284939842b390506df1bc609149f4a7dae4e5eacabd9

SHA512
cff57c199bc7bebc39140876193c3ed1076a4ea2a85ea437f388ab92b0ed131c7e34ace1408bd3a65349fc8d6009e4966907b82eae7fb718bb597881ae65678d

Download Submit
memory/2756-14-0x0000000003920000-0x0000000004440000-memory.dmp

Filesize
11.1MB

Download
memory/2756-17-0x0000000000C80000-0x0000000001164000-memory.dmp

Filesize
4.9MB

Download
memory/2884-16-0x0000000000400000-0x0000000000F20000-memory.dmp

Filesize
11.1MB

Download
memory/2884-21-0x0000000000400000-0x0000000000F20000-memory.dmp

Filesize
11.1MB

Download
memory/2884-23-0x0000000000400000-0x0000000000F20000-memory.dmp

Filesize
11.1MB

Download
memory/2888-3-0x0000000000C80000-0x0000000001164000-memory.dmp

Filesize
4.9MB

Download
memory/2888-5-0x0000000000C80000-0x0000000001164000-memory.dmp

Filesize
4.9MB

Download
memory/2888-20-0x0000000000C80000-0x0000000001164000-memory.dmp

Filesize
4.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads