xtremerat | 4676808324eee00c7f4e07a2e39bf148b18728511d56b72ccce7b96ead559445

Analysis

max time kernel
147s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-10-2024 11:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe
Size

4.9MB
MD5

82d4848af83cbe287d12dab83a5cc2cb
SHA1

b81f86207a4a115e764cfd6e2f484d1989536423
SHA256

4676808324eee00c7f4e07a2e39bf148b18728511d56b72ccce7b96ead559445
SHA512

0f2e5607915529ae156bb2b42e5b37459151bce98220c2bd5a244adbe96e5f78c2479efac8d3d126a3e07b8157f0030ffdf0d2e9b5561c366ec4642b841b6ae1
SSDEEP

98304:zMIUCd4ys7sl28GQ0vQ8nWvrQbCH1bM65wfdIkzyIn9OhbFvZvnjgXWD:g8dmM2BvRn4hY1IkRavZP9

Score

10^/10

xtremerat discovery persistence rat spyware upx

Malware Config

Signatures

Detect XtremeRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/4904-18-0x0000000000C80000-0x0000000001164000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Xtremerat family
xtremerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1544	842XtremeRAT.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0002000000022a9f-8.dat	upx
behavioral2/memory/1544-15-0x0000000000400000-0x0000000000F20000-memory.dmp	upx
behavioral2/memory/1544-19-0x0000000000400000-0x0000000000F20000-memory.dmp	upx
behavioral2/memory/1544-23-0x0000000000400000-0x0000000000F20000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InstallDir\Server.exe	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe
File created	C:\Windows\InstallDir\Server.exe	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	842XtremeRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3860	NOTEPAD.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe
1544	842XtremeRAT.exe
1544	842XtremeRAT.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 4628	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	85
PID 4904 wrote to memory of 4628	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	85
PID 4904 wrote to memory of 4476	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	86
PID 4904 wrote to memory of 4476	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	86
PID 4904 wrote to memory of 4476	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	86
PID 4904 wrote to memory of 1380	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	89
PID 4904 wrote to memory of 1380	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	89
PID 4904 wrote to memory of 2164	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	90
PID 4904 wrote to memory of 2164	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	90
PID 4904 wrote to memory of 2164	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	90
PID 4904 wrote to memory of 3068	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	91
PID 4904 wrote to memory of 3068	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	91
PID 4904 wrote to memory of 2368	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	92
PID 4904 wrote to memory of 2368	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	92
PID 4904 wrote to memory of 2368	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	92
PID 4904 wrote to memory of 4472	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	93
PID 4904 wrote to memory of 4472	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	93
PID 4904 wrote to memory of 4156	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	94
PID 4904 wrote to memory of 4156	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	94
PID 4904 wrote to memory of 4156	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	94
PID 4904 wrote to memory of 4520	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	95
PID 4904 wrote to memory of 4520	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	95
PID 4904 wrote to memory of 4312	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	96
PID 4904 wrote to memory of 4312	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	96
PID 4904 wrote to memory of 4312	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	96
PID 4904 wrote to memory of 1920	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	98
PID 4904 wrote to memory of 1920	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	98
PID 4904 wrote to memory of 436	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	99
PID 4904 wrote to memory of 436	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	99
PID 4904 wrote to memory of 436	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	99
PID 4904 wrote to memory of 3508	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	100
PID 4904 wrote to memory of 3508	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	100
PID 4904 wrote to memory of 2012	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	101
PID 4904 wrote to memory of 2012	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	101
PID 4904 wrote to memory of 2012	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	101
PID 4904 wrote to memory of 380	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	104
PID 4904 wrote to memory of 380	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	104
PID 4904 wrote to memory of 4396	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	105
PID 4904 wrote to memory of 4396	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	105
PID 4904 wrote to memory of 4396	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	105
PID 4904 wrote to memory of 1044	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	106
PID 4904 wrote to memory of 1044	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	106
PID 4904 wrote to memory of 2108	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	107
PID 4904 wrote to memory of 2108	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	107
PID 4904 wrote to memory of 2108	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	107
PID 4904 wrote to memory of 3548	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	110
PID 4904 wrote to memory of 3548	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	110
PID 4904 wrote to memory of 5048	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	111
PID 4904 wrote to memory of 5048	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	111
PID 4904 wrote to memory of 5048	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	111
PID 4904 wrote to memory of 4960	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	112
PID 4904 wrote to memory of 4960	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	112
PID 4904 wrote to memory of 3480	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	113
PID 4904 wrote to memory of 3480	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	113
PID 4904 wrote to memory of 3480	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	113
PID 4904 wrote to memory of 1028	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	115
PID 4904 wrote to memory of 1028	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	115
PID 4904 wrote to memory of 3496	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	116
PID 4904 wrote to memory of 3496	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	116
PID 4904 wrote to memory of 3496	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	116
PID 4904 wrote to memory of 3760	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	117
PID 4904 wrote to memory of 3760	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	117
PID 4904 wrote to memory of 2748	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	118
PID 4904 wrote to memory of 2748	4904	82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe	118

C:\Users\Admin\AppData\Local\Temp\82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\82d4848af83cbe287d12dab83a5cc2cb_JaffaCakes118.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4628
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1380
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3068
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4472
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4520
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1920
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3508
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:380
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1044
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3548
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4960
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1028
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3760
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1276
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4876
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:3656
- C:\Users\Admin\AppData\Local\Temp\842XtremeRAT.exe
  "C:\Users\Admin\AppData\Local\Temp\842XtremeRAT.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1544
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\849new1.ini
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:3860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\842XtremeRAT.exe

Filesize
4.8MB

MD5
bec89e4fbab9bcbb28c581d98b0e3074

SHA1
0cb0979815b8ac1b63b4be8f0813be702a238598

SHA256
f5742189e3724c9578e3284939842b390506df1bc609149f4a7dae4e5eacabd9

SHA512
cff57c199bc7bebc39140876193c3ed1076a4ea2a85ea437f388ab92b0ed131c7e34ace1408bd3a65349fc8d6009e4966907b82eae7fb718bb597881ae65678d

Download Submit
C:\Users\Admin\AppData\Local\Temp\849new1.ini

Filesize
1000B

MD5
428d20769489d1153dd08c709d063a8c

SHA1
fdc30097a680d82b7eb07d90ea5171870000e81f

SHA256
8d14d760731b774e8630f2988dde4dff3a0af7517cc8a01c49b9ea321b722f6b

SHA512
9b128c8ef1d8cb295059bb7fd997b3be71f5ee376435705d5ce19c968471721f1c22dfb6841bab47e6abad1e57b848cf80913bfeee708ecc50019e7c323b4379

Download Submit
memory/1544-15-0x0000000000400000-0x0000000000F20000-memory.dmp

Filesize
11.1MB

Download
memory/1544-19-0x0000000000400000-0x0000000000F20000-memory.dmp

Filesize
11.1MB

Download
memory/1544-23-0x0000000000400000-0x0000000000F20000-memory.dmp

Filesize
11.1MB

Download
memory/4904-18-0x0000000000C80000-0x0000000001164000-memory.dmp

Filesize
4.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads