xtremerat | d3bb9f49727406153a2aac4a0cab2a809f33b30eb86654b74754e398118718c1

Analysis

max time kernel
150s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
29-11-2024 11:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
Size

122KB
MD5

b0d5c8abbaa4625087a2a43e00a6d47a
SHA1

c42adfb169b90be84add9387ba875ab5cbcf638d
SHA256

d3bb9f49727406153a2aac4a0cab2a809f33b30eb86654b74754e398118718c1
SHA512

44fda4b602621954ccd522f0f3df046869e8e49447ca13fe3ebc738635d713d3686fab6b68dd0719dacfbd158e3bb8a8b7f042632297e7ffedaa26eecc2eeb1c
SSDEEP

3072:kCjAjjkir/I3l/hOhc6APDhOSnqt0YMcqxShc:XqR4yxAbgmUeS

Score

10^/10

xtremerat discovery persistence rat spyware upx

Malware Config

Extracted

Family

xtremerat

zipitru.no-ip.org

Signatures

Detect XtremeRAT payload 3 IoCs

resource	yara_rule
behavioral1/memory/2168-16-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral1/memory/2168-15-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral1/memory/1192-25-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Xtremerat family
xtremerat

Executes dropped EXE 1 IoCs

pid	Process
2504	VSCover.exe

Loads dropped DLL 1 IoCs

pid	Process
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\VSCover.exe"	VSCover.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2376 set thread context of 2168	2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	29

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2168-8-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/2168-12-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/2168-9-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/2168-16-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/2168-15-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/2168-14-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/1192-25-0x0000000010000000-0x000000001004D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VSCover.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2504	VSCover.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
Token: SeDebugPrivilege	2504	VSCover.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2168	2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	29
PID 2376 wrote to memory of 2168	2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	29
PID 2376 wrote to memory of 2168	2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	29
PID 2376 wrote to memory of 2168	2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	29
PID 2376 wrote to memory of 2168	2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	29
PID 2376 wrote to memory of 2168	2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	29
PID 2376 wrote to memory of 2168	2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	29
PID 2376 wrote to memory of 2168	2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	29
PID 2168 wrote to memory of 1192	2168	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	30
PID 2168 wrote to memory of 1192	2168	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	30
PID 2168 wrote to memory of 1192	2168	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	30
PID 2168 wrote to memory of 1192	2168	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	30
PID 2376 wrote to memory of 2504	2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	31
PID 2376 wrote to memory of 2504	2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	31
PID 2376 wrote to memory of 2504	2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	31
PID 2376 wrote to memory of 2504	2376	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	31
PID 2168 wrote to memory of 1192	2168	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	30
PID 2168 wrote to memory of 2816	2168	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	32
PID 2168 wrote to memory of 2816	2168	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	32
PID 2168 wrote to memory of 2816	2168	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	32
PID 2168 wrote to memory of 2816	2168	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	32
PID 2168 wrote to memory of 2816	2168	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\Temp\b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1192
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2816
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

Filesize
12KB

MD5
4ed67c056c520b02619836b5b5a03bed

SHA1
5cca9b1083aef2220a06170967ceb24f3c456cc6

SHA256
8eef60ff78478c1e9322415634708d629074270a7329778156bbc9e141eaa35f

SHA512
5b7d327c9489510740f52a431ae222734b53fe2eb30f0777c49e129ea66e30134a91fc67b6bfc993741bc403829354c1078e1c85b82cf74f539f88b587a0d3d4

Download Submit
memory/1192-25-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2168-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2168-7-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2168-8-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2168-12-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2168-9-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2168-16-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2168-15-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2168-14-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2376-0-0x00000000745B1000-0x00000000745B2000-memory.dmp

Filesize
4KB

Download
memory/2376-2-0x00000000745B0000-0x0000000074B5B000-memory.dmp

Filesize
5.7MB

Download
memory/2376-1-0x00000000745B0000-0x0000000074B5B000-memory.dmp

Filesize
5.7MB

Download
memory/2376-26-0x00000000745B0000-0x0000000074B5B000-memory.dmp

Filesize
5.7MB

Download
memory/2376-27-0x00000000745B0000-0x0000000074B5B000-memory.dmp

Filesize
5.7MB

Download