xtremerat | d3bb9f49727406153a2aac4a0cab2a809f33b30eb86654b74754e398118718c1

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2024 11:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
Size

122KB
MD5

b0d5c8abbaa4625087a2a43e00a6d47a
SHA1

c42adfb169b90be84add9387ba875ab5cbcf638d
SHA256

d3bb9f49727406153a2aac4a0cab2a809f33b30eb86654b74754e398118718c1
SHA512

44fda4b602621954ccd522f0f3df046869e8e49447ca13fe3ebc738635d713d3686fab6b68dd0719dacfbd158e3bb8a8b7f042632297e7ffedaa26eecc2eeb1c
SSDEEP

3072:kCjAjjkir/I3l/hOhc6APDhOSnqt0YMcqxShc:XqR4yxAbgmUeS

Score

10^/10

xtremerat discovery persistence rat spyware upx

Malware Config

Extracted

Family

xtremerat

zipitru.no-ip.org

Signatures

Detect XtremeRAT payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1840-11-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/1840-10-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/888-12-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/888-26-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Xtremerat family
xtremerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

VSCover.exe

pid	Process
4888	VSCover.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

VSCover.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\VSCover.exe"	VSCover.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe

description	pid	Process	procid_target
PID 344 set thread context of 1840	344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	82

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1840-7-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/1840-9-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/1840-11-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/1840-10-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/888-12-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/888-26-0x0000000010000000-0x000000001004D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
3972	888	WerFault.exe	83
3668	888	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exeb0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exesvchost.exeVSCover.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VSCover.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exeVSCover.exe

pid	Process
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
4888	VSCover.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exeVSCover.exe

description	pid	Process
Token: SeDebugPrivilege	344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
Token: SeDebugPrivilege	4888	VSCover.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exeb0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe

description	pid	Process	procid_target
PID 344 wrote to memory of 1840	344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	82
PID 344 wrote to memory of 1840	344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	82
PID 344 wrote to memory of 1840	344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	82
PID 344 wrote to memory of 1840	344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	82
PID 344 wrote to memory of 1840	344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	82
PID 344 wrote to memory of 1840	344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	82
PID 344 wrote to memory of 1840	344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	82
PID 344 wrote to memory of 1840	344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	82
PID 1840 wrote to memory of 888	1840	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	83
PID 1840 wrote to memory of 888	1840	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	83
PID 1840 wrote to memory of 888	1840	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	83
PID 1840 wrote to memory of 888	1840	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	83
PID 1840 wrote to memory of 3512	1840	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	84
PID 1840 wrote to memory of 3512	1840	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	84
PID 1840 wrote to memory of 3512	1840	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	84
PID 344 wrote to memory of 4888	344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	87
PID 344 wrote to memory of 4888	344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	87
PID 344 wrote to memory of 4888	344	b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:344
- C:\Users\Admin\AppData\Local\Temp\b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:888
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 888 -s 488
      4⤵
      Program crash
      PID:3972
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 888 -s 496
      4⤵
      Program crash
      PID:3668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3512
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 888 -ip 888
1⤵
PID:3640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 888 -ip 888
1⤵
PID:3712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe

Filesize
12KB

MD5
4ed67c056c520b02619836b5b5a03bed

SHA1
5cca9b1083aef2220a06170967ceb24f3c456cc6

SHA256
8eef60ff78478c1e9322415634708d629074270a7329778156bbc9e141eaa35f

SHA512
5b7d327c9489510740f52a431ae222734b53fe2eb30f0777c49e129ea66e30134a91fc67b6bfc993741bc403829354c1078e1c85b82cf74f539f88b587a0d3d4

Download Submit
memory/344-1-0x00000000754B0000-0x0000000075A61000-memory.dmp

Filesize
5.7MB

Download
memory/344-2-0x00000000754B0000-0x0000000075A61000-memory.dmp

Filesize
5.7MB

Download
memory/344-29-0x00000000754B0000-0x0000000075A61000-memory.dmp

Filesize
5.7MB

Download
memory/344-28-0x00000000754B0000-0x0000000075A61000-memory.dmp

Filesize
5.7MB

Download
memory/344-27-0x00000000754B2000-0x00000000754B3000-memory.dmp

Filesize
4KB

Download
memory/344-0-0x00000000754B2000-0x00000000754B3000-memory.dmp

Filesize
4KB

Download
memory/888-26-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/888-12-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/1840-10-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/1840-11-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/1840-9-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/1840-7-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/4888-23-0x00000000754B2000-0x00000000754B3000-memory.dmp

Filesize
4KB

Download
memory/4888-24-0x00000000754B0000-0x0000000075A61000-memory.dmp

Filesize
5.7MB

Download
memory/4888-25-0x00000000754B0000-0x0000000075A61000-memory.dmp

Filesize
5.7MB

Download
memory/4888-30-0x00000000754B2000-0x00000000754B3000-memory.dmp

Filesize
4KB

Download
memory/4888-31-0x00000000754B0000-0x0000000075A61000-memory.dmp

Filesize
5.7MB

Download
memory/4888-32-0x00000000754B0000-0x0000000075A61000-memory.dmp

Filesize
5.7MB

Download