xtremerat | 88a0415ab2bc28287e83a2fab4d7aa48010afee0c4a9cd91c58b9e1d1c9199f9

General

Target

ba98c4bfc9b34a99984bd5b47e2187d5_JaffaCakes118.exe
Size

5.0MB
MD5

ba98c4bfc9b34a99984bd5b47e2187d5
SHA1

870fa646be34189399c846fc69591b09f89e2e19
SHA256

88a0415ab2bc28287e83a2fab4d7aa48010afee0c4a9cd91c58b9e1d1c9199f9
SHA512

6c5000fff95219b07aea7502396891aa1edfee9450f52c72167f252e30a57b474ef8ff0af23f6bf909728fc5c2910dc00e1636c2cc4a4e9a91990e18e1f1d6ac
SSDEEP

1536:9TKzAb+49etKRhSy/uoQUIiNNNNvb8bVOHNnBuEdxMj2qkSZZZ3gdg:ci+3ct/2UIiZZIbSsSMjYUP

Score

10^/10

xtremerat discovery persistence rat spyware upx

Malware Config

Extracted

Family

xtremerat

C2

powertoys.no-ip.org

Signatures

Detect XtremeRAT payload 5 IoCs

resource	yara_rule
behavioral2/memory/2920-10-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/2920-11-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/3840-14-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/2920-15-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/3840-17-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Xtremerat family
xtremerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1092 set thread context of 2920	1092	ba98c4bfc9b34a99984bd5b47e2187d5_JaffaCakes118.exe	82

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2920-5-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/2920-8-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/2920-10-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/2920-11-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/3840-14-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/2920-15-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/3840-17-0x0000000010000000-0x000000001004D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
464	3840	WerFault.exe	85
4456	3840	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ba98c4bfc9b34a99984bd5b47e2187d5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ba98c4bfc9b34a99984bd5b47e2187d5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 2920	1092	ba98c4bfc9b34a99984bd5b47e2187d5_JaffaCakes118.exe	82
PID 1092 wrote to memory of 2920	1092	ba98c4bfc9b34a99984bd5b47e2187d5_JaffaCakes118.exe	82
PID 1092 wrote to memory of 2920	1092	ba98c4bfc9b34a99984bd5b47e2187d5_JaffaCakes118.exe	82
PID 1092 wrote to memory of 2920	1092	ba98c4bfc9b34a99984bd5b47e2187d5_JaffaCakes118.exe	82
PID 1092 wrote to memory of 2920	1092	ba98c4bfc9b34a99984bd5b47e2187d5_JaffaCakes118.exe	82
PID 1092 wrote to memory of 2920	1092	ba98c4bfc9b34a99984bd5b47e2187d5_JaffaCakes118.exe	82
PID 1092 wrote to memory of 2920	1092	ba98c4bfc9b34a99984bd5b47e2187d5_JaffaCakes118.exe	82
PID 1092 wrote to memory of 2920	1092	ba98c4bfc9b34a99984bd5b47e2187d5_JaffaCakes118.exe	82
PID 1092 wrote to memory of 2288	1092	ba98c4bfc9b34a99984bd5b47e2187d5_JaffaCakes118.exe	83
PID 1092 wrote to memory of 2288	1092	ba98c4bfc9b34a99984bd5b47e2187d5_JaffaCakes118.exe	83
PID 1092 wrote to memory of 2288	1092	ba98c4bfc9b34a99984bd5b47e2187d5_JaffaCakes118.exe	83
PID 2920 wrote to memory of 3840	2920	ba98c4bfc9b34a99984bd5b47e2187d5_JaffaCakes118.exe	85
PID 2920 wrote to memory of 3840	2920	ba98c4bfc9b34a99984bd5b47e2187d5_JaffaCakes118.exe	85
PID 2920 wrote to memory of 3840	2920	ba98c4bfc9b34a99984bd5b47e2187d5_JaffaCakes118.exe	85
PID 2920 wrote to memory of 3840	2920	ba98c4bfc9b34a99984bd5b47e2187d5_JaffaCakes118.exe	85
PID 2920 wrote to memory of 3484	2920	ba98c4bfc9b34a99984bd5b47e2187d5_JaffaCakes118.exe	86
PID 2920 wrote to memory of 3484	2920	ba98c4bfc9b34a99984bd5b47e2187d5_JaffaCakes118.exe	86
PID 2920 wrote to memory of 3484	2920	ba98c4bfc9b34a99984bd5b47e2187d5_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\ba98c4bfc9b34a99984bd5b47e2187d5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ba98c4bfc9b34a99984bd5b47e2187d5_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Users\Admin\AppData\Local\Temp\ba98c4bfc9b34a99984bd5b47e2187d5_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ba98c4bfc9b34a99984bd5b47e2187d5_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3840
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 480
      4⤵
      Program crash
      PID:464
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 488
      4⤵
      Program crash
      PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\delete.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3840 -ip 3840
1⤵
PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3840 -ip 3840
1⤵
PID:3572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\delete.bat

Filesize
216B

MD5
e39301817b7cfe20341ed8650d7014f3

SHA1
bb8750de02c0f70ee583f349524d01955d3f6ec9

SHA256
792c94acfba8d3a3f137727910b4cc7d16f693fb9150c48b7609d17e7db109a4

SHA512
610dea796a47f786591dd4f56e082f99c7c5bff8ab7a116a070fdf7ffddb3afd62a8307b7b2bc9af876b000a9219e9d1e074983d9cc71be13b5b8888be7aaf5a

Download Submit
memory/1092-12-0x00000000750B0000-0x0000000075661000-memory.dmp

Filesize
5.7MB

Download
memory/1092-1-0x00000000750B0000-0x0000000075661000-memory.dmp

Filesize
5.7MB

Download
memory/1092-2-0x00000000750B0000-0x0000000075661000-memory.dmp

Filesize
5.7MB

Download
memory/1092-0-0x00000000750B2000-0x00000000750B3000-memory.dmp

Filesize
4KB

Download
memory/1092-3-0x00000000750B0000-0x0000000075661000-memory.dmp

Filesize
5.7MB

Download
memory/2920-5-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2920-11-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2920-10-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2920-8-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2920-15-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/3840-14-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/3840-17-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download

Analysis

Sharing