xtremerat | b3a10160f588e942dbef93afb940c375ad6150ca2bd51f37a656a5cf8f9564db

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
09-12-2024 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

daac44e81c354330f3afc4f378944477_JaffaCakes118.exe
Size

82KB
MD5

daac44e81c354330f3afc4f378944477
SHA1

31eed75004054c42ca3fea4ca6105ba597a76dd2
SHA256

b3a10160f588e942dbef93afb940c375ad6150ca2bd51f37a656a5cf8f9564db
SHA512

03db41c3f08862cc6f3201c4aa2a57fc2e7499a10465f9bbf0cd43638c2aec9e975486c11b5746765535f4fe1b53b8ad788b831f7f97ac172f6dbaf87ffd0fae
SSDEEP

1536:Isq+QU4rObAdXWpf/yp7ozNwi3YIYroBP:Nt4rj/ZodUoB

Score

10^/10

xtremerat discovery persistence rat spyware

Malware Config

Signatures

Detect XtremeRAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2488-0-0x0000000010000000-0x000000001004E000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Xtremerat family
xtremerat

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3028	2488	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daac44e81c354330f3afc4f378944477_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 3028	2488	daac44e81c354330f3afc4f378944477_JaffaCakes118.exe	30
PID 2488 wrote to memory of 3028	2488	daac44e81c354330f3afc4f378944477_JaffaCakes118.exe	30
PID 2488 wrote to memory of 3028	2488	daac44e81c354330f3afc4f378944477_JaffaCakes118.exe	30
PID 2488 wrote to memory of 3028	2488	daac44e81c354330f3afc4f378944477_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\daac44e81c354330f3afc4f378944477_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\daac44e81c354330f3afc4f378944477_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 160
  2⤵
  - Program crash
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2488-0-0x0000000010000000-0x000000001004E000-memory.dmp

Filesize
312KB

Download