xtremerat | 209b685ffe19683bfa33f9bb813abe69fd7df5d7260e186d09189d0764b61b5c

General

Target

JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe
Size

608KB
MD5

7ab423a0c3c7eeb3bb00d130e6b6f9bd
SHA1

23ecc0bb28e5c69b5a07cd215e34b2459ffa7f4e
SHA256

209b685ffe19683bfa33f9bb813abe69fd7df5d7260e186d09189d0764b61b5c
SHA512

dc2061ac9a1e7573348ac49514a6c905f3c756e4d5a366001ca76bb604e92f03fe4e967f65f843c82397e74cce938b32cc08261e9b193a91bb58270d291da93e
SSDEEP

12288:52u4sum+hlTEqUZoYX+KdC3R+kFifVucd4lJO2oT+VC/:pKmGlTEZo8eRpFifMK/

Score

10^/10

xtremerat discovery persistence rat spyware upx

Malware Config

Signatures

Detect XtremeRAT payload 3 IoCs

resource	yara_rule
behavioral2/memory/2184-54-0x0000000000C80000-0x0000000000CB2000-memory.dmp	family_xtremerat
behavioral2/memory/2012-59-0x0000000000C80000-0x0000000000CB2000-memory.dmp	family_xtremerat
behavioral2/memory/2012-69-0x0000000000C80000-0x0000000000CB2000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Xtremerat family
xtremerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\system.exe restart"	JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\system.exe"	JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\system.exe"	JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4944 set thread context of 2184	4944	JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe	85

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2184-48-0x0000000000C80000-0x0000000000CB2000-memory.dmp	upx
behavioral2/memory/2184-53-0x0000000000C80000-0x0000000000CB2000-memory.dmp	upx
behavioral2/memory/2184-54-0x0000000000C80000-0x0000000000CB2000-memory.dmp	upx
behavioral2/memory/2012-59-0x0000000000C80000-0x0000000000CB2000-memory.dmp	upx
behavioral2/memory/2012-69-0x0000000000C80000-0x0000000000CB2000-memory.dmp	upx

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InstallDir\system.exe	JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe
File created	C:\Windows\InstallDir\system.exe	JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe
File created	C:\Windows\867KDBotLite.exe.exe	JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe
File created	C:\Windows\867KDBotLite.exe	JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

NTFS ADS 3 IoCs

description	ioc	Process
File created	C:\ProgramData:$SS_DESCRIPTOR_SBXNV9VVGV1BF1646XBHV2FJW016YRF47TPBJNGFSVF7VB4VP4GF	JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe
File created	C:\ProgramData\DYA_AOTCDGIILGPMOMALC\1.0.0:$SS_DESCRIPTOR_SBXNV9VVGV1BF1646XBHV2FJW016YRF47TPBJNGFSVF7VB4VP4GF	JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe
File created	C:\Users\Public\Desktop:$SS_DESCRIPTOR_SBXNV9VVGV1BF1646XBHV2FJW016YRF47TPBJNGFSVF7VB4VP4GF	JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4944	JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe
2012	calc.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 2184	4944	JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe	85
PID 4944 wrote to memory of 2184	4944	JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe	85
PID 4944 wrote to memory of 2184	4944	JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe	85
PID 4944 wrote to memory of 2184	4944	JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe	85
PID 4944 wrote to memory of 2184	4944	JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe	85
PID 4944 wrote to memory of 2184	4944	JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe	85
PID 4944 wrote to memory of 2184	4944	JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe	85
PID 4944 wrote to memory of 2184	4944	JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe	85
PID 2184 wrote to memory of 2012	2184	JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe	86
PID 2184 wrote to memory of 2012	2184	JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe	86
PID 2184 wrote to memory of 2012	2184	JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe	86
PID 2184 wrote to memory of 2012	2184	JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe	86

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Checks computer location settings
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Active Setup

1

T1547.014

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Active Setup

1

T1547.014

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\DYA_AOTCDGIILGPMOMALC\1.0.0\Data\app.dat

Filesize
971B

MD5
bc927f9c98623eb2f1beefde02085316

SHA1
1421822873d453d24f874a10d7d1293f463b7f39

SHA256
3fc2933b01a45913d9599df921784bbc85ff754b265b289a24e15e5a5fdf4717

SHA512
bf1ba87f836d7e2f8b2d30eecf9052959395d7d94493e4a5e66f24c0f3ea4ea529b3da03be2024c86d3479310130d7f6421c13aa45ecaa5929d070c2c082782e

Download Submit
C:\ProgramData\DYA_AOTCDGIILGPMOMALC\1.0.0\Data\updates.dat

Filesize
971B

MD5
1672edcaa69fcd6696d210fc27d84760

SHA1
237db715a17c381a2380a34b9f8f7c487745d12e

SHA256
f03b737036e9bd0994ccf00e196a9e13906a60bdeae5fbe39cfb5d84928c78d8

SHA512
ec640b23882c32ee0cd76b6aafa9c5e65bbf65a15d9a8ed2ae95364a2f1c40bce3202cafa7adebda9f39d69f299fb9aee86a3683ce1b67664bddb49d4982371c

Download Submit
C:\Users\Admin\AppData\Roaming\DYA_AOTCDGIILGPMOMALC\1.0.0\Data\dya.dat

Filesize
971B

MD5
954c62ee6376d7502831ae39831caadc

SHA1
75860379a9f0ae31e3b21fc9fc839f3f534c792b

SHA256
1d7e0004629ce379e7c39f3416111cede15f1badb5d232dad40c56371f647ef7

SHA512
d8dbd31c6c4e09035a88e1ceea90d54a37c8472b955c1db9fc06fd0bc0c1712c2047060d1aabc5f34205015de8e081dea536bcdb3ab4bfb56679c6281c98d1af

Download Submit
C:\Windows\867KDBotLite.exe

Filesize
104KB

MD5
d0b19e992ba59870eb39b2ffc90c14ad

SHA1
c1603dae3c2c62d11c7f3d77c0e26efc49007121

SHA256
acbfd6d51b161a98d8786e7f63d44dd448096e9620bb574288e134b2126922a6

SHA512
5269137efa016aa0bdc49198e9b41fb12d182c1d5a0d5c4470c93c8376098a8aab645fc0eb50b507a3d9c0787613b0870990e2b9abd7c684d46ad64cc301897f

Download Submit
memory/2012-59-0x0000000000C80000-0x0000000000CB2000-memory.dmp

Filesize
200KB

Download
memory/2012-69-0x0000000000C80000-0x0000000000CB2000-memory.dmp

Filesize
200KB

Download
memory/2184-54-0x0000000000C80000-0x0000000000CB2000-memory.dmp

Filesize
200KB

Download
memory/2184-48-0x0000000000C80000-0x0000000000CB2000-memory.dmp

Filesize
200KB

Download
memory/2184-53-0x0000000000C80000-0x0000000000CB2000-memory.dmp

Filesize
200KB

Download
memory/2184-55-0x0000000000400000-0x00000000004BFB0C-memory.dmp

Filesize
766KB

Download
memory/4944-45-0x0000000000400000-0x00000000004BFB0C-memory.dmp

Filesize
766KB

Download
memory/4944-52-0x0000000000400000-0x00000000004BFB0C-memory.dmp

Filesize
766KB

Download
memory/4944-51-0x000000000040A000-0x00000000004A7000-memory.dmp

Filesize
628KB

Download
memory/4944-0-0x0000000000400000-0x00000000004BFB0C-memory.dmp

Filesize
766KB

Download
memory/4944-44-0x0000000000400000-0x00000000004BFB0C-memory.dmp

Filesize
766KB

Download
memory/4944-43-0x0000000000400000-0x00000000004BFB0C-memory.dmp

Filesize
766KB

Download
memory/4944-1-0x000000000040A000-0x00000000004A7000-memory.dmp

Filesize
628KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads