xtremerat | 138607817f48bd18b5b512d8eb9f53b6984f6c88f9287ce60612aacde2a8d332

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-01-2025 20:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe
Size

64KB
MD5

250368901067ead28d96afb92bf7efa3
SHA1

3457dae67baf52b8797c4524749c93ae30db7d2b
SHA256

138607817f48bd18b5b512d8eb9f53b6984f6c88f9287ce60612aacde2a8d332
SHA512

a4fafc3527b9209feb29cb268e168ccef39f094f638497fccaf7dde47a66423ea647cbbf685800a11c18a8da3764e9231b08adc6712d18467d16ce1d09b8081e
SSDEEP

1536:g13FL1blWvOXpYRl5oy1on9/Zf2uDuL1QZ:S1L1blWvapYRHfu9B9i

Score

10^/10

xtremerat discovery persistence rat spyware

Malware Config

Signatures

Detect XtremeRAT payload 6 IoCs

resource	yara_rule
behavioral1/memory/2776-2-0x0000000000C80000-0x0000000000C92000-memory.dmp	family_xtremerat
behavioral1/memory/2776-14-0x0000000000C80000-0x0000000000C92000-memory.dmp	family_xtremerat
behavioral1/memory/2776-12-0x0000000000C80000-0x0000000000C92000-memory.dmp	family_xtremerat
behavioral1/memory/2776-10-0x0000000000C80000-0x0000000000C92000-memory.dmp	family_xtremerat
behavioral1/memory/2776-7-0x0000000000C80000-0x0000000000C92000-memory.dmp	family_xtremerat
behavioral1/memory/2776-4-0x0000000000C80000-0x0000000000C92000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Xtremerat family
xtremerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2936 set thread context of 2776	2936	JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe	30

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2776	2936	JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe	30
PID 2936 wrote to memory of 2776	2936	JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe	30
PID 2936 wrote to memory of 2776	2936	JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe	30
PID 2936 wrote to memory of 2776	2936	JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe	30
PID 2936 wrote to memory of 2776	2936	JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe	30
PID 2936 wrote to memory of 2776	2936	JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe	30
PID 2936 wrote to memory of 2776	2936	JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe	30
PID 2936 wrote to memory of 2776	2936	JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe	30
PID 2936 wrote to memory of 2776	2936	JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe	30
PID 2936 wrote to memory of 2776	2936	JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe	30
PID 2936 wrote to memory of 2776	2936	JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe	30
PID 2936 wrote to memory of 2776	2936	JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe
  2⤵
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2776-0-0x0000000000C80000-0x0000000000C92000-memory.dmp

Filesize
72KB

Download
memory/2776-1-0x0000000000C80000-0x0000000000C92000-memory.dmp

Filesize
72KB

Download
memory/2776-2-0x0000000000C80000-0x0000000000C92000-memory.dmp

Filesize
72KB

Download
memory/2776-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2776-14-0x0000000000C80000-0x0000000000C92000-memory.dmp

Filesize
72KB

Download
memory/2776-12-0x0000000000C80000-0x0000000000C92000-memory.dmp

Filesize
72KB

Download
memory/2776-10-0x0000000000C80000-0x0000000000C92000-memory.dmp

Filesize
72KB

Download
memory/2776-7-0x0000000000C80000-0x0000000000C92000-memory.dmp

Filesize
72KB

Download
memory/2776-4-0x0000000000C80000-0x0000000000C92000-memory.dmp

Filesize
72KB

Download
memory/2936-18-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download