xtremerat | 138607817f48bd18b5b512d8eb9f53b6984f6c88f9287ce60612aacde2a8d332

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2025 20:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe
Size

64KB
MD5

250368901067ead28d96afb92bf7efa3
SHA1

3457dae67baf52b8797c4524749c93ae30db7d2b
SHA256

138607817f48bd18b5b512d8eb9f53b6984f6c88f9287ce60612aacde2a8d332
SHA512

a4fafc3527b9209feb29cb268e168ccef39f094f638497fccaf7dde47a66423ea647cbbf685800a11c18a8da3764e9231b08adc6712d18467d16ce1d09b8081e
SSDEEP

1536:g13FL1blWvOXpYRl5oy1on9/Zf2uDuL1QZ:S1L1blWvapYRHfu9B9i

Score

10^/10

xtremerat discovery persistence rat spyware

Malware Config

Signatures

Detect XtremeRAT payload 6 IoCs

resource	yara_rule
behavioral2/memory/884-7-0x0000000000C80000-0x0000000000C92000-memory.dmp	family_xtremerat
behavioral2/memory/884-6-0x0000000000C80000-0x0000000000C92000-memory.dmp	family_xtremerat
behavioral2/memory/884-5-0x0000000000C80000-0x0000000000C92000-memory.dmp	family_xtremerat
behavioral2/memory/884-3-0x0000000000C80000-0x0000000000C92000-memory.dmp	family_xtremerat
behavioral2/memory/884-0-0x0000000000C80000-0x0000000000C92000-memory.dmp	family_xtremerat
behavioral2/memory/884-1-0x0000000000C80000-0x0000000000C92000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Xtremerat family
xtremerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2440 set thread context of 884	2440	JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe	82

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2028	884	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 884	2440	JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe	82
PID 2440 wrote to memory of 884	2440	JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe	82
PID 2440 wrote to memory of 884	2440	JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe	82
PID 2440 wrote to memory of 884	2440	JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe	82
PID 2440 wrote to memory of 884	2440	JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe	82
PID 2440 wrote to memory of 884	2440	JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe	82
PID 2440 wrote to memory of 884	2440	JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe	82
PID 2440 wrote to memory of 884	2440	JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe	82
PID 2440 wrote to memory of 884	2440	JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe	82
PID 2440 wrote to memory of 884	2440	JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe	82
PID 2440 wrote to memory of 884	2440	JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe	82
PID 2440 wrote to memory of 884	2440	JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe	82
PID 2440 wrote to memory of 884	2440	JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe	82

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_250368901067ead28d96afb92bf7efa3.exe
  2⤵
  PID:884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 12
    3⤵
    - Program crash
    PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 884 -ip 884
1⤵
PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/884-7-0x0000000000C80000-0x0000000000C92000-memory.dmp

Filesize
72KB

Download
memory/884-6-0x0000000000C80000-0x0000000000C92000-memory.dmp

Filesize
72KB

Download
memory/884-5-0x0000000000C80000-0x0000000000C92000-memory.dmp

Filesize
72KB

Download
memory/884-3-0x0000000000C80000-0x0000000000C92000-memory.dmp

Filesize
72KB

Download
memory/884-0-0x0000000000C80000-0x0000000000C92000-memory.dmp

Filesize
72KB

Download
memory/884-1-0x0000000000C80000-0x0000000000C92000-memory.dmp

Filesize
72KB

Download
memory/2440-9-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download