xtremerat | 02ea32d655e7fd83a61e9dd9c3585e3f53f40ff787ee39765d10878f3f1f70b2

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/01/2025, 23:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_5c9c571ab236db43c7782dfaa3eba5ae.exe
Size

65KB
MD5

5c9c571ab236db43c7782dfaa3eba5ae
SHA1

4f538b244898453b77c83c53c9c84682a18c12fa
SHA256

02ea32d655e7fd83a61e9dd9c3585e3f53f40ff787ee39765d10878f3f1f70b2
SHA512

a5211cee18d4cbed9d2f015550b11fd555fe9b7de129907468e0ebbe02decda5a80abcf445034b48a1dc7ee6f65888a82754844617d83cbea4a9594e07be8aaa
SSDEEP

768:88m1Sq4NQErBsH1tzoisBKQI6dObAG/dqOXHsoAx5JXrUqLOY0pYKnA+7PoNwgzI:esq+QV4rObAdNoAf5UqiYmlArNwoodV

Score

10^/10

xtremerat discovery persistence rat spyware

Malware Config

Signatures

Detect XtremeRAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2664-0-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Xtremerat family
xtremerat

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2828	2664	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5c9c571ab236db43c7782dfaa3eba5ae.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2828	2664	JaffaCakes118_5c9c571ab236db43c7782dfaa3eba5ae.exe	31
PID 2664 wrote to memory of 2828	2664	JaffaCakes118_5c9c571ab236db43c7782dfaa3eba5ae.exe	31
PID 2664 wrote to memory of 2828	2664	JaffaCakes118_5c9c571ab236db43c7782dfaa3eba5ae.exe	31
PID 2664 wrote to memory of 2828	2664	JaffaCakes118_5c9c571ab236db43c7782dfaa3eba5ae.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5c9c571ab236db43c7782dfaa3eba5ae.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5c9c571ab236db43c7782dfaa3eba5ae.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 160
  2⤵
  - Program crash
  PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2664-0-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download