xtremerat | 332996f178bab2733717a5a46632f4622d0df1519dd782e532bf47ccfe95aac4

Analysis

max time kernel
149s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-01-2025 11:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe
Size

1.0MB
MD5

625f1ab0811df7656488d52c0fe6df7f
SHA1

efe2d912e509cca41c244345786c01d5a98cf136
SHA256

332996f178bab2733717a5a46632f4622d0df1519dd782e532bf47ccfe95aac4
SHA512

a64e335051683b080552c82b137f87819c64125cb97b61f3b007d36c0d45af4633b0f366a589f758c925f3ead19bd7516bb4847005d9f0ba602f07c601e26db3
SSDEEP

24576:2520OwmxOKXJHtkjaYvZJiffU8AazZDd+w1TuED:420jKJkaqZJJ8Aazxd+Uq

Score

10^/10

xtremerat discovery persistence rat spyware upx

Malware Config

Extracted

Family

xtremerat

korcerrah.no-ip.biz

Signatures

Detect XtremeRAT payload 4 IoCs

resource	yara_rule
behavioral1/memory/2828-29-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral1/memory/2828-28-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral1/memory/2628-37-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral1/memory/2828-42-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Xtremerat family
xtremerat

Executes dropped EXE 3 IoCs

pid	Process
2712	java.exe
2828	java.exe
2624	launcher.exe

Loads dropped DLL 7 IoCs

pid	Process
2292	JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe
2292	JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe
2712	java.exe
2712	java.exe
2828	java.exe
2292	JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe
2624	launcher.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2712	java.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2712 set thread context of 2828	2712	java.exe	31

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2828-29-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/2828-28-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/2828-27-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/2828-24-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/2828-21-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/2628-37-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/2828-42-0x0000000010000000-0x000000001004D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	java.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	java.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	launcher.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2712	java.exe
2712	java.exe
2624	launcher.exe
2624	launcher.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2712	2292	JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe	30
PID 2292 wrote to memory of 2712	2292	JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe	30
PID 2292 wrote to memory of 2712	2292	JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe	30
PID 2292 wrote to memory of 2712	2292	JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe	30
PID 2292 wrote to memory of 2712	2292	JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe	30
PID 2292 wrote to memory of 2712	2292	JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe	30
PID 2292 wrote to memory of 2712	2292	JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe	30
PID 2712 wrote to memory of 2828	2712	java.exe	31
PID 2712 wrote to memory of 2828	2712	java.exe	31
PID 2712 wrote to memory of 2828	2712	java.exe	31
PID 2712 wrote to memory of 2828	2712	java.exe	31
PID 2712 wrote to memory of 2828	2712	java.exe	31
PID 2712 wrote to memory of 2828	2712	java.exe	31
PID 2712 wrote to memory of 2828	2712	java.exe	31
PID 2712 wrote to memory of 2828	2712	java.exe	31
PID 2712 wrote to memory of 2828	2712	java.exe	31
PID 2712 wrote to memory of 2828	2712	java.exe	31
PID 2712 wrote to memory of 2828	2712	java.exe	31
PID 2712 wrote to memory of 2828	2712	java.exe	31
PID 2828 wrote to memory of 2628	2828	java.exe	32
PID 2828 wrote to memory of 2628	2828	java.exe	32
PID 2828 wrote to memory of 2628	2828	java.exe	32
PID 2828 wrote to memory of 2628	2828	java.exe	32
PID 2828 wrote to memory of 2628	2828	java.exe	32
PID 2828 wrote to memory of 2628	2828	java.exe	32
PID 2828 wrote to memory of 2628	2828	java.exe	32
PID 2828 wrote to memory of 2628	2828	java.exe	32
PID 2292 wrote to memory of 2624	2292	JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe	33
PID 2292 wrote to memory of 2624	2292	JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe	33
PID 2292 wrote to memory of 2624	2292	JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe	33
PID 2292 wrote to memory of 2624	2292	JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe	33
PID 2292 wrote to memory of 2624	2292	JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe	33
PID 2292 wrote to memory of 2624	2292	JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe	33
PID 2292 wrote to memory of 2624	2292	JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe	33
PID 2828 wrote to memory of 2772	2828	java.exe	34
PID 2828 wrote to memory of 2772	2828	java.exe	34
PID 2828 wrote to memory of 2772	2828	java.exe	34
PID 2828 wrote to memory of 2772	2828	java.exe	34
PID 2828 wrote to memory of 2772	2828	java.exe	34
PID 2828 wrote to memory of 2772	2828	java.exe	34
PID 2828 wrote to memory of 2772	2828	java.exe	34
PID 2828 wrote to memory of 2772	2828	java.exe	34

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\java.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\java.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\java.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\java.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2628
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:2772
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\launcher.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\launcher.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\IXP000.TMP\java.exe

Filesize
657KB

MD5
da0af3e686fed546be5b6b72c8fa73c5

SHA1
797d25724f0bbb12a041f71ed1b5c16760cc8ddf

SHA256
a9b9158a681ab964207ef6871fa876524fa389fafd7daa7c0f3ee93662a55c73

SHA512
339df2d46ee03ce9b66c86f9f569d5fc0197c33382328158fb5a524ee983fb3ae0ee6248297aec597328445b3ee73d0721d969056c02aca0b75cfded409ef3c9

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\launcher.exe

Filesize
829KB

MD5
88164229bedab3b56f859a816f2de699

SHA1
d0e5ac0a9e2604185b8176162789998ac7e96bb0

SHA256
2cd2e15f3a6927904a9d2cc9d13485f85edb575a4dfb82a84c5807c6b012c5be

SHA512
2222d7b1890670868940e1d9210d20ace6e85c3996a0c4029a8e818a1bc1b8ede60ba6b03c4e58a8e7a199acacdcb647a8218d35104330569d75712d8379d292

Download Submit
memory/2292-11-0x00000000027E0000-0x0000000002B80000-memory.dmp

Filesize
3.6MB

Download
memory/2292-15-0x00000000027E0000-0x0000000002B80000-memory.dmp

Filesize
3.6MB

Download
memory/2292-43-0x00000000027E0000-0x0000000002B80000-memory.dmp

Filesize
3.6MB

Download
memory/2624-44-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/2628-37-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2628-35-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2712-20-0x00000000043C0000-0x0000000004760000-memory.dmp

Filesize
3.6MB

Download
memory/2712-14-0x0000000000400000-0x00000000007A0000-memory.dmp

Filesize
3.6MB

Download
memory/2712-32-0x0000000000400000-0x00000000007A0000-memory.dmp

Filesize
3.6MB

Download
memory/2712-16-0x0000000000F60000-0x0000000001300000-memory.dmp

Filesize
3.6MB

Download
memory/2828-28-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2828-27-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2828-24-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2828-21-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2828-29-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2828-42-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2828-30-0x0000000000F00000-0x00000000012A0000-memory.dmp

Filesize
3.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads