xtremerat | 332996f178bab2733717a5a46632f4622d0df1519dd782e532bf47ccfe95aac4

General

Target

JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe
Size

1.0MB
MD5

625f1ab0811df7656488d52c0fe6df7f
SHA1

efe2d912e509cca41c244345786c01d5a98cf136
SHA256

332996f178bab2733717a5a46632f4622d0df1519dd782e532bf47ccfe95aac4
SHA512

a64e335051683b080552c82b137f87819c64125cb97b61f3b007d36c0d45af4633b0f366a589f758c925f3ead19bd7516bb4847005d9f0ba602f07c601e26db3
SSDEEP

24576:2520OwmxOKXJHtkjaYvZJiffU8AazZDd+w1TuED:420jKJkaqZJJ8Aazxd+Uq

Score

10^/10

xtremerat discovery persistence rat spyware upx

Malware Config

Extracted

Family

xtremerat

C2

korcerrah.no-ip.biz

Signatures

Detect XtremeRAT payload 4 IoCs

resource	yara_rule
behavioral2/memory/3104-17-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/3104-18-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/3164-23-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/3164-24-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Xtremerat family
xtremerat

Executes dropped EXE 3 IoCs

pid	Process
4604	java.exe
3104	java.exe
4292	launcher.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4604 set thread context of 3104	4604	java.exe	82

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3104-10-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/3104-15-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/3104-17-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/3104-18-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/3104-13-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/3164-23-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/3164-24-0x0000000010000000-0x000000001004D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1924	3164	WerFault.exe	84
828	3164	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	java.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	java.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4604	java.exe
4604	java.exe
4292	launcher.exe
4292	launcher.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 4604	1656	JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe	81
PID 1656 wrote to memory of 4604	1656	JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe	81
PID 1656 wrote to memory of 4604	1656	JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe	81
PID 4604 wrote to memory of 3104	4604	java.exe	82
PID 4604 wrote to memory of 3104	4604	java.exe	82
PID 4604 wrote to memory of 3104	4604	java.exe	82
PID 4604 wrote to memory of 3104	4604	java.exe	82
PID 4604 wrote to memory of 3104	4604	java.exe	82
PID 4604 wrote to memory of 3104	4604	java.exe	82
PID 4604 wrote to memory of 3104	4604	java.exe	82
PID 4604 wrote to memory of 3104	4604	java.exe	82
PID 1656 wrote to memory of 4292	1656	JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe	83
PID 1656 wrote to memory of 4292	1656	JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe	83
PID 1656 wrote to memory of 4292	1656	JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe	83
PID 3104 wrote to memory of 3164	3104	java.exe	84
PID 3104 wrote to memory of 3164	3104	java.exe	84
PID 3104 wrote to memory of 3164	3104	java.exe	84
PID 3104 wrote to memory of 3164	3104	java.exe	84
PID 3104 wrote to memory of 3680	3104	java.exe	85
PID 3104 wrote to memory of 3680	3104	java.exe	85
PID 3104 wrote to memory of 3680	3104	java.exe	85

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_625f1ab0811df7656488d52c0fe6df7f.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\java.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\java.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\java.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\java.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3104
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3164
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 504
        5⤵
        Program crash
        
        PID:1924
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 512
        5⤵
        Program crash
        
        PID:828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3680
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\launcher.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\launcher.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3164 -ip 3164
1⤵
PID:1168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3164 -ip 3164
1⤵
PID:4936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\java.exe

Filesize
657KB

MD5
da0af3e686fed546be5b6b72c8fa73c5

SHA1
797d25724f0bbb12a041f71ed1b5c16760cc8ddf

SHA256
a9b9158a681ab964207ef6871fa876524fa389fafd7daa7c0f3ee93662a55c73

SHA512
339df2d46ee03ce9b66c86f9f569d5fc0197c33382328158fb5a524ee983fb3ae0ee6248297aec597328445b3ee73d0721d969056c02aca0b75cfded409ef3c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\launcher.exe

Filesize
829KB

MD5
88164229bedab3b56f859a816f2de699

SHA1
d0e5ac0a9e2604185b8176162789998ac7e96bb0

SHA256
2cd2e15f3a6927904a9d2cc9d13485f85edb575a4dfb82a84c5807c6b012c5be

SHA512
2222d7b1890670868940e1d9210d20ace6e85c3996a0c4029a8e818a1bc1b8ede60ba6b03c4e58a8e7a199acacdcb647a8218d35104330569d75712d8379d292

Download Submit
memory/3104-10-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/3104-15-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/3104-17-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/3104-18-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/3104-13-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/3164-23-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/3164-24-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/4292-25-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/4604-7-0x0000000000400000-0x00000000007A0000-memory.dmp

Filesize
3.6MB

Download
memory/4604-19-0x0000000000400000-0x00000000007A0000-memory.dmp

Filesize
3.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads