xtremerat | b76a807606db6a1aac5682e7d41029d4c37cadf66450ac3921d3f52185b786aa

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2025 14:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_0c47fb7fd347405b55d70e63b0e30a3b.exe
Size

107KB
MD5

0c47fb7fd347405b55d70e63b0e30a3b
SHA1

4acf8903ff82f35509be14e5530bffea3fd1957d
SHA256

b76a807606db6a1aac5682e7d41029d4c37cadf66450ac3921d3f52185b786aa
SHA512

ed481e19d59a5417408d542f08a38f3ce734b51ff18248470817e919faa1b4d9252e4871a00112ab70874f813da03ceca6c925b2e4603630de698e8d863cac03
SSDEEP

3072:1sB1D0vmB7U+OxyN+RcAx05aX74BsPNuMqLIe+:yB1wv4oRxbR905aXgssMre+

Score

10^/10

xtremerat discovery persistence rat spyware

Malware Config

Signatures

Detect XtremeRAT payload 6 IoCs

resource	yara_rule
behavioral2/memory/1960-7-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/1960-6-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/1960-5-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/1960-3-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/1960-1-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/1960-0-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Xtremerat family
xtremerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1572 set thread context of 1960	1572	JaffaCakes118_0c47fb7fd347405b55d70e63b0e30a3b.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4624	1960	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0c47fb7fd347405b55d70e63b0e30a3b.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 1960	1572	JaffaCakes118_0c47fb7fd347405b55d70e63b0e30a3b.exe	86
PID 1572 wrote to memory of 1960	1572	JaffaCakes118_0c47fb7fd347405b55d70e63b0e30a3b.exe	86
PID 1572 wrote to memory of 1960	1572	JaffaCakes118_0c47fb7fd347405b55d70e63b0e30a3b.exe	86
PID 1572 wrote to memory of 1960	1572	JaffaCakes118_0c47fb7fd347405b55d70e63b0e30a3b.exe	86
PID 1572 wrote to memory of 1960	1572	JaffaCakes118_0c47fb7fd347405b55d70e63b0e30a3b.exe	86
PID 1572 wrote to memory of 1960	1572	JaffaCakes118_0c47fb7fd347405b55d70e63b0e30a3b.exe	86
PID 1572 wrote to memory of 1960	1572	JaffaCakes118_0c47fb7fd347405b55d70e63b0e30a3b.exe	86
PID 1572 wrote to memory of 1960	1572	JaffaCakes118_0c47fb7fd347405b55d70e63b0e30a3b.exe	86
PID 1572 wrote to memory of 1960	1572	JaffaCakes118_0c47fb7fd347405b55d70e63b0e30a3b.exe	86
PID 1572 wrote to memory of 1960	1572	JaffaCakes118_0c47fb7fd347405b55d70e63b0e30a3b.exe	86
PID 1572 wrote to memory of 1960	1572	JaffaCakes118_0c47fb7fd347405b55d70e63b0e30a3b.exe	86
PID 1572 wrote to memory of 1960	1572	JaffaCakes118_0c47fb7fd347405b55d70e63b0e30a3b.exe	86
PID 1572 wrote to memory of 1960	1572	JaffaCakes118_0c47fb7fd347405b55d70e63b0e30a3b.exe	86

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0c47fb7fd347405b55d70e63b0e30a3b.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0c47fb7fd347405b55d70e63b0e30a3b.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0c47fb7fd347405b55d70e63b0e30a3b.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0c47fb7fd347405b55d70e63b0e30a3b.exe
  2⤵
  PID:1960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 12
    3⤵
    - Program crash
    PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1960 -ip 1960
1⤵
PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1572-9-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1960-7-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1960-6-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1960-5-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1960-3-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1960-1-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1960-0-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download