xtremerat | 52c4f19fe6ac08c8a23e841f4704121950421c32e8a78b8e5f46a1d8e1a574b6

Analysis

max time kernel
103s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
17/03/2025, 10:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_7ddf01df05eb4f9affa42914d91da24a.exe
Size

194KB
MD5

7ddf01df05eb4f9affa42914d91da24a
SHA1

10f56c3b002d8f877288cce8898bec0fa05e1deb
SHA256

52c4f19fe6ac08c8a23e841f4704121950421c32e8a78b8e5f46a1d8e1a574b6
SHA512

75bdbeeb978a932e73d5f61b4483749219a02c579ad8b35fd3f33c93a3d7e3d8379792a43a0fc19431ab28261efa0455f979b91fdf36144f270b4c180de3dabd
SSDEEP

3072:44lRkAehGfzmuqTPryF5draBIpPQMPozgEAQIIOxm9v9S:44lRkAehaKuqT+F5draBCDorAB4K

Score

10^/10

xtremerat discovery persistence rat spyware

Malware Config

Signatures

Detect XtremeRAT payload 2 IoCs

resource	yara_rule
behavioral2/files/0x00060000000227be-4.dat	family_xtremerat
behavioral2/memory/3448-9-0x0000000000C80000-0x0000000000C92000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Xtremerat family
xtremerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	JaffaCakes118_7ddf01df05eb4f9affa42914d91da24a.exe

Executes dropped EXE 1 IoCs

pid	Process
3448	1.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\__tmp_rar_sfx_access_check_240615343	JaffaCakes118_7ddf01df05eb4f9affa42914d91da24a.exe
File created	C:\Windows\1.exe	JaffaCakes118_7ddf01df05eb4f9affa42914d91da24a.exe
File opened for modification	C:\Windows\1.exe	JaffaCakes118_7ddf01df05eb4f9affa42914d91da24a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4180	3448	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7ddf01df05eb4f9affa42914d91da24a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 3448	3100	JaffaCakes118_7ddf01df05eb4f9affa42914d91da24a.exe	88
PID 3100 wrote to memory of 3448	3100	JaffaCakes118_7ddf01df05eb4f9affa42914d91da24a.exe	88
PID 3100 wrote to memory of 3448	3100	JaffaCakes118_7ddf01df05eb4f9affa42914d91da24a.exe	88

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7ddf01df05eb4f9affa42914d91da24a.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7ddf01df05eb4f9affa42914d91da24a.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3100
- C:\WINDOWS\1.exe
  "C:\WINDOWS\1.exe"
  2⤵
  - Executes dropped EXE
  PID:3448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 500
    3⤵
    - Program crash
    PID:4180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3448 -ip 3448
1⤵
PID:4872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\1.exe

Filesize
40KB

MD5
2bd4570ab11e273b365e0527abdee325

SHA1
d0d753d1db682a23c3a7875e645cbc42abc95a03

SHA256
6328c12432677c5533db16757d50904910946fbb5e46aeca60a0de565a60fe7b

SHA512
7fb02e2b01d1fbec2248783261a9af5b0337afc5246d472cfce87de75c3a3d64e234d12c90176e3292468c2ecec6ccd19c7af9cf6c61bd9b097ced6415a7a872

Download Submit
memory/3448-9-0x0000000000C80000-0x0000000000C92000-memory.dmp

Filesize
72KB

Download