xtremerat | 1d28a6389bb2de22013f3db9fdd144fc606347fe165a550ca22429570deb4280

General

Target
jaffacakes118__2911a2d0849999cd6aa4bb2d90fe45ec.exe
Size 1.2MB
Sample260920-2lnqlatzav
SHA256 1d28a6389bb2de22013f3db9fdd144fc606347fe165a550ca22429570deb4280
MD5 2911a2d0849999cd6aa4bb2d90fe45ec
SHA1 7d20b672c88fca3c2a53fef6848dddc068fba0e2
SHA512 f35c995d6e05408e488066a1606b9bc814b6cd5cec460b83ae7f7d0b71f102ad905db7ec44dc759ce690c438f4a0e65c025f3a312399e9bf7e5778a4478d824a
SSDEEP 12288:8btIEYQqLW7y3l+LUZclgdYxThUegN56fIM6SkYQqLWpbtIEUZclgdYxThUegN5i:8nYJLT3lokYJLYBREk8n4XYJL
TLSH
T1584583253A78522BD060D6B8CFE1B463A41BBC2F35D08C7191A6770A83B7F47259B63D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery xtremerat persistence rat spyware

Malware Config

Extracted

Family

xtremerat

C2

z2a.no-ip.info

Signatures

Family: XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Detect XtremeRAT payload 7 IoCs

resource	yara_rule
behavioral2/memory/2352-2-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/2352-3-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/2352-4-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/2352-5-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/5956-6-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/2352-7-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/5956-8-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4548 set thread context of 2352	4548	jaffacakes118__2911a2d0849999cd6aa4bb2d90fe45ec.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5124	5956	WerFault.exe	91
2640	5956	WerFault.exe	91

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__2911a2d0849999cd6aa4bb2d90fe45ec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__2911a2d0849999cd6aa4bb2d90fe45ec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4548	jaffacakes118__2911a2d0849999cd6aa4bb2d90fe45ec.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 2352	4548	jaffacakes118__2911a2d0849999cd6aa4bb2d90fe45ec.exe	90
PID 4548 wrote to memory of 2352	4548	jaffacakes118__2911a2d0849999cd6aa4bb2d90fe45ec.exe	90
PID 4548 wrote to memory of 2352	4548	jaffacakes118__2911a2d0849999cd6aa4bb2d90fe45ec.exe	90
PID 4548 wrote to memory of 2352	4548	jaffacakes118__2911a2d0849999cd6aa4bb2d90fe45ec.exe	90
PID 4548 wrote to memory of 2352	4548	jaffacakes118__2911a2d0849999cd6aa4bb2d90fe45ec.exe	90
PID 4548 wrote to memory of 2352	4548	jaffacakes118__2911a2d0849999cd6aa4bb2d90fe45ec.exe	90
PID 4548 wrote to memory of 2352	4548	jaffacakes118__2911a2d0849999cd6aa4bb2d90fe45ec.exe	90
PID 4548 wrote to memory of 2352	4548	jaffacakes118__2911a2d0849999cd6aa4bb2d90fe45ec.exe	90
PID 2352 wrote to memory of 5956	2352	jaffacakes118__2911a2d0849999cd6aa4bb2d90fe45ec.exe	91
PID 2352 wrote to memory of 5956	2352	jaffacakes118__2911a2d0849999cd6aa4bb2d90fe45ec.exe	91
PID 2352 wrote to memory of 4212	2352	jaffacakes118__2911a2d0849999cd6aa4bb2d90fe45ec.exe	92
PID 2352 wrote to memory of 4212	2352	jaffacakes118__2911a2d0849999cd6aa4bb2d90fe45ec.exe	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2911a2d0849999cd6aa4bb2d90fe45ec.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2911a2d0849999cd6aa4bb2d90fe45ec.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2911a2d0849999cd6aa4bb2d90fe45ec.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2911a2d0849999cd6aa4bb2d90fe45ec.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5956
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5956 -s 528
      4⤵
      Program crash
      PID:5124
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5956 -s 536
      4⤵
      Program crash
      PID:2640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5956 -ip 5956
1⤵
PID:5340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5956 -ip 5956
1⤵
PID:4580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2352-2-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/2352-3-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/2352-4-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/2352-5-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/2352-7-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/5956-6-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/5956-8-0x0000000010000000-0x000000001004A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads