xtremerat | 99a3202f491be08355089103dd25365f271749a244dfbb1114bb09d1ca1c2b6a

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/10/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Injector.pcbn.exe
Size 344KB
Sample261009-xtcwvaay8m
SHA256 99a3202f491be08355089103dd25365f271749a244dfbb1114bb09d1ca1c2b6a
MD5 305c25310e1a26aa9d78a7b172f615fc
SHA1 8521a6a4176b82e9f0fb02b8694b1e9b2a9ee96c
SHA512 726021ec6f680a6d1a6f6e5ff426b7e50aab499ea6b4ab584ea9e4047ef51139611059e7f81629ee85fa6e6f1214becd8281ad89cdfb2d60aef9a0a39eee8121
SSDEEP 6144:WbB8IHeMQjhIWPrjAlZbXJsPAzCi7/isDqCzlneblS9:WthHeMQjZPrgZbWCCi7VmCzlGl
TLSH
T16774E101BBD5C5B7D1B012BA09EF5BB44734EE6A47314BC767A4FA315C222509B0F39A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery xtremerat persistence rat spyware upx

Malware Config

Signatures

Family: XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Detect XtremeRAT payload 3 IoCs

resource	yara_rule
behavioral1/memory/3716-23-0x0000000010000000-0x0000000010049000-memory.dmp	family_xtremerat
behavioral1/memory/3716-26-0x0000000010000000-0x0000000010049000-memory.dmp	family_xtremerat
behavioral1/memory/1144-28-0x0000000010000000-0x0000000010049000-memory.dmp	family_xtremerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	jaffacakes118_Trojan-Dropper.Win32.Injector.pcbn.exe

Executes dropped EXE 2 IoCs

pid	Process
3716	1.exe
4988	2.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00110000000243d0-7.dat	upx
behavioral1/memory/3716-23-0x0000000010000000-0x0000000010049000-memory.dmp	upx
behavioral1/memory/3716-26-0x0000000010000000-0x0000000010049000-memory.dmp	upx
behavioral1/memory/1144-28-0x0000000010000000-0x0000000010049000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
432	1144	WerFault.exe	90
4840	1144	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4988	2.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 3716	4772	jaffacakes118_Trojan-Dropper.Win32.Injector.pcbn.exe	88
PID 4772 wrote to memory of 4988	4772	jaffacakes118_Trojan-Dropper.Win32.Injector.pcbn.exe	89
PID 3716 wrote to memory of 1144	3716	1.exe	90
PID 3716 wrote to memory of 1144	3716	1.exe	90
PID 3716 wrote to memory of 4164	3716	1.exe	91
PID 3716 wrote to memory of 4164	3716	1.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Injector.pcbn.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Injector.pcbn.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Users\Admin\AppData\Local\Temp\1.exe
  "C:\Users\Admin\AppData\Local\Temp\1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3716
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1144
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1144 -s 480
      4⤵
      Program crash
      PID:432
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1144 -s 488
      4⤵
      Program crash
      PID:4840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4164
- C:\Users\Admin\AppData\Local\Temp\2.exe
  "C:\Users\Admin\AppData\Local\Temp\2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1144 -ip 1144
1⤵
PID:2088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1144 -ip 1144
1⤵
PID:2256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.exe

Path C:\Users\Admin\AppData\Local\Temp\1.exe
Size 27KB
SHA256 839af35d9c2397aa40ae562bdaf5b3638d3e884b9c2a9739e24892f42196cc3a
MD5 fb6a23f8f0001bcef1a7a382c771fa56
SHA1 61cb4c9e0c703cf2ef4054e612de9fcdb4fbf3cd
SHA512 cc7e3fce93ec4e5812c48dfd303f4878b80680e4cf3a1ce53729c84df60497cd613d8e3eafe2143745b9d5627969b459bf1e40de222d692767e75ef629f08b3b
SSDEEP 768:3DvUGW+cwg39Sa4ee3nsCmOesTEWktbBz8:wGBcDB4z3VnesTklBz8
TLSH
T192C2E0ADAF23A804D33396F49F17479D76D885B2963C0B91FC15442B7C076D91AB08AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2.exe

Path C:\Users\Admin\AppData\Local\Temp\2.exe
Size 300KB
SHA256 7b42e9cdcd42fe58885bfa526784d11bfe6324de63cdd7342473a04a3ebbefa7
MD5 9d13945ec32c7430982307e4e6ed2224
SHA1 43a12e233323c3ac0e4ec6bfbe22be3db27164a6
SHA512 fbb930eb4e8da453f3aa8742419ac4fc3669b71aa17d5b1958736355bd5a19309c4da511a57da86aa3859a00eb80bc33cefd8907a82ab93d917e993c17f26e69
SSDEEP 6144:EbB8IHeMQjhIWPrjAlZbXJsPAzCi7/isD:EthHeMQjZPrgZbWCCi7V
TLSH
T1E464D001BBD5C5F7D1B012BA08EF6BB44734EE6A47315BC763A4FA314D62250AB0E35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1144-28-0x0000000010000000-0x0000000010049000-memory.dmp

Download

memory/3716-23-0x0000000010000000-0x0000000010049000-memory.dmp

Download

memory/3716-26-0x0000000010000000-0x0000000010049000-memory.dmp

Download

memory/4772-0-0x00007FFCE0DE5000-0x00007FFCE0DE6000-memory.dmp

Download

memory/4772-3-0x00007FFCE0B30000-0x00007FFCE14D1000-memory.dmp

Download

memory/4772-4-0x00007FFCE0B30000-0x00007FFCE14D1000-memory.dmp

Download

memory/4772-8-0x00007FFCE0B30000-0x00007FFCE14D1000-memory.dmp

Download

memory/4772-20-0x00007FFCE0B30000-0x00007FFCE14D1000-memory.dmp

Download

memory/4772-22-0x00007FFCE0B30000-0x00007FFCE14D1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads