xtremerat | 5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4

Resubmissions

11-08-2022 15:42

220811-s5dkasbch6 10

31-07-2022 21:07

220731-zyandsgda9 10

Analysis

max time kernel
153s
max time network
172s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
11-08-2022 15:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
Size

280KB
MD5

ce079d3dad0e1d26bd0fec06249958fc
SHA1

0718bb878a04f653dc31b530579ccb901667ecaa
SHA256

5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4
SHA512

65568bf161e9d7b53e34b335b2fc3d3e77fe4b50aaf4004151a1268bedf13ce4082b97eb425ca7ee301b3f5ca5d6a4a2adbed9bafc48561ac2ae111a6f18a10f

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Extracted

Family

xtremerat

temp.ibadvisors.co

Signatures

Detect XtremeRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/820-61-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral1/memory/820-62-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral1/memory/820-63-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/820-56-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/820-60-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/820-61-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/820-62-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/820-63-0x0000000010000000-0x000000001004D000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe

description	pid	process	target process
PID 1920 set thread context of 820	1920	5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe	5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe

pid process

1920 5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe

pid	process
1920	5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe

description	pid	process	target process
PID 1920 wrote to memory of 820	1920	5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe	5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
PID 1920 wrote to memory of 820	1920	5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe	5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
PID 1920 wrote to memory of 820	1920	5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe	5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
PID 1920 wrote to memory of 820	1920	5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe	5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
PID 1920 wrote to memory of 820	1920	5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe	5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
PID 1920 wrote to memory of 820	1920	5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe	5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
PID 1920 wrote to memory of 820	1920	5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe	5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
PID 1920 wrote to memory of 820	1920	5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe	5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
PID 1920 wrote to memory of 820	1920	5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe	5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe

C:\Users\Admin\AppData\Local\Temp\5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
"C:\Users\Admin\AppData\Local\Temp\5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1920

C:\Users\Admin\AppData\Local\Temp\5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
"C:\Users\Admin\AppData\Local\Temp\5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe"
2⤵
PID:820

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/820-57-0x000000001004B900-mapping.dmp

Download
memory/820-56-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/820-59-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download
memory/820-60-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/820-61-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/820-62-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/820-63-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download