xtremerat | 7bec450473cf1cffaba40e912d04dd7cc5da0d00649f17c31a099557721c74d9

General

Target

7bec450473cf1cffaba40e912d04dd7cc5da0d00649f17c31a099557721c74d9.exe
Size

106KB
MD5

aa3f313ac924c27b2d2fe5acf6c5401a
SHA1

63fcc3eb367d36544dcd0810310ed26ba5f3ce4c
SHA256

7bec450473cf1cffaba40e912d04dd7cc5da0d00649f17c31a099557721c74d9
SHA512

f07c87f247ca1346a5d4279730795c77b2a5150482482e7dca816278e7785d524c0c3ddf0997fe25ec20ce8cb5f29d68bda006e594e4f0ad64f2ffe964bb2a89
SSDEEP

1536:rqHvMCaAweZSsHpy/RGeCyjmKq5D6pMFhWi+PUlOCX/Aq4eoiU:atUsHp+5xe5WWHAyo1

Score

10^/10

Malware Config

Signatures

Detect XtremeRAT payload 14 IoCs

resource	yara_rule
behavioral1/memory/1800-59-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/1800-60-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/1800-61-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/1800-62-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/1800-63-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/1800-66-0x000000001000D07C-mapping.dmp	family_xtremerat
behavioral1/memory/1800-65-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/1800-67-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/1800-69-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/1800-70-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/1116-73-0x0000000000000000-mapping.dmp	family_xtremerat
behavioral1/memory/1800-75-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/1116-76-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/1116-77-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1584 set thread context of 1800	1584	7bec450473cf1cffaba40e912d04dd7cc5da0d00649f17c31a099557721c74d9.exe	26

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1584	7bec450473cf1cffaba40e912d04dd7cc5da0d00649f17c31a099557721c74d9.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 1800	1584	7bec450473cf1cffaba40e912d04dd7cc5da0d00649f17c31a099557721c74d9.exe	26
PID 1584 wrote to memory of 1800	1584	7bec450473cf1cffaba40e912d04dd7cc5da0d00649f17c31a099557721c74d9.exe	26
PID 1584 wrote to memory of 1800	1584	7bec450473cf1cffaba40e912d04dd7cc5da0d00649f17c31a099557721c74d9.exe	26
PID 1584 wrote to memory of 1800	1584	7bec450473cf1cffaba40e912d04dd7cc5da0d00649f17c31a099557721c74d9.exe	26
PID 1584 wrote to memory of 1800	1584	7bec450473cf1cffaba40e912d04dd7cc5da0d00649f17c31a099557721c74d9.exe	26
PID 1584 wrote to memory of 1800	1584	7bec450473cf1cffaba40e912d04dd7cc5da0d00649f17c31a099557721c74d9.exe	26
PID 1584 wrote to memory of 1800	1584	7bec450473cf1cffaba40e912d04dd7cc5da0d00649f17c31a099557721c74d9.exe	26
PID 1584 wrote to memory of 1800	1584	7bec450473cf1cffaba40e912d04dd7cc5da0d00649f17c31a099557721c74d9.exe	26
PID 1584 wrote to memory of 1800	1584	7bec450473cf1cffaba40e912d04dd7cc5da0d00649f17c31a099557721c74d9.exe	26
PID 1584 wrote to memory of 1800	1584	7bec450473cf1cffaba40e912d04dd7cc5da0d00649f17c31a099557721c74d9.exe	26
PID 1584 wrote to memory of 1800	1584	7bec450473cf1cffaba40e912d04dd7cc5da0d00649f17c31a099557721c74d9.exe	26
PID 1584 wrote to memory of 1800	1584	7bec450473cf1cffaba40e912d04dd7cc5da0d00649f17c31a099557721c74d9.exe	26
PID 1800 wrote to memory of 1116	1800	7bec450473cf1cffaba40e912d04dd7cc5da0d00649f17c31a099557721c74d9.exe	27
PID 1800 wrote to memory of 1116	1800	7bec450473cf1cffaba40e912d04dd7cc5da0d00649f17c31a099557721c74d9.exe	27
PID 1800 wrote to memory of 1116	1800	7bec450473cf1cffaba40e912d04dd7cc5da0d00649f17c31a099557721c74d9.exe	27
PID 1800 wrote to memory of 1116	1800	7bec450473cf1cffaba40e912d04dd7cc5da0d00649f17c31a099557721c74d9.exe	27
PID 1800 wrote to memory of 1116	1800	7bec450473cf1cffaba40e912d04dd7cc5da0d00649f17c31a099557721c74d9.exe	27
PID 1800 wrote to memory of 844	1800	7bec450473cf1cffaba40e912d04dd7cc5da0d00649f17c31a099557721c74d9.exe	28
PID 1800 wrote to memory of 844	1800	7bec450473cf1cffaba40e912d04dd7cc5da0d00649f17c31a099557721c74d9.exe	28
PID 1800 wrote to memory of 844	1800	7bec450473cf1cffaba40e912d04dd7cc5da0d00649f17c31a099557721c74d9.exe	28
PID 1800 wrote to memory of 844	1800	7bec450473cf1cffaba40e912d04dd7cc5da0d00649f17c31a099557721c74d9.exe	28
PID 1800 wrote to memory of 844	1800	7bec450473cf1cffaba40e912d04dd7cc5da0d00649f17c31a099557721c74d9.exe	28

C:\Users\Admin\AppData\Local\Temp\7bec450473cf1cffaba40e912d04dd7cc5da0d00649f17c31a099557721c74d9.exe
"C:\Users\Admin\AppData\Local\Temp\7bec450473cf1cffaba40e912d04dd7cc5da0d00649f17c31a099557721c74d9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Users\Admin\AppData\Local\Temp\7bec450473cf1cffaba40e912d04dd7cc5da0d00649f17c31a099557721c74d9.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:1116
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1116-77-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1116-76-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1800-65-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1800-68-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

Filesize
8KB

Download
memory/1800-62-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1800-63-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1800-56-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1800-67-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1800-61-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1800-69-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1800-70-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1800-60-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1800-75-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1800-59-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1800-57-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download

Analysis

Sharing