xtremerat | e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/10/2022, 23:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe
Size

767KB
MD5

5904871d8801f165e37c246bbf79f286
SHA1

4a4233176739b9437032be597923b2241b8265d5
SHA256

e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9
SHA512

f8c0e1d89819011f56880b7af29090970f91592d46dfae085e0900a4f655635c9adcb467a8b60c95f3a81b80230e21c88e92e4f40f21a1360d43e390f778b24c
SSDEEP

12288:EyJJsR1oT51musrmQqAXlhUQEUac8YT1fo9GVB7Ue9IgM1bI3U:i+51mL1Xce1w9GVB7UzbIE

Score

10^/10

xtremerat evasion persistence rat spyware

Malware Config

Extracted

Family

xtremerat

dfuso.zapto.org

Signatures

Detect XtremeRAT payload 13 IoCs

resource	yara_rule
behavioral1/memory/1936-58-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral1/memory/1936-59-0x0000000000C88ABC-mapping.dmp	family_xtremerat
behavioral1/memory/1936-60-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral1/memory/1936-62-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral1/memory/1936-64-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral1/memory/904-68-0x0000000000000000-mapping.dmp	family_xtremerat
behavioral1/memory/904-71-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral1/memory/1616-74-0x0000000000000000-mapping.dmp	family_xtremerat
behavioral1/memory/468-78-0x0000000000000000-mapping.dmp	family_xtremerat
behavioral1/memory/1616-82-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral1/memory/1936-83-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral1/memory/468-84-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral1/memory/468-85-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{726K875W-T4RC-0E18-623A-EUV07N8XK17E}	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{726K875W-T4RC-0E18-623A-EUV07N8XK17E}\StubPath = "C:\\Windows\\system32\\winunpz\\djeiwr.exe restart"	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{726K875W-T4RC-0E18-623A-EUV07N8XK17E}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{726K875W-T4RC-0E18-623A-EUV07N8XK17E}\StubPath = "C:\\Windows\\system32\\winunpz\\djeiwr.exe restart"	svchost.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe

Deletes itself 1 IoCs

pid	Process
1616	explorer.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Wine	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\winunpz\\djeiwr.exe"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\winunpz\\djeiwr.exe"	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\winunpz\\djeiwr.exe"	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\winunpz\\djeiwr.exe"	svchost.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\winunpz\djeiwr.exe	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe
File created	C:\Windows\SysWOW64\winunpz\djeiwr.exe	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe
File opened for modification	C:\Windows\SysWOW64\winunpz\	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1268	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1268 set thread context of 1936	1268	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	26

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1268	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe
1936	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1268	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe
468	explorer.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 1936	1268	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	26
PID 1268 wrote to memory of 1936	1268	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	26
PID 1268 wrote to memory of 1936	1268	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	26
PID 1268 wrote to memory of 1936	1268	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	26
PID 1268 wrote to memory of 1936	1268	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	26
PID 1268 wrote to memory of 1936	1268	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	26
PID 1268 wrote to memory of 1936	1268	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	26
PID 1268 wrote to memory of 1936	1268	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	26
PID 1268 wrote to memory of 1936	1268	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	26
PID 1268 wrote to memory of 1936	1268	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	26
PID 1268 wrote to memory of 1936	1268	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	26
PID 1268 wrote to memory of 1936	1268	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	26
PID 1268 wrote to memory of 1936	1268	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	26
PID 1268 wrote to memory of 1936	1268	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	26
PID 1936 wrote to memory of 904	1936	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	27
PID 1936 wrote to memory of 904	1936	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	27
PID 1936 wrote to memory of 904	1936	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	27
PID 1936 wrote to memory of 904	1936	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	27
PID 1936 wrote to memory of 904	1936	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	27
PID 1936 wrote to memory of 268	1936	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	28
PID 1936 wrote to memory of 268	1936	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	28
PID 1936 wrote to memory of 268	1936	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	28
PID 1936 wrote to memory of 268	1936	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	28
PID 1936 wrote to memory of 468	1936	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	29
PID 1936 wrote to memory of 468	1936	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	29
PID 1936 wrote to memory of 468	1936	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	29
PID 1936 wrote to memory of 468	1936	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	29
PID 1936 wrote to memory of 1616	1936	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	30
PID 1936 wrote to memory of 1616	1936	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	30
PID 1936 wrote to memory of 1616	1936	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	30
PID 1936 wrote to memory of 1616	1936	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	30
PID 1936 wrote to memory of 1616	1936	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	30
PID 1936 wrote to memory of 468	1936	e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe	29

C:\Users\Admin\AppData\Local\Temp\e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe
"C:\Users\Admin\AppData\Local\Temp\e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe"
1⤵
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Users\Admin\AppData\Local\Temp\e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe
  "C:\Users\Admin\AppData\Local\Temp\e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9.exe"
  2⤵
  - Modifies Installed Components in the registry
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - Modifies Installed Components in the registry
    - Adds Run key to start application
    PID:904
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:268
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:468
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - Deletes itself
    PID:1616

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\winunpz\djeiwr.exe

Filesize
767KB

MD5
5904871d8801f165e37c246bbf79f286

SHA1
4a4233176739b9437032be597923b2241b8265d5

SHA256
e9b82889b8e458dce4efa341d1c9fb3da7ad9246d37c16707bd31b3ec5509eb9

SHA512
f8c0e1d89819011f56880b7af29090970f91592d46dfae085e0900a4f655635c9adcb467a8b60c95f3a81b80230e21c88e92e4f40f21a1360d43e390f778b24c

Download Submit
memory/468-85-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/468-84-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/468-80-0x0000000074781000-0x0000000074783000-memory.dmp

Filesize
8KB

Download
memory/904-71-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/904-66-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/1268-65-0x0000000000400000-0x00000000005DA000-memory.dmp

Filesize
1.9MB

Download
memory/1268-54-0x0000000074F41000-0x0000000074F43000-memory.dmp

Filesize
8KB

Download
memory/1268-63-0x0000000000400000-0x00000000005DA000-memory.dmp

Filesize
1.9MB

Download
memory/1268-55-0x0000000000400000-0x00000000005DA000-memory.dmp

Filesize
1.9MB

Download
memory/1616-82-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/1936-64-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/1936-62-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/1936-60-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/1936-83-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/1936-58-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download