xtremerat | e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda

General

Target

e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe
Size

316KB
MD5

6388b0c729f20b3dbd680945479d2f80
SHA1

7b3d01217936f8028c7ba917cb73e15b6c51a823
SHA256

e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda
SHA512

1c8389364c37535521700fc45d61025a4578d295b39ab5028690a2807fb22072c03ad3ac4bfb58646290a71156e71f4457a197d52d7404e6131aa81c4e9134c0
SSDEEP

1536:2ntvJyGe1KmWCra7PRfV2GeJJL0Mk0PCZSAEDzzKb+4:skGe1jGPRyJ4saWD3c

Score

10^/10

xtremerat evasion persistence rat spyware trojan

Malware Config

Extracted

Family

xtremerat

C2

msg290yaho.myvnc.com

Signatures

Detect XtremeRAT payload 9 IoCs

resource	yara_rule
behavioral1/memory/1596-57-0x000000001000D0F4-mapping.dmp	family_xtremerat
behavioral1/memory/1596-58-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/1596-56-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/1596-60-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/1596-61-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/1032-64-0x0000000000000000-mapping.dmp	family_xtremerat
behavioral1/memory/1032-66-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/1596-67-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/1032-68-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0"	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0"	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1836 set thread context of 1596	1836	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	1836	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1836	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 1596	1836	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	29
PID 1836 wrote to memory of 1596	1836	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	29
PID 1836 wrote to memory of 1596	1836	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	29
PID 1836 wrote to memory of 1596	1836	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	29
PID 1836 wrote to memory of 1596	1836	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	29
PID 1836 wrote to memory of 1596	1836	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	29
PID 1836 wrote to memory of 1596	1836	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	29
PID 1836 wrote to memory of 1596	1836	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	29
PID 1836 wrote to memory of 1596	1836	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	29
PID 1836 wrote to memory of 1596	1836	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	29
PID 1836 wrote to memory of 1596	1836	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	29
PID 1836 wrote to memory of 1596	1836	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	29
PID 1836 wrote to memory of 1596	1836	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	29
PID 1836 wrote to memory of 1596	1836	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	29
PID 1596 wrote to memory of 1032	1596	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	30
PID 1596 wrote to memory of 1032	1596	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	30
PID 1596 wrote to memory of 1032	1596	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	30
PID 1596 wrote to memory of 1032	1596	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	30
PID 1596 wrote to memory of 1032	1596	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	30
PID 1596 wrote to memory of 1468	1596	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	31
PID 1596 wrote to memory of 1468	1596	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	31
PID 1596 wrote to memory of 1468	1596	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	31
PID 1596 wrote to memory of 1468	1596	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	31
PID 1596 wrote to memory of 1468	1596	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	31

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe

C:\Users\Admin\AppData\Local\Temp\e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe
"C:\Users\Admin\AppData\Local\Temp\e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe"
1⤵
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1836
- C:\Users\Admin\AppData\Local\Temp\e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe
  "C:\Users\Admin\AppData\Local\Temp\e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:1032
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:1468

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1032-62-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1032-64-0x0000000000000000-mapping.dmp

Download
memory/1032-66-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1032-68-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1596-57-0x000000001000D0F4-mapping.dmp

Download
memory/1596-58-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1596-56-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1596-59-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download
memory/1596-60-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1596-61-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1596-67-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads