xtremerat | e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda

General

Target

e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe
Size

316KB
MD5

6388b0c729f20b3dbd680945479d2f80
SHA1

7b3d01217936f8028c7ba917cb73e15b6c51a823
SHA256

e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda
SHA512

1c8389364c37535521700fc45d61025a4578d295b39ab5028690a2807fb22072c03ad3ac4bfb58646290a71156e71f4457a197d52d7404e6131aa81c4e9134c0
SSDEEP

1536:2ntvJyGe1KmWCra7PRfV2GeJJL0Mk0PCZSAEDzzKb+4:skGe1jGPRyJ4saWD3c

Score

10^/10

xtremerat evasion persistence rat spyware trojan

Malware Config

Extracted

Family

xtremerat

C2

msg290yaho.myvnc.com

Signatures

Detect XtremeRAT payload 8 IoCs

resource	yara_rule
behavioral2/memory/4920-135-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/4920-134-0x0000000000000000-mapping.dmp	family_xtremerat
behavioral2/memory/4920-136-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/4920-137-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/4920-138-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/5116-139-0x0000000000000000-mapping.dmp	family_xtremerat
behavioral2/memory/4920-140-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/5116-141-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3212 set thread context of 4920	3212	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1728	5116	WerFault.exe	84
1328	5116	WerFault.exe	84

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	3212	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3212	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 4920	3212	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	83
PID 3212 wrote to memory of 4920	3212	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	83
PID 3212 wrote to memory of 4920	3212	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	83
PID 3212 wrote to memory of 4920	3212	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	83
PID 3212 wrote to memory of 4920	3212	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	83
PID 3212 wrote to memory of 4920	3212	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	83
PID 3212 wrote to memory of 4920	3212	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	83
PID 3212 wrote to memory of 4920	3212	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	83
PID 3212 wrote to memory of 4920	3212	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	83
PID 3212 wrote to memory of 4920	3212	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	83
PID 3212 wrote to memory of 4920	3212	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	83
PID 3212 wrote to memory of 4920	3212	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	83
PID 3212 wrote to memory of 4920	3212	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	83
PID 4920 wrote to memory of 5116	4920	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	84
PID 4920 wrote to memory of 5116	4920	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	84
PID 4920 wrote to memory of 5116	4920	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	84
PID 4920 wrote to memory of 5116	4920	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	84
PID 4920 wrote to memory of 2120	4920	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	85
PID 4920 wrote to memory of 2120	4920	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	85
PID 4920 wrote to memory of 2120	4920	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe	85

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe

C:\Users\Admin\AppData\Local\Temp\e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe
"C:\Users\Admin\AppData\Local\Temp\e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe"
1⤵
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3212
- C:\Users\Admin\AppData\Local\Temp\e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe
  "C:\Users\Admin\AppData\Local\Temp\e9348cb01ad037af1b8043989cd525e47e5c271ff49aece168432eadfb69beda.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:5116
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 488
      4⤵
      Program crash
      PID:1728
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 508
      4⤵
      Program crash
      PID:1328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5116 -ip 5116
1⤵
PID:2668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5116 -ip 5116
1⤵
PID:4120

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4920-135-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/4920-134-0x0000000000000000-mapping.dmp

Download
memory/4920-136-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/4920-137-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/4920-138-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/4920-140-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/5116-139-0x0000000000000000-mapping.dmp

Download
memory/5116-141-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads