xtremerat | f6d4b40a18bb3c32cb074006c1dbb86444dbf7fdeda51a8d4d0f5a067ec1e27b

General

Target

f6d4b40a18bb3c32cb074006c1dbb86444dbf7fdeda51a8d4d0f5a067ec1e27b.exe
Size

88KB
MD5

63deeb103e37e968c17e4563174830fe
SHA1

887f45d76a7d798af47bfcfc9c832a1343dae68d
SHA256

f6d4b40a18bb3c32cb074006c1dbb86444dbf7fdeda51a8d4d0f5a067ec1e27b
SHA512

36e083cf440fc98c1a4145c6b08df9b1cd86f6a9a73cefac9f2e55abf3a0e8f12608d33e62e980a32bc659aa956892ab60647f1a1e609ef536e6267dab61dbc8
SSDEEP

1536:kqCU1Llu7HttiUq6yry0Qo5LDMzs3p5VEqzm7zNdqKrj9hleVHy:vINtc6y29o1AzE5Vlzm7zprj9Lsy

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Extracted

Family

xtremerat

C2

googie.myvnc.com

Signatures

Detect XtremeRAT payload 6 IoCs

resource	yara_rule
behavioral1/memory/1520-66-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral1/memory/860-69-0x0000000000000000-mapping.dmp	family_xtremerat
behavioral1/memory/1520-71-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral1/memory/860-72-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral1/memory/1520-74-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral1/memory/860-75-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1520-57-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/1520-59-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/1520-60-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/1520-64-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/1520-66-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/1520-71-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/860-72-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/1520-74-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/860-75-0x0000000010000000-0x000000001004D000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 996 set thread context of 1520	996	f6d4b40a18bb3c32cb074006c1dbb86444dbf7fdeda51a8d4d0f5a067ec1e27b.exe	27

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
996	f6d4b40a18bb3c32cb074006c1dbb86444dbf7fdeda51a8d4d0f5a067ec1e27b.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 1520	996	f6d4b40a18bb3c32cb074006c1dbb86444dbf7fdeda51a8d4d0f5a067ec1e27b.exe	27
PID 996 wrote to memory of 1520	996	f6d4b40a18bb3c32cb074006c1dbb86444dbf7fdeda51a8d4d0f5a067ec1e27b.exe	27
PID 996 wrote to memory of 1520	996	f6d4b40a18bb3c32cb074006c1dbb86444dbf7fdeda51a8d4d0f5a067ec1e27b.exe	27
PID 996 wrote to memory of 1520	996	f6d4b40a18bb3c32cb074006c1dbb86444dbf7fdeda51a8d4d0f5a067ec1e27b.exe	27
PID 996 wrote to memory of 1520	996	f6d4b40a18bb3c32cb074006c1dbb86444dbf7fdeda51a8d4d0f5a067ec1e27b.exe	27
PID 996 wrote to memory of 1520	996	f6d4b40a18bb3c32cb074006c1dbb86444dbf7fdeda51a8d4d0f5a067ec1e27b.exe	27
PID 996 wrote to memory of 1520	996	f6d4b40a18bb3c32cb074006c1dbb86444dbf7fdeda51a8d4d0f5a067ec1e27b.exe	27
PID 996 wrote to memory of 1520	996	f6d4b40a18bb3c32cb074006c1dbb86444dbf7fdeda51a8d4d0f5a067ec1e27b.exe	27
PID 1520 wrote to memory of 860	1520	f6d4b40a18bb3c32cb074006c1dbb86444dbf7fdeda51a8d4d0f5a067ec1e27b.exe	28
PID 1520 wrote to memory of 860	1520	f6d4b40a18bb3c32cb074006c1dbb86444dbf7fdeda51a8d4d0f5a067ec1e27b.exe	28
PID 1520 wrote to memory of 860	1520	f6d4b40a18bb3c32cb074006c1dbb86444dbf7fdeda51a8d4d0f5a067ec1e27b.exe	28
PID 1520 wrote to memory of 860	1520	f6d4b40a18bb3c32cb074006c1dbb86444dbf7fdeda51a8d4d0f5a067ec1e27b.exe	28
PID 1520 wrote to memory of 860	1520	f6d4b40a18bb3c32cb074006c1dbb86444dbf7fdeda51a8d4d0f5a067ec1e27b.exe	28
PID 1520 wrote to memory of 1216	1520	f6d4b40a18bb3c32cb074006c1dbb86444dbf7fdeda51a8d4d0f5a067ec1e27b.exe	29
PID 1520 wrote to memory of 1216	1520	f6d4b40a18bb3c32cb074006c1dbb86444dbf7fdeda51a8d4d0f5a067ec1e27b.exe	29
PID 1520 wrote to memory of 1216	1520	f6d4b40a18bb3c32cb074006c1dbb86444dbf7fdeda51a8d4d0f5a067ec1e27b.exe	29
PID 1520 wrote to memory of 1216	1520	f6d4b40a18bb3c32cb074006c1dbb86444dbf7fdeda51a8d4d0f5a067ec1e27b.exe	29
PID 1520 wrote to memory of 1216	1520	f6d4b40a18bb3c32cb074006c1dbb86444dbf7fdeda51a8d4d0f5a067ec1e27b.exe	29

C:\Users\Admin\AppData\Local\Temp\f6d4b40a18bb3c32cb074006c1dbb86444dbf7fdeda51a8d4d0f5a067ec1e27b.exe
"C:\Users\Admin\AppData\Local\Temp\f6d4b40a18bb3c32cb074006c1dbb86444dbf7fdeda51a8d4d0f5a067ec1e27b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996
- C:\Users\Admin\AppData\Local\Temp\f6d4b40a18bb3c32cb074006c1dbb86444dbf7fdeda51a8d4d0f5a067ec1e27b.exe
  C:\Users\Admin\AppData\Local\Temp\f6d4b40a18bb3c32cb074006c1dbb86444dbf7fdeda51a8d4d0f5a067ec1e27b.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:860
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:1216

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/860-75-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/860-72-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/996-65-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1520-63-0x0000000075E11000-0x0000000075E13000-memory.dmp

Filesize
8KB

Download
memory/1520-64-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/1520-66-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/1520-60-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/1520-56-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/1520-71-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/1520-59-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/1520-73-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1520-74-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/1520-57-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download

Analysis

Sharing