xtremerat | eb2f00a6f30af31236fd3b3d159ec0afe266d3252ac4eab0ac33a8d10ce3642e

General

Target

eb2f00a6f30af31236fd3b3d159ec0afe266d3252ac4eab0ac33a8d10ce3642e.exe
Size

352KB
MD5

0b152cf8897e772007edb904778de108
SHA1

890c1b3abb912bed4242aafb3d5d3cb27215474c
SHA256

eb2f00a6f30af31236fd3b3d159ec0afe266d3252ac4eab0ac33a8d10ce3642e
SHA512

c0234e3d0f48c8d7bf35edd0db2f26f924194695eb49ec1c13f47fa5243a4cf6524f2e5fe4689e4c1ecd4e62804ef813510221c44a0abd5d219b69b0f34d6d0f
SSDEEP

768:U+Zd3mQLUBTD3xlCnhyDQ9qmJ1+mEHQ0+rmzgQZ1mUdtF+UqvJObuqYsFa2x7tdl:UGdbL7kWb+m1Q+KMUqvuut2xpBi/2mO

Score

10^/10

Malware Config

Signatures

Detect XtremeRAT payload 3 IoCs

resource	yara_rule
behavioral1/memory/1072-61-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral1/memory/1072-62-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral1/memory/1072-63-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1072-61-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/1072-60-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/1072-56-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/1072-62-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/1072-63-0x0000000010000000-0x000000001004D000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	eb2f00a6f30af31236fd3b3d159ec0afe266d3252ac4eab0ac33a8d10ce3642e.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	eb2f00a6f30af31236fd3b3d159ec0afe266d3252ac4eab0ac33a8d10ce3642e.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1668 set thread context of 1072	1668	eb2f00a6f30af31236fd3b3d159ec0afe266d3252ac4eab0ac33a8d10ce3642e.exe	24

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InstallDir\Server.exe	eb2f00a6f30af31236fd3b3d159ec0afe266d3252ac4eab0ac33a8d10ce3642e.exe
File created	C:\Windows\InstallDir\Server.exe	eb2f00a6f30af31236fd3b3d159ec0afe266d3252ac4eab0ac33a8d10ce3642e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1668	eb2f00a6f30af31236fd3b3d159ec0afe266d3252ac4eab0ac33a8d10ce3642e.exe
1072	eb2f00a6f30af31236fd3b3d159ec0afe266d3252ac4eab0ac33a8d10ce3642e.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1072	1668	eb2f00a6f30af31236fd3b3d159ec0afe266d3252ac4eab0ac33a8d10ce3642e.exe	24
PID 1668 wrote to memory of 1072	1668	eb2f00a6f30af31236fd3b3d159ec0afe266d3252ac4eab0ac33a8d10ce3642e.exe	24
PID 1668 wrote to memory of 1072	1668	eb2f00a6f30af31236fd3b3d159ec0afe266d3252ac4eab0ac33a8d10ce3642e.exe	24
PID 1668 wrote to memory of 1072	1668	eb2f00a6f30af31236fd3b3d159ec0afe266d3252ac4eab0ac33a8d10ce3642e.exe	24
PID 1668 wrote to memory of 1072	1668	eb2f00a6f30af31236fd3b3d159ec0afe266d3252ac4eab0ac33a8d10ce3642e.exe	24
PID 1668 wrote to memory of 1072	1668	eb2f00a6f30af31236fd3b3d159ec0afe266d3252ac4eab0ac33a8d10ce3642e.exe	24
PID 1668 wrote to memory of 1072	1668	eb2f00a6f30af31236fd3b3d159ec0afe266d3252ac4eab0ac33a8d10ce3642e.exe	24
PID 1668 wrote to memory of 1072	1668	eb2f00a6f30af31236fd3b3d159ec0afe266d3252ac4eab0ac33a8d10ce3642e.exe	24
PID 1668 wrote to memory of 1072	1668	eb2f00a6f30af31236fd3b3d159ec0afe266d3252ac4eab0ac33a8d10ce3642e.exe	24

C:\Users\Admin\AppData\Local\Temp\eb2f00a6f30af31236fd3b3d159ec0afe266d3252ac4eab0ac33a8d10ce3642e.exe
"C:\Users\Admin\AppData\Local\Temp\eb2f00a6f30af31236fd3b3d159ec0afe266d3252ac4eab0ac33a8d10ce3642e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Users\Admin\AppData\Local\Temp\eb2f00a6f30af31236fd3b3d159ec0afe266d3252ac4eab0ac33a8d10ce3642e.exe
  "C:\Users\Admin\AppData\Local\Temp\eb2f00a6f30af31236fd3b3d159ec0afe266d3252ac4eab0ac33a8d10ce3642e.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:1072

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1072-61-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/1072-60-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/1072-59-0x0000000076DC1000-0x0000000076DC3000-memory.dmp

Filesize
8KB

Download
memory/1072-56-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/1072-62-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/1072-63-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download

Analysis

Sharing