xtremerat | 4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537

Analysis

max time kernel
142s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe
Size

744KB
MD5

93f29597ba1f7e7b1fca672faef44ec5
SHA1

e063ed6c59ad3fa6c5392262172d06d06efac174
SHA256

4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537
SHA512

5a12fdc1dca6a958b7ec27a1c04c4f9f62048b51085d8381adfc5c8258f15df82fd7de7c8fb90e0b9da5c48e3efad49273bc2af52e7d7696a74e110bf01e6cd2
SSDEEP

6144:UETQQtrh7yAZCKBkoO+U7wnKxC79yjT0yWUi0:QQtrlyUFny3i0

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Extracted

Family

xtremerat

zainee.no-ip.biz

Signatures

Detect XtremeRAT payload 7 IoCs

resource	yara_rule
behavioral2/memory/4844-135-0x0000000000000000-mapping.dmp	family_xtremerat
behavioral2/memory/4844-136-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/4844-138-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/4844-142-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/2288-143-0x0000000000000000-mapping.dmp	family_xtremerat
behavioral2/memory/4844-144-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/2288-145-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5088 set thread context of 4844	5088	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe	81
PID 5088 set thread context of 0	5088	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1564	2288	WerFault.exe	84
2616	2288	WerFault.exe	84

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5088	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 4844	5088	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe	81
PID 5088 wrote to memory of 4844	5088	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe	81
PID 5088 wrote to memory of 4844	5088	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe	81
PID 5088 wrote to memory of 4844	5088	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe	81
PID 5088 wrote to memory of 4844	5088	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe	81
PID 5088 wrote to memory of 4844	5088	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe	81
PID 5088 wrote to memory of 4844	5088	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe	81
PID 5088 wrote to memory of 4844	5088	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe	81
PID 5088 wrote to memory of 4844	5088	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe	81
PID 5088 wrote to memory of 4844	5088	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe	81
PID 5088 wrote to memory of 4844	5088	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe	81
PID 5088 wrote to memory of 4844	5088	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe	81
PID 5088 wrote to memory of 4844	5088	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe	81
PID 5088 wrote to memory of 0	5088	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe
PID 5088 wrote to memory of 0	5088	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe
PID 5088 wrote to memory of 0	5088	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe
PID 5088 wrote to memory of 0	5088	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe
PID 5088 wrote to memory of 0	5088	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe
PID 5088 wrote to memory of 0	5088	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe
PID 5088 wrote to memory of 0	5088	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe
PID 5088 wrote to memory of 0	5088	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe
PID 5088 wrote to memory of 0	5088	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe
PID 5088 wrote to memory of 0	5088	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe
PID 4844 wrote to memory of 2288	4844	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe	84
PID 4844 wrote to memory of 2288	4844	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe	84
PID 4844 wrote to memory of 2288	4844	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe	84
PID 4844 wrote to memory of 2288	4844	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe	84
PID 4844 wrote to memory of 4612	4844	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe	85
PID 4844 wrote to memory of 4612	4844	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe	85
PID 4844 wrote to memory of 4612	4844	4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe	85

C:\Users\Admin\AppData\Local\Temp\4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe
"C:\Users\Admin\AppData\Local\Temp\4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Users\Admin\AppData\Local\Temp\4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe
  "C:\Users\Admin\AppData\Local\Temp\4ec7e83ec08cfd4a4c42ade6935d5becdd6595ca289c7a0821adad0aeed5e537.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2288
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 480
      4⤵
      Program crash
      PID:1564
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 348
      4⤵
      Program crash
      PID:2616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2288 -ip 2288
1⤵
PID:1336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2288 -ip 2288
1⤵
PID:1504

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2288-145-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/4844-136-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/4844-138-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/4844-139-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/4844-142-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/4844-144-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/5088-132-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/5088-137-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/5088-141-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download