xtremerat | 865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816

Analysis

max time kernel
276s
max time network
389s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 22:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe
Size

118KB
MD5

5177f64dcb7ee531eb5a96039656feda
SHA1

8affb58b0b0a489839c253b50c8bf0b371de971d
SHA256

865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816
SHA512

52b06d5df1655f179c96f2f9bf8be71e941bd811dd89ad54ec2b780b9b6fc5bd5c768de4961e3904fd62bce0c576c136eb5b294575c350f15b10f26a996022ca
SSDEEP

3072:YkYprM/xfKhNDbqWfHjghSWAif82nLW6jN:0YKhNDbTghSWAifHd

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Extracted

Family

xtremerat

torrentt.no-ip.info

Signatures

Detect XtremeRAT payload 5 IoCs

resource	yara_rule
behavioral2/memory/5008-134-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/5008-135-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/5008-136-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/1860-138-0x0000000000000000-mapping.dmp	family_xtremerat
behavioral2/memory/1860-140-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Q11T5B6O-87WO-0X08-15QD-F885551E78K5}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Q11T5B6O-87WO-0X08-15QD-F885551E78K5}	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Q11T5B6O-87WO-0X08-15QD-F885551E78K5}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Q11T5B6O-87WO-0X08-15QD-F885551E78K5}	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2008 set thread context of 5008	2008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	81

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InstallDir\Server.exe	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe
File created	C:\Windows\InstallDir\Server.exe	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe
File opened for modification	C:\Windows\InstallDir\	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 4764	2008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	80
PID 2008 wrote to memory of 4764	2008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	80
PID 2008 wrote to memory of 4764	2008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	80
PID 2008 wrote to memory of 5008	2008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	81
PID 2008 wrote to memory of 5008	2008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	81
PID 2008 wrote to memory of 5008	2008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	81
PID 2008 wrote to memory of 5008	2008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	81
PID 2008 wrote to memory of 5008	2008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	81
PID 2008 wrote to memory of 5008	2008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	81
PID 2008 wrote to memory of 5008	2008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	81
PID 2008 wrote to memory of 5008	2008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	81
PID 2008 wrote to memory of 5008	2008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	81
PID 2008 wrote to memory of 5008	2008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	81
PID 2008 wrote to memory of 5008	2008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	81
PID 2008 wrote to memory of 5008	2008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	81
PID 2008 wrote to memory of 5008	2008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	81
PID 5008 wrote to memory of 1860	5008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	82
PID 5008 wrote to memory of 1860	5008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	82
PID 5008 wrote to memory of 1860	5008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	82
PID 5008 wrote to memory of 1860	5008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	82
PID 5008 wrote to memory of 3864	5008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	83
PID 5008 wrote to memory of 3864	5008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	83
PID 5008 wrote to memory of 3864	5008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	83
PID 5008 wrote to memory of 1444	5008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	84
PID 5008 wrote to memory of 1444	5008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	84
PID 5008 wrote to memory of 1444	5008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	84
PID 5008 wrote to memory of 4756	5008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	85
PID 5008 wrote to memory of 4756	5008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	85
PID 5008 wrote to memory of 4756	5008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	85
PID 5008 wrote to memory of 1312	5008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	86
PID 5008 wrote to memory of 1312	5008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	86
PID 5008 wrote to memory of 1312	5008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	86
PID 5008 wrote to memory of 4528	5008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	87
PID 5008 wrote to memory of 4528	5008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	87
PID 5008 wrote to memory of 4528	5008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	87
PID 5008 wrote to memory of 5048	5008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	88
PID 5008 wrote to memory of 5048	5008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	88
PID 5008 wrote to memory of 5048	5008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	88
PID 5008 wrote to memory of 4716	5008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	89
PID 5008 wrote to memory of 4716	5008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	89
PID 5008 wrote to memory of 4716	5008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	89
PID 5008 wrote to memory of 4844	5008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	90
PID 5008 wrote to memory of 4844	5008	865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe	90

C:\Users\Admin\AppData\Local\Temp\865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe
"C:\Users\Admin\AppData\Local\Temp\865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Users\Admin\AppData\Local\Temp\865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe
  865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe
  2⤵
  PID:4764
- C:\Users\Admin\AppData\Local\Temp\865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe
  865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816.exe
  2⤵
  - Modifies Installed Components in the registry
  - Checks computer location settings
  - Adds Run key to start application
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - Modifies Installed Components in the registry
    - Adds Run key to start application
    - Modifies registry class
    PID:1860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:1444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:1312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\InstallDir\Server.exe

Filesize
118KB

MD5
5177f64dcb7ee531eb5a96039656feda

SHA1
8affb58b0b0a489839c253b50c8bf0b371de971d

SHA256
865ee3d67afe1fd11fbb5906094d7fb9ed1712f53678d49edc092657bd46d816

SHA512
52b06d5df1655f179c96f2f9bf8be71e941bd811dd89ad54ec2b780b9b6fc5bd5c768de4961e3904fd62bce0c576c136eb5b294575c350f15b10f26a996022ca

Download Submit
memory/1860-140-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2008-132-0x0000000074D40000-0x00000000752F1000-memory.dmp

Filesize
5.7MB

Download
memory/2008-137-0x0000000074D40000-0x00000000752F1000-memory.dmp

Filesize
5.7MB

Download
memory/5008-134-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/5008-135-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/5008-136-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads