xtremerat | 39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b

General

Target

39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.exe
Size

519KB
MD5

b1415073293fa408b8c1a31bdc34fcc4
SHA1

37642c6145a1f451c88b710b8573bca7afa7ba81
SHA256

39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b
SHA512

b48214ddc7006268a2c2f273602b70e45aca4e909025e44b41b890455e527f94bbf36796fac7e0b1af656cefdfab5d79dff85d31b14f310990bba0c72fddb25b
SSDEEP

12288:RnCOMDRxONM9eVXeHwv70Kd5hLVxKHx6KoUur6iQafK:RnCjDFHVKd5bKofhc

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Extracted

Family

xtremerat

C2

alertsdanish.bounceme.net

čalertsdanish.bounceme.net

Signatures

Detect XtremeRAT payload 16 IoCs

Processes:

resource	yara_rule
behavioral1/memory/968-59-0x0000000010000000-0x0000000010097000-memory.dmp	family_xtremerat
behavioral1/memory/968-60-0x0000000010000000-0x0000000010097000-memory.dmp	family_xtremerat
behavioral1/memory/968-61-0x0000000010000000-0x0000000010097000-memory.dmp	family_xtremerat
behavioral1/memory/968-62-0x0000000010000000-0x0000000010097000-memory.dmp	family_xtremerat
behavioral1/memory/968-63-0x0000000010000000-0x0000000010097000-memory.dmp	family_xtremerat
behavioral1/memory/968-65-0x0000000010000000-0x0000000010097000-memory.dmp	family_xtremerat
behavioral1/memory/968-66-0x000000001000D0F4-mapping.dmp	family_xtremerat
behavioral1/memory/968-67-0x0000000010000000-0x0000000010097000-memory.dmp	family_xtremerat
behavioral1/memory/968-69-0x0000000010000000-0x0000000010097000-memory.dmp	family_xtremerat
behavioral1/memory/968-70-0x0000000010000000-0x0000000010097000-memory.dmp	family_xtremerat
behavioral1/memory/668-73-0x0000000000000000-mapping.dmp	family_xtremerat
behavioral1/memory/684-77-0x0000000000000000-mapping.dmp	family_xtremerat
behavioral1/memory/968-80-0x0000000010000000-0x0000000010097000-memory.dmp	family_xtremerat
behavioral1/memory/684-83-0x0000000010000000-0x0000000010097000-memory.dmp	family_xtremerat
behavioral1/memory/668-84-0x0000000010000000-0x0000000010097000-memory.dmp	family_xtremerat
behavioral1/memory/668-87-0x0000000010000000-0x0000000010097000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{TWDB4HK2-65MQ-224E-01L2-YY6624NJV2XC}\StubPath = "C:\\Windows\\InstallDir\\svchost.exe"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{TWDB4HK2-65MQ-224E-01L2-YY6624NJV2XC}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{TWDB4HK2-65MQ-224E-01L2-YY6624NJV2XC}\StubPath = "C:\\Windows\\InstallDir\\svchost.exe restart"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{TWDB4HK2-65MQ-224E-01L2-YY6624NJV2XC}	svchost.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\svchost.exe"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\svchost.exe"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\svchost.exe"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\svchost.exe"	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.exe

description	pid	process	target process
PID 1324 set thread context of 968	1324	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.exe	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXE

Drops file in Windows directory 5 IoCs

Processes:

39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXEexplorer.exe

description	ioc	process
File created	C:\Windows\210Moto-Azabu Hills Apt 2204 Rosbacher.pdf.exe	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXE
File created	C:\Windows\210Moto-Azabu Hills Apt 2204 Rosbacher.pdf	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXE
File opened for modification	C:\Windows\InstallDir\svchost.exe	explorer.exe
File created	C:\Windows\InstallDir\svchost.exe	explorer.exe
File opened for modification	C:\Windows\InstallDir\	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.exeexplorer.exeAcroRd32.exe

pid process

1324 39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.exe
684 explorer.exe
276 AcroRd32.exe
276 AcroRd32.exe
276 AcroRd32.exe

pid	process
1324	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.exe
684	explorer.exe
276	AcroRd32.exe
276	AcroRd32.exe
276	AcroRd32.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.exe39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXE

description	pid	process	target process
PID 1324 wrote to memory of 968	1324	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.exe	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXE
PID 1324 wrote to memory of 968	1324	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.exe	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXE
PID 1324 wrote to memory of 968	1324	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.exe	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXE
PID 1324 wrote to memory of 968	1324	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.exe	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXE
PID 1324 wrote to memory of 968	1324	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.exe	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXE
PID 1324 wrote to memory of 968	1324	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.exe	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXE
PID 1324 wrote to memory of 968	1324	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.exe	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXE
PID 1324 wrote to memory of 968	1324	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.exe	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXE
PID 1324 wrote to memory of 968	1324	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.exe	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXE
PID 1324 wrote to memory of 968	1324	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.exe	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXE
PID 1324 wrote to memory of 968	1324	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.exe	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXE
PID 1324 wrote to memory of 968	1324	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.exe	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXE
PID 968 wrote to memory of 668	968	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXE	svchost.exe
PID 968 wrote to memory of 668	968	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXE	svchost.exe
PID 968 wrote to memory of 668	968	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXE	svchost.exe
PID 968 wrote to memory of 668	968	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXE	svchost.exe
PID 968 wrote to memory of 668	968	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXE	svchost.exe
PID 968 wrote to memory of 684	968	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXE	explorer.exe
PID 968 wrote to memory of 684	968	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXE	explorer.exe
PID 968 wrote to memory of 684	968	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXE	explorer.exe
PID 968 wrote to memory of 684	968	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXE	explorer.exe
PID 968 wrote to memory of 684	968	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXE	explorer.exe
PID 968 wrote to memory of 276	968	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXE	AcroRd32.exe
PID 968 wrote to memory of 276	968	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXE	AcroRd32.exe
PID 968 wrote to memory of 276	968	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXE	AcroRd32.exe
PID 968 wrote to memory of 276	968	39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXE	AcroRd32.exe

C:\Users\Admin\AppData\Local\Temp\39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.exe
"C:\Users\Admin\AppData\Local\Temp\39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1324

C:\Users\Admin\AppData\Local\Temp\39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXE
"C:\Users\Admin\AppData\Local\Temp\39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b.EXE"
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\SysWOW64\svchost.exe
svchost.exe
3⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:668

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:684

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Windows\210Moto-Azabu Hills Apt 2204 Rosbacher.pdf"
3⤵
- Suspicious use of SetWindowsHookEx
PID:276

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\210Moto-Azabu Hills Apt 2204 Rosbacher.pdf
Filesize
308KB

MD5
23bbd7c3a81207672ed44de64c7a3289

SHA1
a190365064ad07ca95fcbe03c175b1ad575e1aa2

SHA256
d23e94dfa47e49e83e3fbd60817e2cd20701ec1d06a4310845edfdb5f784b34d

SHA512
4e1c7c423c6385376ab1bad1f660a8bb9bb9af0d94befcf65ceee7057dcc4991beb5abc4e4a5339c7c3b65a4ff60627b0381cc75cb1f1e9ae4c85ab93df397e4

Download Submit
C:\Windows\InstallDir\svchost.exe
Filesize
519KB

MD5
b1415073293fa408b8c1a31bdc34fcc4

SHA1
37642c6145a1f451c88b710b8573bca7afa7ba81

SHA256
39ecc03892d92ca63c0393580cee198b7cdd3b6ce2be337aed947802c882753b

SHA512
b48214ddc7006268a2c2f273602b70e45aca4e909025e44b41b890455e527f94bbf36796fac7e0b1af656cefdfab5d79dff85d31b14f310990bba0c72fddb25b

Download Submit
memory/276-79-0x0000000000000000-mapping.dmp

Download
memory/668-73-0x0000000000000000-mapping.dmp

Download
memory/668-87-0x0000000010000000-0x0000000010097000-memory.dmp

Filesize
604KB

Download
memory/668-84-0x0000000010000000-0x0000000010097000-memory.dmp

Filesize
604KB

Download
memory/684-83-0x0000000010000000-0x0000000010097000-memory.dmp

Filesize
604KB

Download
memory/684-82-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download
memory/684-77-0x0000000000000000-mapping.dmp

Download
memory/968-62-0x0000000010000000-0x0000000010097000-memory.dmp

Filesize
604KB

Download
memory/968-63-0x0000000010000000-0x0000000010097000-memory.dmp

Filesize
604KB

Download
memory/968-69-0x0000000010000000-0x0000000010097000-memory.dmp

Filesize
604KB

Download
memory/968-70-0x0000000010000000-0x0000000010097000-memory.dmp

Filesize
604KB

Download
memory/968-67-0x0000000010000000-0x0000000010097000-memory.dmp

Filesize
604KB

Download
memory/968-66-0x000000001000D0F4-mapping.dmp

Download
memory/968-65-0x0000000010000000-0x0000000010097000-memory.dmp

Filesize
604KB

Download
memory/968-68-0x0000000076191000-0x0000000076193000-memory.dmp

Filesize
8KB

Download
memory/968-80-0x0000000010000000-0x0000000010097000-memory.dmp

Filesize
604KB

Download
memory/968-56-0x0000000010000000-0x0000000010097000-memory.dmp

Filesize
604KB

Download
memory/968-61-0x0000000010000000-0x0000000010097000-memory.dmp

Filesize
604KB

Download
memory/968-60-0x0000000010000000-0x0000000010097000-memory.dmp

Filesize
604KB

Download
memory/968-59-0x0000000010000000-0x0000000010097000-memory.dmp

Filesize
604KB

Download
memory/968-57-0x0000000010000000-0x0000000010097000-memory.dmp

Filesize
604KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads