xtremerat | 95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d

General

Target

95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe
Size

50KB
MD5

2e43371f1d086aac9f65c5c6005f342a
SHA1

ec61fd33aed4e4ebdb158080f2812a623acda81d
SHA256

95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d
SHA512

e90ef3dd6c28bfb4604ae3624aa369bff937f1c81154f327809ab7edd326b49d47818d9ee998124a0097b562e912a0d5a660355ae79025c4cad0b14bda821a42
SSDEEP

768:Zg1rwwyTR9Ywp8PXk/XIZNXSCOWMEPbz5iO9i7xRqEX1q:+cXl9hSs/IZNCCOEYO9M1s

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Signatures

Detect XtremeRAT payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/760-65-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/760-66-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/1152-69-0x0000000000000000-mapping.dmp	family_xtremerat
behavioral1/memory/760-71-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/1152-72-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/760-57-0x0000000010000000-0x000000001004A000-memory.dmp	upx
behavioral1/memory/760-59-0x0000000010000000-0x000000001004A000-memory.dmp	upx
behavioral1/memory/760-60-0x0000000010000000-0x000000001004A000-memory.dmp	upx
behavioral1/memory/760-64-0x0000000010000000-0x000000001004A000-memory.dmp	upx
behavioral1/memory/760-65-0x0000000010000000-0x000000001004A000-memory.dmp	upx
behavioral1/memory/760-66-0x0000000010000000-0x000000001004A000-memory.dmp	upx
behavioral1/memory/760-71-0x0000000010000000-0x000000001004A000-memory.dmp	upx
behavioral1/memory/1152-72-0x0000000010000000-0x000000001004A000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe

description	pid	process	target process
PID 1252 set thread context of 760	1252	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe

pid process

1252 95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe

pid	process
1252	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe

description	pid	process	target process
PID 1252 wrote to memory of 760	1252	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe
PID 1252 wrote to memory of 760	1252	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe
PID 1252 wrote to memory of 760	1252	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe
PID 1252 wrote to memory of 760	1252	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe
PID 1252 wrote to memory of 760	1252	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe
PID 1252 wrote to memory of 760	1252	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe
PID 1252 wrote to memory of 760	1252	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe
PID 1252 wrote to memory of 760	1252	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe
PID 760 wrote to memory of 1152	760	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	svchost.exe
PID 760 wrote to memory of 1152	760	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	svchost.exe
PID 760 wrote to memory of 1152	760	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	svchost.exe
PID 760 wrote to memory of 1152	760	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	svchost.exe
PID 760 wrote to memory of 1152	760	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	svchost.exe
PID 760 wrote to memory of 1988	760	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	iexplore.exe
PID 760 wrote to memory of 1988	760	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	iexplore.exe
PID 760 wrote to memory of 1988	760	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	iexplore.exe
PID 760 wrote to memory of 1988	760	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	iexplore.exe
PID 760 wrote to memory of 1988	760	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe
"C:\Users\Admin\AppData\Local\Temp\95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252

C:\Users\Admin\AppData\Local\Temp\95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe
"C:\Users\Admin\AppData\Local\Temp\95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:760

C:\Windows\SysWOW64\svchost.exe
svchost.exe
3⤵
PID:1152

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:1988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/760-56-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/760-57-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/760-59-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/760-60-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/760-61-0x0000000010048CA0-mapping.dmp

Download
memory/760-63-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/760-64-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/760-65-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/760-66-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/760-71-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1152-69-0x0000000000000000-mapping.dmp

Download
memory/1152-72-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads