xtremerat | 29d7348ec6bbdee69d8be5e33524248b89d487ee9671ff26ced1e8a7ed273476

Analysis

max time kernel
66s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 21:27

Target

29d7348ec6bbdee69d8be5e33524248b89d487ee9671ff26ced1e8a7ed273476.exe
Size

425KB
MD5

3223bb78d08e6c075e74b6fa1b831836
SHA1

10f8ceb2b5accfe76072a44056397fb8a0c302ed
SHA256

29d7348ec6bbdee69d8be5e33524248b89d487ee9671ff26ced1e8a7ed273476
SHA512

40cb49caf92d409f19c3e23491e73ca5264e001c0a6f119189403d0790aabf5022edcd0788e2b4e24d862dc1d4d718c0313a5a2507dbc229ca4b6a655bdeec36
SSDEEP

12288:5BUIZIMw7qs9yxHpl61t+Wh7BzmRxJ9wb:blwID8b+WjGxU

Score

10^/10

Detect XtremeRAT payload 8 IoCs

resource	yara_rule
behavioral1/memory/772-58-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral1/memory/772-60-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral1/memory/772-63-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral1/memory/772-66-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral1/memory/772-68-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral1/memory/772-71-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral1/memory/772-73-0x000000001000D288-mapping.dmp	family_xtremerat
behavioral1/memory/516-74-0x0000000001F90000-0x00000000020B7000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 516 set thread context of 772	516	29d7348ec6bbdee69d8be5e33524248b89d487ee9671ff26ced1e8a7ed273476.exe	28

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 516 wrote to memory of 772	516	29d7348ec6bbdee69d8be5e33524248b89d487ee9671ff26ced1e8a7ed273476.exe	28
PID 516 wrote to memory of 772	516	29d7348ec6bbdee69d8be5e33524248b89d487ee9671ff26ced1e8a7ed273476.exe	28
PID 516 wrote to memory of 772	516	29d7348ec6bbdee69d8be5e33524248b89d487ee9671ff26ced1e8a7ed273476.exe	28
PID 516 wrote to memory of 772	516	29d7348ec6bbdee69d8be5e33524248b89d487ee9671ff26ced1e8a7ed273476.exe	28
PID 516 wrote to memory of 772	516	29d7348ec6bbdee69d8be5e33524248b89d487ee9671ff26ced1e8a7ed273476.exe	28
PID 516 wrote to memory of 772	516	29d7348ec6bbdee69d8be5e33524248b89d487ee9671ff26ced1e8a7ed273476.exe	28
PID 516 wrote to memory of 772	516	29d7348ec6bbdee69d8be5e33524248b89d487ee9671ff26ced1e8a7ed273476.exe	28
PID 516 wrote to memory of 772	516	29d7348ec6bbdee69d8be5e33524248b89d487ee9671ff26ced1e8a7ed273476.exe	28
PID 516 wrote to memory of 772	516	29d7348ec6bbdee69d8be5e33524248b89d487ee9671ff26ced1e8a7ed273476.exe	28
PID 516 wrote to memory of 772	516	29d7348ec6bbdee69d8be5e33524248b89d487ee9671ff26ced1e8a7ed273476.exe	28
PID 516 wrote to memory of 772	516	29d7348ec6bbdee69d8be5e33524248b89d487ee9671ff26ced1e8a7ed273476.exe	28
PID 516 wrote to memory of 772	516	29d7348ec6bbdee69d8be5e33524248b89d487ee9671ff26ced1e8a7ed273476.exe	28

C:\Users\Admin\AppData\Local\Temp\29d7348ec6bbdee69d8be5e33524248b89d487ee9671ff26ced1e8a7ed273476.exe
"C:\Users\Admin\AppData\Local\Temp\29d7348ec6bbdee69d8be5e33524248b89d487ee9671ff26ced1e8a7ed273476.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:516
- C:\Users\Admin\AppData\Local\Temp\29d7348ec6bbdee69d8be5e33524248b89d487ee9671ff26ced1e8a7ed273476.exe
  C:\Users\Admin\AppData\Local\Temp\29d7348ec6bbdee69d8be5e33524248b89d487ee9671ff26ced1e8a7ed273476.exe
  2⤵
  PID:772

memory/516-54-0x0000000000400000-0x0000000000527000-memory.dmp

Filesize
1.2MB

Download
memory/516-76-0x0000000001F90000-0x00000000020B7000-memory.dmp

Filesize
1.2MB

Download
memory/516-75-0x0000000000400000-0x0000000000527000-memory.dmp

Filesize
1.2MB

Download
memory/516-74-0x0000000001F90000-0x00000000020B7000-memory.dmp

Filesize
1.2MB

Download
memory/772-66-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/772-63-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/772-60-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/772-68-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/772-71-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/772-58-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/772-56-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/772-55-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download