xtremerat | fc80f4ae5f25cd9a3275248063f923da04e91600e2c3885db70cbc1cdb243d72

Analysis

max time kernel
170s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 20:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fc80f4ae5f25cd9a3275248063f923da04e91600e2c3885db70cbc1cdb243d72.exe
Size

159KB
MD5

59ee8d36be73745808e7bad09ed379a3
SHA1

d8b81d532b8a10aaf92a5d46b8d4d8679f8fafe9
SHA256

fc80f4ae5f25cd9a3275248063f923da04e91600e2c3885db70cbc1cdb243d72
SHA512

5a172cc49308e3e09e6bd5ecd5958414aa838375dedc65a0bef25b06a76b699528fedf70b48759fd039ef405a77ac44552daf559e26e871b4637730dad3c6ca4
SSDEEP

3072:rx/DtO11yxCnhYvh9Yn1WyGbaZtqbLiQCK2sjzvxTqF54zHzInx:PG1eQn11GbaqL/Fzv9Q6rsnx

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Extracted

Family

xtremerat

bykoray.no-ip.org

31.no-ip.org

Signatures

Detect XtremeRAT payload 5 IoCs

resource	yara_rule
behavioral2/memory/1996-135-0x0000000000000000-mapping.dmp	family_xtremerat
behavioral2/memory/1996-136-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/1996-137-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/1996-138-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/1996-140-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4296 set thread context of 1996	4296	fc80f4ae5f25cd9a3275248063f923da04e91600e2c3885db70cbc1cdb243d72.exe	80

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4296	fc80f4ae5f25cd9a3275248063f923da04e91600e2c3885db70cbc1cdb243d72.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 1996	4296	fc80f4ae5f25cd9a3275248063f923da04e91600e2c3885db70cbc1cdb243d72.exe	80
PID 4296 wrote to memory of 1996	4296	fc80f4ae5f25cd9a3275248063f923da04e91600e2c3885db70cbc1cdb243d72.exe	80
PID 4296 wrote to memory of 1996	4296	fc80f4ae5f25cd9a3275248063f923da04e91600e2c3885db70cbc1cdb243d72.exe	80
PID 4296 wrote to memory of 1996	4296	fc80f4ae5f25cd9a3275248063f923da04e91600e2c3885db70cbc1cdb243d72.exe	80
PID 4296 wrote to memory of 1996	4296	fc80f4ae5f25cd9a3275248063f923da04e91600e2c3885db70cbc1cdb243d72.exe	80
PID 4296 wrote to memory of 1996	4296	fc80f4ae5f25cd9a3275248063f923da04e91600e2c3885db70cbc1cdb243d72.exe	80
PID 4296 wrote to memory of 1996	4296	fc80f4ae5f25cd9a3275248063f923da04e91600e2c3885db70cbc1cdb243d72.exe	80
PID 4296 wrote to memory of 1996	4296	fc80f4ae5f25cd9a3275248063f923da04e91600e2c3885db70cbc1cdb243d72.exe	80
PID 4296 wrote to memory of 1996	4296	fc80f4ae5f25cd9a3275248063f923da04e91600e2c3885db70cbc1cdb243d72.exe	80
PID 4296 wrote to memory of 1996	4296	fc80f4ae5f25cd9a3275248063f923da04e91600e2c3885db70cbc1cdb243d72.exe	80
PID 4296 wrote to memory of 1996	4296	fc80f4ae5f25cd9a3275248063f923da04e91600e2c3885db70cbc1cdb243d72.exe	80
PID 4296 wrote to memory of 1996	4296	fc80f4ae5f25cd9a3275248063f923da04e91600e2c3885db70cbc1cdb243d72.exe	80
PID 4296 wrote to memory of 1996	4296	fc80f4ae5f25cd9a3275248063f923da04e91600e2c3885db70cbc1cdb243d72.exe	80
PID 1996 wrote to memory of 1672	1996	fc80f4ae5f25cd9a3275248063f923da04e91600e2c3885db70cbc1cdb243d72.exe	81
PID 1996 wrote to memory of 1672	1996	fc80f4ae5f25cd9a3275248063f923da04e91600e2c3885db70cbc1cdb243d72.exe	81
PID 1996 wrote to memory of 1672	1996	fc80f4ae5f25cd9a3275248063f923da04e91600e2c3885db70cbc1cdb243d72.exe	81

C:\Users\Admin\AppData\Local\Temp\fc80f4ae5f25cd9a3275248063f923da04e91600e2c3885db70cbc1cdb243d72.exe
"C:\Users\Admin\AppData\Local\Temp\fc80f4ae5f25cd9a3275248063f923da04e91600e2c3885db70cbc1cdb243d72.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Users\Admin\AppData\Local\Temp\fc80f4ae5f25cd9a3275248063f923da04e91600e2c3885db70cbc1cdb243d72.exe
  "C:\Users\Admin\AppData\Local\Temp\fc80f4ae5f25cd9a3275248063f923da04e91600e2c3885db70cbc1cdb243d72.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:1672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1996-136-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1996-137-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1996-138-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1996-140-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1996-141-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4296-134-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4296-139-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download