xtremerat | ea42e7e7dd921ffa74ddd9bbbc3427bd2b461133c27f04a67ad54a976f53b77a

General

Target

ea42e7e7dd921ffa74ddd9bbbc3427bd2b461133c27f04a67ad54a976f53b77a.exe
Size

21KB
MD5

9c7b8090200d8e29026fb93b90054cb9
SHA1

c8a2acacd5055989b7b384bcfa634ce6b1f8ba48
SHA256

ea42e7e7dd921ffa74ddd9bbbc3427bd2b461133c27f04a67ad54a976f53b77a
SHA512

c51e76d1c9ee46ff058dd12c18719b58c8f747de50321b2643198d766c2a60b09ac1e407b21b8a150eaa00a161f5baaa2b9b2a838f8d10f4c53792d573a4e8c1
SSDEEP

384:jIdmF+TH95xJMu/0PlxjV8BINhuLJ37tMOpuqqz3KK7eIVmi7gdWbjYIT8eC1nP7:jIsF8HdbKjV8BX7Vy6K7eIVTUdik68eQ

Score

10^/10

Malware Config

Signatures

Detect XtremeRAT payload 5 IoCs

resource	yara_rule
behavioral1/memory/1348-55-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2028-58-0x0000000000000000-mapping.dmp	family_xtremerat
behavioral1/memory/2028-61-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/1348-62-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat
behavioral1/memory/2028-63-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	ea42e7e7dd921ffa74ddd9bbbc3427bd2b461133c27f04a67ad54a976f53b77a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	ea42e7e7dd921ffa74ddd9bbbc3427bd2b461133c27f04a67ad54a976f53b77a.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1348-55-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2028-61-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/1348-62-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral1/memory/2028-63-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	ea42e7e7dd921ffa74ddd9bbbc3427bd2b461133c27f04a67ad54a976f53b77a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	ea42e7e7dd921ffa74ddd9bbbc3427bd2b461133c27f04a67ad54a976f53b77a.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	ea42e7e7dd921ffa74ddd9bbbc3427bd2b461133c27f04a67ad54a976f53b77a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	ea42e7e7dd921ffa74ddd9bbbc3427bd2b461133c27f04a67ad54a976f53b77a.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InstallDir\Server.exe	ea42e7e7dd921ffa74ddd9bbbc3427bd2b461133c27f04a67ad54a976f53b77a.exe
File created	C:\Windows\InstallDir\Server.exe	ea42e7e7dd921ffa74ddd9bbbc3427bd2b461133c27f04a67ad54a976f53b77a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2028	explorer.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 2044	1348	ea42e7e7dd921ffa74ddd9bbbc3427bd2b461133c27f04a67ad54a976f53b77a.exe	27
PID 1348 wrote to memory of 2044	1348	ea42e7e7dd921ffa74ddd9bbbc3427bd2b461133c27f04a67ad54a976f53b77a.exe	27
PID 1348 wrote to memory of 2044	1348	ea42e7e7dd921ffa74ddd9bbbc3427bd2b461133c27f04a67ad54a976f53b77a.exe	27
PID 1348 wrote to memory of 2044	1348	ea42e7e7dd921ffa74ddd9bbbc3427bd2b461133c27f04a67ad54a976f53b77a.exe	27
PID 1348 wrote to memory of 2028	1348	ea42e7e7dd921ffa74ddd9bbbc3427bd2b461133c27f04a67ad54a976f53b77a.exe	28
PID 1348 wrote to memory of 2028	1348	ea42e7e7dd921ffa74ddd9bbbc3427bd2b461133c27f04a67ad54a976f53b77a.exe	28
PID 1348 wrote to memory of 2028	1348	ea42e7e7dd921ffa74ddd9bbbc3427bd2b461133c27f04a67ad54a976f53b77a.exe	28
PID 1348 wrote to memory of 2028	1348	ea42e7e7dd921ffa74ddd9bbbc3427bd2b461133c27f04a67ad54a976f53b77a.exe	28
PID 1348 wrote to memory of 2028	1348	ea42e7e7dd921ffa74ddd9bbbc3427bd2b461133c27f04a67ad54a976f53b77a.exe	28

C:\Users\Admin\AppData\Local\Temp\ea42e7e7dd921ffa74ddd9bbbc3427bd2b461133c27f04a67ad54a976f53b77a.exe
"C:\Users\Admin\AppData\Local\Temp\ea42e7e7dd921ffa74ddd9bbbc3427bd2b461133c27f04a67ad54a976f53b77a.exe"
1⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:2044
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1348-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1348-55-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1348-62-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2028-56-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2028-60-0x00000000746A1000-0x00000000746A3000-memory.dmp

Filesize
8KB

Download
memory/2028-61-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/2028-63-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads