xtremerat | cc0b05d4a502163309f252dcd5458bfd3c69550665334c9fb539c018bdd8238f

General

Target

cc0b05d4a502163309f252dcd5458bfd3c69550665334c9fb539c018bdd8238f.exe
Size

65KB
MD5

c405b40eef9d2031355ac78f3bea1be6
SHA1

0885a5489c9945f4dd86ae9ddce0df71e9c12a6b
SHA256

cc0b05d4a502163309f252dcd5458bfd3c69550665334c9fb539c018bdd8238f
SHA512

b9f7cbd5ff8abe2fdbec8a4976b98c690bcd062817a3a3ce93d01ba94a3e7c36351bc37f889c8da23a18f4529447976fc2bb5f555988dc2a6e5a0b0471caf724
SSDEEP

768:iMm1Sq4NQErBsH1tzoisBKQI6dObAG/dqMuW29Ifnca/yyR+P2ujf2iZK/A+7Xo6:Asq+QV4rObAdnWpf/yu7YzNwieoo

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Extracted

Family

xtremerat

C2

totti1996.zapto.org

Signatures

Detect XtremeRAT payload 4 IoCs

resource	yara_rule
behavioral2/memory/1420-132-0x0000000000000000-mapping.dmp	family_xtremerat
behavioral2/memory/4032-133-0x0000000000000000-mapping.dmp	family_xtremerat
behavioral2/memory/1420-134-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/4032-135-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	notepad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	notepad.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	notepad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	notepad.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\InstallDir\Server.exe	notepad.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	notepad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
5104	1420	WerFault.exe	84
4600	4032	WerFault.exe	85
3476	1420	WerFault.exe	84
3480	4032	WerFault.exe	85

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4032	notepad.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 1420	4312	cc0b05d4a502163309f252dcd5458bfd3c69550665334c9fb539c018bdd8238f.exe	84
PID 4312 wrote to memory of 1420	4312	cc0b05d4a502163309f252dcd5458bfd3c69550665334c9fb539c018bdd8238f.exe	84
PID 4312 wrote to memory of 1420	4312	cc0b05d4a502163309f252dcd5458bfd3c69550665334c9fb539c018bdd8238f.exe	84
PID 4312 wrote to memory of 1420	4312	cc0b05d4a502163309f252dcd5458bfd3c69550665334c9fb539c018bdd8238f.exe	84
PID 4312 wrote to memory of 4032	4312	cc0b05d4a502163309f252dcd5458bfd3c69550665334c9fb539c018bdd8238f.exe	85
PID 4312 wrote to memory of 4032	4312	cc0b05d4a502163309f252dcd5458bfd3c69550665334c9fb539c018bdd8238f.exe	85
PID 4312 wrote to memory of 4032	4312	cc0b05d4a502163309f252dcd5458bfd3c69550665334c9fb539c018bdd8238f.exe	85
PID 4312 wrote to memory of 4032	4312	cc0b05d4a502163309f252dcd5458bfd3c69550665334c9fb539c018bdd8238f.exe	85

C:\Users\Admin\AppData\Local\Temp\cc0b05d4a502163309f252dcd5458bfd3c69550665334c9fb539c018bdd8238f.exe
"C:\Users\Admin\AppData\Local\Temp\cc0b05d4a502163309f252dcd5458bfd3c69550665334c9fb539c018bdd8238f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:1420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 480
    3⤵
    - Program crash
    PID:5104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 476
    3⤵
    - Program crash
    PID:3476
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  - Modifies Installed Components in the registry
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:4032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 972
    3⤵
    - Program crash
    PID:4600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 996
    3⤵
    - Program crash
    PID:3480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 1420 -ip 1420
1⤵
PID:204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 4032 -ip 4032
1⤵
PID:3896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1420 -ip 1420
1⤵
PID:364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4032 -ip 4032
1⤵
PID:3976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1420-134-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/4032-135-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads