xtremerat | 82b9334b18aa6f3b1b010a41d1fe2623bcfc6a22ab6d564314a1a09e1a5f93b5

Analysis

max time kernel
147s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 05:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

82b9334b18aa6f3b1b010a41d1fe2623bcfc6a22ab6d564314a1a09e1a5f93b5.exe
Size

269KB
MD5

2c93b142213c24ca2afba3b7db3b7b10
SHA1

4317825532c791cf71b28564e2a660ec38b6692a
SHA256

82b9334b18aa6f3b1b010a41d1fe2623bcfc6a22ab6d564314a1a09e1a5f93b5
SHA512

d7b6604c020aae0cd0c6b34475d4c93440ea8085a4f96dc0d4406592057db7acea92a27fbe1823d9cebc42fa85f8f8b9e7e32854205a46abff6b7c0ca76ec9ad
SSDEEP

6144:uq/MR82MWOhjeFNd8fq4nw5EeCdiUR5ltR82MWOhjeFNd8fq4nw5EeCdiUR5lM:LUR82MWOhjeFNd8fq4w5EeCdiUR5ltRl

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Extracted

Family

xtremerat

xjy3322.3322.org

Signatures

Detect XtremeRAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/220-132-0x0000000000000000-mapping.dmp	family_xtremerat
behavioral2/memory/220-133-0x0000000010000000-0x000000001007B000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2584	220	WerFault.exe	84
1628	220	WerFault.exe	84

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 220	2416	82b9334b18aa6f3b1b010a41d1fe2623bcfc6a22ab6d564314a1a09e1a5f93b5.exe	84
PID 2416 wrote to memory of 220	2416	82b9334b18aa6f3b1b010a41d1fe2623bcfc6a22ab6d564314a1a09e1a5f93b5.exe	84
PID 2416 wrote to memory of 220	2416	82b9334b18aa6f3b1b010a41d1fe2623bcfc6a22ab6d564314a1a09e1a5f93b5.exe	84
PID 2416 wrote to memory of 220	2416	82b9334b18aa6f3b1b010a41d1fe2623bcfc6a22ab6d564314a1a09e1a5f93b5.exe	84
PID 2416 wrote to memory of 4632	2416	82b9334b18aa6f3b1b010a41d1fe2623bcfc6a22ab6d564314a1a09e1a5f93b5.exe	85
PID 2416 wrote to memory of 4632	2416	82b9334b18aa6f3b1b010a41d1fe2623bcfc6a22ab6d564314a1a09e1a5f93b5.exe	85
PID 2416 wrote to memory of 4632	2416	82b9334b18aa6f3b1b010a41d1fe2623bcfc6a22ab6d564314a1a09e1a5f93b5.exe	85

C:\Users\Admin\AppData\Local\Temp\82b9334b18aa6f3b1b010a41d1fe2623bcfc6a22ab6d564314a1a09e1a5f93b5.exe
"C:\Users\Admin\AppData\Local\Temp\82b9334b18aa6f3b1b010a41d1fe2623bcfc6a22ab6d564314a1a09e1a5f93b5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 472
    3⤵
    - Program crash
    PID:2584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 488
    3⤵
    - Program crash
    PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 220 -ip 220
1⤵
PID:3544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 220 -ip 220
1⤵
PID:1028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/220-133-0x0000000010000000-0x000000001007B000-memory.dmp

Filesize
492KB

Download