xtremerat | 0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998

Analysis

max time kernel
151s
max time network
191s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 15:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe
Size

196KB
MD5

278e881d21f23dd62a5b2a56a27a57b0
SHA1

fc2736ed6c410f77779a9c0971a354705e9d740f
SHA256

0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998
SHA512

73c238699a617c05ce694da2ef552a8a41d3a1d54e86540826a189e45cdd58b19b4ad80505ede0868c869d94ea0472ab42ff8650819f9d8ff4cddd4bb68d6c34
SSDEEP

3072:A/Ak/2Nhq2awPzXToomKWIEzapmnM3A9Yyaj+tr7iicNu39JifE+oGn9Ry3KFZ:A/JKxpPlITzawmAqzj2Sk3CM+RHHFZ

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Extracted

Family

xtremerat

mastercore.dyndns.biz

Signatures

Detect XtremeRAT payload 3 IoCs

resource	yara_rule
behavioral1/memory/1272-54-0x0000000000C80000-0x0000000000CAB000-memory.dmp	family_xtremerat
behavioral1/memory/1272-56-0x0000000000C80000-0x0000000000CAB000-memory.dmp	family_xtremerat
behavioral1/memory/1272-61-0x0000000000C80000-0x0000000000CAB000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{K1163WK6-55E7-W068-6L4B-30TQ1K3O8VI6}	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{K1163WK6-55E7-W068-6L4B-30TQ1K3O8VI6}\StubPath = "C:\\Windows\\InstallDir\\PRV.exe restart"	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLMPRV = "C:\\Windows\\InstallDir\\PRV.exe"	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCUPRV = "C:\\Windows\\InstallDir\\PRV.exe"	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InstallDir\PRV.exe	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe
File created	C:\Windows\InstallDir\PRV.exe	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 936	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	28
PID 1272 wrote to memory of 936	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	28
PID 1272 wrote to memory of 936	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	28
PID 1272 wrote to memory of 936	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	28
PID 1272 wrote to memory of 484	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	29
PID 1272 wrote to memory of 484	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	29
PID 1272 wrote to memory of 484	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	29
PID 1272 wrote to memory of 484	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	29
PID 1272 wrote to memory of 1124	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	30
PID 1272 wrote to memory of 1124	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	30
PID 1272 wrote to memory of 1124	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	30
PID 1272 wrote to memory of 1124	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	30
PID 1272 wrote to memory of 580	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	31
PID 1272 wrote to memory of 580	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	31
PID 1272 wrote to memory of 580	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	31
PID 1272 wrote to memory of 580	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	31
PID 1272 wrote to memory of 1064	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	32
PID 1272 wrote to memory of 1064	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	32
PID 1272 wrote to memory of 1064	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	32
PID 1272 wrote to memory of 1064	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	32
PID 1272 wrote to memory of 1516	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	34
PID 1272 wrote to memory of 1516	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	34
PID 1272 wrote to memory of 1516	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	34
PID 1272 wrote to memory of 1516	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	34
PID 1272 wrote to memory of 732	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	33
PID 1272 wrote to memory of 732	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	33
PID 1272 wrote to memory of 732	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	33
PID 1272 wrote to memory of 732	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	33
PID 1272 wrote to memory of 1928	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	35
PID 1272 wrote to memory of 1928	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	35
PID 1272 wrote to memory of 1928	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	35
PID 1272 wrote to memory of 1928	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	35
PID 1272 wrote to memory of 1180	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	36
PID 1272 wrote to memory of 1180	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	36
PID 1272 wrote to memory of 1180	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	36
PID 1272 wrote to memory of 1180	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	36
PID 1272 wrote to memory of 896	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	37
PID 1272 wrote to memory of 896	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	37
PID 1272 wrote to memory of 896	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	37
PID 1272 wrote to memory of 896	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	37
PID 1272 wrote to memory of 892	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	38
PID 1272 wrote to memory of 892	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	38
PID 1272 wrote to memory of 892	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	38
PID 1272 wrote to memory of 892	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	38
PID 1272 wrote to memory of 1828	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	39
PID 1272 wrote to memory of 1828	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	39
PID 1272 wrote to memory of 1828	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	39
PID 1272 wrote to memory of 1828	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	39
PID 1272 wrote to memory of 1772	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	40
PID 1272 wrote to memory of 1772	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	40
PID 1272 wrote to memory of 1772	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	40
PID 1272 wrote to memory of 1772	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	40
PID 1272 wrote to memory of 844	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	41
PID 1272 wrote to memory of 844	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	41
PID 1272 wrote to memory of 844	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	41
PID 1272 wrote to memory of 844	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	41
PID 1272 wrote to memory of 1308	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	42
PID 1272 wrote to memory of 1308	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	42
PID 1272 wrote to memory of 1308	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	42
PID 1272 wrote to memory of 1308	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	42
PID 1272 wrote to memory of 1508	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	43
PID 1272 wrote to memory of 1508	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	43
PID 1272 wrote to memory of 1508	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	43
PID 1272 wrote to memory of 1508	1272	0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe	43

C:\Users\Admin\AppData\Local\Temp\0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe
"C:\Users\Admin\AppData\Local\Temp\0f32592722795ef45eca9706fea16685735fedfd2318ad450ccb78c469fe4998.exe"
1⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:936
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:484
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:1124
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:580
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:1064
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:732
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:1516
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:1928
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:1180
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:896
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:892
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:1828
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:1772
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:844
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:1308
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:1508
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:1664
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:568
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:752
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:656
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:940
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:532
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:748
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:1784
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:696
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:1008
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:608
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:1996
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:536

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1124-60-0x0000000074A61000-0x0000000074A63000-memory.dmp

Filesize
8KB

Download
memory/1272-55-0x00000000764C1000-0x00000000764C3000-memory.dmp

Filesize
8KB

Download
memory/1272-54-0x0000000000C80000-0x0000000000CAB000-memory.dmp

Filesize
172KB

Download
memory/1272-56-0x0000000000C80000-0x0000000000CAB000-memory.dmp

Filesize
172KB

Download
memory/1272-57-0x00000000002C0000-0x00000000002FA000-memory.dmp

Filesize
232KB

Download
memory/1272-61-0x0000000000C80000-0x0000000000CAB000-memory.dmp

Filesize
172KB

Download
memory/1272-62-0x00000000002C0000-0x00000000002FA000-memory.dmp

Filesize
232KB

Download