xtremerat | 838a345bc007a981b97e9579b8ee78d7dfc5f717619fab47229efc5ffc5e7958

General

Target

838a345bc007a981b97e9579b8ee78d7dfc5f717619fab47229efc5ffc5e7958.exe
Size

65KB
MD5

e56933481e08daa34c129c24f9a4fc81
SHA1

9f4c8f786bab70abd4463edfb66a4a4762e4285d
SHA256

838a345bc007a981b97e9579b8ee78d7dfc5f717619fab47229efc5ffc5e7958
SHA512

35b4bb49c4467525fc75abf5ecf389ecdea22ff72d7819c755ca54292630530fce52b0c6196bc4417620ec3653a3da836ffe67a975e72c17eed777edfd9e3480
SSDEEP

1536:72WyRaJJ62M6hwYvckT7aNxhBs+BTf8o5Vomfu:7qOrPvPT70xhBs+9fvOmfu

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Extracted

Family

xtremerat

C2

xstrema.no-ip.org

Signatures

Detect XtremeRAT payload 6 IoCs

resource	yara_rule
behavioral1/memory/1696-65-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral1/memory/1872-69-0x0000000000000000-mapping.dmp	family_xtremerat
behavioral1/memory/1696-71-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral1/memory/1872-72-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral1/memory/1696-73-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral1/memory/1872-74-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1696-57-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/1696-59-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/1696-60-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/1696-65-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/1696-64-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/1696-71-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/1872-72-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/1696-73-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/1872-74-0x0000000010000000-0x000000001004D000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 936 set thread context of 1696	936	838a345bc007a981b97e9579b8ee78d7dfc5f717619fab47229efc5ffc5e7958.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
744	936	WerFault.exe	20

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
936	838a345bc007a981b97e9579b8ee78d7dfc5f717619fab47229efc5ffc5e7958.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 1696	936	838a345bc007a981b97e9579b8ee78d7dfc5f717619fab47229efc5ffc5e7958.exe	28
PID 936 wrote to memory of 1696	936	838a345bc007a981b97e9579b8ee78d7dfc5f717619fab47229efc5ffc5e7958.exe	28
PID 936 wrote to memory of 1696	936	838a345bc007a981b97e9579b8ee78d7dfc5f717619fab47229efc5ffc5e7958.exe	28
PID 936 wrote to memory of 1696	936	838a345bc007a981b97e9579b8ee78d7dfc5f717619fab47229efc5ffc5e7958.exe	28
PID 936 wrote to memory of 1696	936	838a345bc007a981b97e9579b8ee78d7dfc5f717619fab47229efc5ffc5e7958.exe	28
PID 936 wrote to memory of 1696	936	838a345bc007a981b97e9579b8ee78d7dfc5f717619fab47229efc5ffc5e7958.exe	28
PID 936 wrote to memory of 1696	936	838a345bc007a981b97e9579b8ee78d7dfc5f717619fab47229efc5ffc5e7958.exe	28
PID 936 wrote to memory of 1696	936	838a345bc007a981b97e9579b8ee78d7dfc5f717619fab47229efc5ffc5e7958.exe	28
PID 1696 wrote to memory of 1872	1696	838a345bc007a981b97e9579b8ee78d7dfc5f717619fab47229efc5ffc5e7958.exe	30
PID 1696 wrote to memory of 1872	1696	838a345bc007a981b97e9579b8ee78d7dfc5f717619fab47229efc5ffc5e7958.exe	30
PID 1696 wrote to memory of 1872	1696	838a345bc007a981b97e9579b8ee78d7dfc5f717619fab47229efc5ffc5e7958.exe	30
PID 1696 wrote to memory of 1872	1696	838a345bc007a981b97e9579b8ee78d7dfc5f717619fab47229efc5ffc5e7958.exe	30
PID 936 wrote to memory of 744	936	838a345bc007a981b97e9579b8ee78d7dfc5f717619fab47229efc5ffc5e7958.exe	29
PID 936 wrote to memory of 744	936	838a345bc007a981b97e9579b8ee78d7dfc5f717619fab47229efc5ffc5e7958.exe	29
PID 936 wrote to memory of 744	936	838a345bc007a981b97e9579b8ee78d7dfc5f717619fab47229efc5ffc5e7958.exe	29
PID 936 wrote to memory of 744	936	838a345bc007a981b97e9579b8ee78d7dfc5f717619fab47229efc5ffc5e7958.exe	29
PID 1696 wrote to memory of 1872	1696	838a345bc007a981b97e9579b8ee78d7dfc5f717619fab47229efc5ffc5e7958.exe	30
PID 1696 wrote to memory of 556	1696	838a345bc007a981b97e9579b8ee78d7dfc5f717619fab47229efc5ffc5e7958.exe	31
PID 1696 wrote to memory of 556	1696	838a345bc007a981b97e9579b8ee78d7dfc5f717619fab47229efc5ffc5e7958.exe	31
PID 1696 wrote to memory of 556	1696	838a345bc007a981b97e9579b8ee78d7dfc5f717619fab47229efc5ffc5e7958.exe	31
PID 1696 wrote to memory of 556	1696	838a345bc007a981b97e9579b8ee78d7dfc5f717619fab47229efc5ffc5e7958.exe	31
PID 1696 wrote to memory of 556	1696	838a345bc007a981b97e9579b8ee78d7dfc5f717619fab47229efc5ffc5e7958.exe	31

C:\Users\Admin\AppData\Local\Temp\838a345bc007a981b97e9579b8ee78d7dfc5f717619fab47229efc5ffc5e7958.exe
"C:\Users\Admin\AppData\Local\Temp\838a345bc007a981b97e9579b8ee78d7dfc5f717619fab47229efc5ffc5e7958.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:936
- C:\Users\Admin\AppData\Local\Temp\838a345bc007a981b97e9579b8ee78d7dfc5f717619fab47229efc5ffc5e7958.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:1872
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 192
  2⤵
  - Program crash
  PID:744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/744-66-0x0000000000000000-mapping.dmp

Download
memory/1696-65-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/1696-59-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/1696-60-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/1696-61-0x000000001004B900-mapping.dmp

Download
memory/1696-63-0x0000000076941000-0x0000000076943000-memory.dmp

Filesize
8KB

Download
memory/1696-56-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/1696-64-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/1696-57-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/1696-71-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/1696-73-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/1872-69-0x0000000000000000-mapping.dmp

Download
memory/1872-72-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/1872-74-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download

Analysis

Sharing