xtremerat | 054ce23e77868d3b70a3884cc350b48c75e9fa63b774df6718ca6ae608b00fdf

General

Target

48233c394fd136a8e8c50f72c479818d.exe
Size

120KB
MD5

48233c394fd136a8e8c50f72c479818d
SHA1

a286371bf593d75e5932e75b0f7ccbd85e81b13b
SHA256

054ce23e77868d3b70a3884cc350b48c75e9fa63b774df6718ca6ae608b00fdf
SHA512

2fa9e8fe42cf7146a10963cb52a1e5d733e233147c5be2a3f0a6109695f1b2eb2b7ed0ebf5e56c96e7f61c5ca41d8ba55329d57d13d949382bdfbfc7aef422c3
SSDEEP

3072:JHLPsKAmOc6GxqG20y8g6vxnqV32cm5dtJWgW73HC+VPpwk87VP+vCGx:JHzsIv4G20yqvxnG32cm5dtJWgW73HCW

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Signatures

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	48233c394fd136a8e8c50f72c479818d.exe

Executes dropped EXE 4 IoCs

pid	Process
2524	crashes.exe
3176	crashes.exe
452	crashes.exe
3620	crashes.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\crashes.exe = "C:\\Users\\Admin\\AppData\\Roaming\\crashes\\crashes.exe"	48233c394fd136a8e8c50f72c479818d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2524 set thread context of 3176	2524	crashes.exe	96

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2200	48233c394fd136a8e8c50f72c479818d.exe
2524	crashes.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2524	2200	48233c394fd136a8e8c50f72c479818d.exe	93
PID 2200 wrote to memory of 2524	2200	48233c394fd136a8e8c50f72c479818d.exe	93
PID 2200 wrote to memory of 2524	2200	48233c394fd136a8e8c50f72c479818d.exe	93
PID 2524 wrote to memory of 3176	2524	crashes.exe	96
PID 2524 wrote to memory of 3176	2524	crashes.exe	96
PID 2524 wrote to memory of 3176	2524	crashes.exe	96
PID 2524 wrote to memory of 3176	2524	crashes.exe	96
PID 2524 wrote to memory of 3176	2524	crashes.exe	96
PID 2524 wrote to memory of 3176	2524	crashes.exe	96
PID 2524 wrote to memory of 3176	2524	crashes.exe	96
PID 2524 wrote to memory of 3176	2524	crashes.exe	96
PID 2524 wrote to memory of 3176	2524	crashes.exe	96
PID 2524 wrote to memory of 3176	2524	crashes.exe	96
PID 2524 wrote to memory of 3176	2524	crashes.exe	96
PID 2524 wrote to memory of 3176	2524	crashes.exe	96
PID 2524 wrote to memory of 3176	2524	crashes.exe	96
PID 2524 wrote to memory of 3176	2524	crashes.exe	96
PID 2524 wrote to memory of 3176	2524	crashes.exe	96
PID 3176 wrote to memory of 452	3176	crashes.exe	100
PID 3176 wrote to memory of 452	3176	crashes.exe	100
PID 3176 wrote to memory of 452	3176	crashes.exe	100
PID 3176 wrote to memory of 3620	3176	crashes.exe	102
PID 3176 wrote to memory of 3620	3176	crashes.exe	102
PID 3176 wrote to memory of 3620	3176	crashes.exe	102

C:\Users\Admin\AppData\Local\Temp\48233c394fd136a8e8c50f72c479818d.exe
"C:\Users\Admin\AppData\Local\Temp\48233c394fd136a8e8c50f72c479818d.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
  "C:\Users\Admin\AppData\Roaming\crashes\crashes.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
    "C:\Users\Admin\AppData\Roaming\crashes\crashes.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3176
  - - C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
      C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
      4⤵
      Executes dropped EXE
      PID:452
  - - C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
      C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
      4⤵
      Executes dropped EXE
      PID:3620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\crashes\crashes.exe

Filesize
32KB

MD5
e8c846efe21bbed25464e676e5c457cb

SHA1
d0fe7c2465e6dd98a66f01e0449cb2ee4b9715a3

SHA256
be7c4e95f44c471a53670db94b35247e511410691ab85e15293d6e03cf0dfce9

SHA512
18d40b46a4cc904ccc0237b55207e2eda6e04e090a1e12db585725ff414cbebd1f82f7e26bf916f6d0340f0b63e8a5e51e67215595ac489395d6963394e54160

Download Submit
C:\Users\Admin\AppData\Roaming\crashes\crashes.exe

Filesize
120KB

MD5
48233c394fd136a8e8c50f72c479818d

SHA1
a286371bf593d75e5932e75b0f7ccbd85e81b13b

SHA256
054ce23e77868d3b70a3884cc350b48c75e9fa63b774df6718ca6ae608b00fdf

SHA512
2fa9e8fe42cf7146a10963cb52a1e5d733e233147c5be2a3f0a6109695f1b2eb2b7ed0ebf5e56c96e7f61c5ca41d8ba55329d57d13d949382bdfbfc7aef422c3

Download Submit
memory/2200-2-0x0000000000620000-0x0000000000626000-memory.dmp

Filesize
24KB

Download
memory/3176-18-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3176-25-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3176-28-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3176-31-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads