Malware Analysis Report

2025-06-16 01:06

Sample ID 240107-f2hcvsfaer
Target 48233c394fd136a8e8c50f72c479818d
SHA256 054ce23e77868d3b70a3884cc350b48c75e9fa63b774df6718ca6ae608b00fdf
Tags
xtremerat persistence rat spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

054ce23e77868d3b70a3884cc350b48c75e9fa63b774df6718ca6ae608b00fdf

Threat Level: Known bad

The file 48233c394fd136a8e8c50f72c479818d was found to be: Known bad.

Malicious Activity Summary

xtremerat persistence rat spyware

XtremeRAT

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-07 05:21

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-07 05:21

Reported

2024-01-07 05:24

Platform

win7-20231215-en

Max time kernel

146s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\48233c394fd136a8e8c50f72c479818d.exe"

Signatures

XtremeRAT

persistence spyware rat xtremerat

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\crashes.exe = "C:\\Users\\Admin\\AppData\\Roaming\\crashes\\crashes.exe" C:\Users\Admin\AppData\Local\Temp\48233c394fd136a8e8c50f72c479818d.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2144 set thread context of 2792 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2144 set thread context of 2792 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\48233c394fd136a8e8c50f72c479818d.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3040 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\48233c394fd136a8e8c50f72c479818d.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 3040 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\48233c394fd136a8e8c50f72c479818d.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 3040 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\48233c394fd136a8e8c50f72c479818d.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 3040 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\48233c394fd136a8e8c50f72c479818d.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2144 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2144 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2144 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2144 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2144 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2144 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2144 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2144 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2144 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2144 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2144 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2144 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2144 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2144 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2144 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2144 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2792 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2792 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2792 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2792 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2792 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2792 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2792 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2792 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe

Processes

C:\Users\Admin\AppData\Local\Temp\48233c394fd136a8e8c50f72c479818d.exe

"C:\Users\Admin\AppData\Local\Temp\48233c394fd136a8e8c50f72c479818d.exe"

C:\Users\Admin\AppData\Roaming\crashes\crashes.exe

"C:\Users\Admin\AppData\Roaming\crashes\crashes.exe"

C:\Users\Admin\AppData\Roaming\crashes\crashes.exe

"C:\Users\Admin\AppData\Roaming\crashes\crashes.exe"

C:\Users\Admin\AppData\Roaming\crashes\crashes.exe

C:\Users\Admin\AppData\Roaming\crashes\crashes.exe

C:\Users\Admin\AppData\Roaming\crashes\crashes.exe

C:\Users\Admin\AppData\Roaming\crashes\crashes.exe

Network

Country Destination Domain Proto
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp

Files

memory/3040-2-0x0000000000230000-0x0000000000236000-memory.dmp

C:\Users\Admin\AppData\Roaming\crashes\crashes.exe

MD5 48233c394fd136a8e8c50f72c479818d
SHA1 a286371bf593d75e5932e75b0f7ccbd85e81b13b
SHA256 054ce23e77868d3b70a3884cc350b48c75e9fa63b774df6718ca6ae608b00fdf
SHA512 2fa9e8fe42cf7146a10963cb52a1e5d733e233147c5be2a3f0a6109695f1b2eb2b7ed0ebf5e56c96e7f61c5ca41d8ba55329d57d13d949382bdfbfc7aef422c3

memory/2792-17-0x0000000000400000-0x0000000000418000-memory.dmp

memory/2792-23-0x0000000000400000-0x0000000000418000-memory.dmp

memory/2792-28-0x0000000000400000-0x0000000000418000-memory.dmp

memory/2792-29-0x0000000000400000-0x0000000000400000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-07 05:21

Reported

2024-01-07 05:24

Platform

win10v2004-20231222-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\48233c394fd136a8e8c50f72c479818d.exe"

Signatures

XtremeRAT

persistence spyware rat xtremerat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\48233c394fd136a8e8c50f72c479818d.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\crashes.exe = "C:\\Users\\Admin\\AppData\\Roaming\\crashes\\crashes.exe" C:\Users\Admin\AppData\Local\Temp\48233c394fd136a8e8c50f72c479818d.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2312 set thread context of 528 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\48233c394fd136a8e8c50f72c479818d.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1532 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\48233c394fd136a8e8c50f72c479818d.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 1532 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\48233c394fd136a8e8c50f72c479818d.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 1532 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\48233c394fd136a8e8c50f72c479818d.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2312 wrote to memory of 528 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2312 wrote to memory of 528 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2312 wrote to memory of 528 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2312 wrote to memory of 528 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2312 wrote to memory of 528 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2312 wrote to memory of 528 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2312 wrote to memory of 528 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2312 wrote to memory of 528 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2312 wrote to memory of 528 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2312 wrote to memory of 528 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2312 wrote to memory of 528 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2312 wrote to memory of 528 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2312 wrote to memory of 528 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2312 wrote to memory of 528 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 2312 wrote to memory of 528 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 528 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 528 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 528 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 528 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 528 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe
PID 528 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Roaming\crashes\crashes.exe C:\Users\Admin\AppData\Roaming\crashes\crashes.exe

Processes

C:\Users\Admin\AppData\Local\Temp\48233c394fd136a8e8c50f72c479818d.exe

"C:\Users\Admin\AppData\Local\Temp\48233c394fd136a8e8c50f72c479818d.exe"

C:\Users\Admin\AppData\Roaming\crashes\crashes.exe

"C:\Users\Admin\AppData\Roaming\crashes\crashes.exe"

C:\Users\Admin\AppData\Roaming\crashes\crashes.exe

"C:\Users\Admin\AppData\Roaming\crashes\crashes.exe"

C:\Users\Admin\AppData\Roaming\crashes\crashes.exe

C:\Users\Admin\AppData\Roaming\crashes\crashes.exe

C:\Users\Admin\AppData\Roaming\crashes\crashes.exe

C:\Users\Admin\AppData\Roaming\crashes\crashes.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 84.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
N/A 127.0.0.1:81 tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
N/A 127.0.0.1:81 tcp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
N/A 127.0.0.1:81 tcp
US 20.231.121.79:80 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 58.99.105.20.in-addr.arpa udp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
N/A 127.0.0.1:81 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp

Files

memory/1532-2-0x00000000005C0000-0x00000000005C6000-memory.dmp

C:\Users\Admin\AppData\Roaming\crashes\crashes.exe

MD5 48233c394fd136a8e8c50f72c479818d
SHA1 a286371bf593d75e5932e75b0f7ccbd85e81b13b
SHA256 054ce23e77868d3b70a3884cc350b48c75e9fa63b774df6718ca6ae608b00fdf
SHA512 2fa9e8fe42cf7146a10963cb52a1e5d733e233147c5be2a3f0a6109695f1b2eb2b7ed0ebf5e56c96e7f61c5ca41d8ba55329d57d13d949382bdfbfc7aef422c3

memory/528-18-0x0000000000400000-0x0000000000418000-memory.dmp

memory/528-20-0x0000000000400000-0x0000000000418000-memory.dmp

memory/528-24-0x0000000000400000-0x0000000000418000-memory.dmp

memory/528-29-0x0000000000400000-0x0000000000418000-memory.dmp