Malware Analysis Report

2025-01-02 02:07

Sample ID 240130-lsmtwaehcj
Target 821e4c194c721f6f40b6a63b71229677
SHA256 b95a5e2ae5653e4de504a1d230857b40b1c251c5b832057a3f3ac67ec4cdb408
Tags
xtremerat persistence rat spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b95a5e2ae5653e4de504a1d230857b40b1c251c5b832057a3f3ac67ec4cdb408

Threat Level: Known bad

The file 821e4c194c721f6f40b6a63b71229677 was found to be: Known bad.

Malicious Activity Summary

xtremerat persistence rat spyware

XtremeRAT

Detect XtremeRAT payload

Modifies Installed Components in the registry

Executes dropped EXE

Adds Run key to start application

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-30 09:47

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-30 09:47

Reported

2024-01-30 09:50

Platform

win7-20231215-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\821e4c194c721f6f40b6a63b71229677.exe"

Signatures

Detect XtremeRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

XtremeRAT

persistence spyware rat xtremerat

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{W8T14QPY-7Y46-5QEV-21J8-V8SC54R564PN} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{W8T14QPY-7Y46-5QEV-21J8-V8SC54R564PN}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\InstallDir\\Server.exe restart" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{W8T14QPY-7Y46-5QEV-21J8-V8SC54R564PN} C:\Windows\SysWOW64\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{W8T14QPY-7Y46-5QEV-21J8-V8SC54R564PN}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\InstallDir\\Server.exe" C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MINEEE~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ACELER~1.EXE N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\821e4c194c721f6f40b6a63b71229677.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Local\\Temp\\InstallDir\\Server.exe" C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Local\\Temp\\InstallDir\\Server.exe" C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Local\\Temp\\InstallDir\\Server.exe" C:\Windows\SysWOW64\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Local\\Temp\\InstallDir\\Server.exe" C:\Windows\SysWOW64\svchost.exe N/A

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2668 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\821e4c194c721f6f40b6a63b71229677.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MINEEE~1.EXE
PID 2668 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\821e4c194c721f6f40b6a63b71229677.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MINEEE~1.EXE
PID 2668 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\821e4c194c721f6f40b6a63b71229677.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MINEEE~1.EXE
PID 2668 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\821e4c194c721f6f40b6a63b71229677.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MINEEE~1.EXE
PID 2012 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MINEEE~1.EXE C:\Windows\SysWOW64\svchost.exe
PID 2012 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MINEEE~1.EXE C:\Windows\SysWOW64\svchost.exe
PID 2012 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MINEEE~1.EXE C:\Windows\SysWOW64\svchost.exe
PID 2012 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MINEEE~1.EXE C:\Windows\SysWOW64\svchost.exe
PID 2012 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MINEEE~1.EXE C:\Windows\SysWOW64\svchost.exe
PID 2012 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MINEEE~1.EXE C:\Windows\SysWOW64\explorer.exe
PID 2012 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MINEEE~1.EXE C:\Windows\SysWOW64\explorer.exe
PID 2012 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MINEEE~1.EXE C:\Windows\SysWOW64\explorer.exe
PID 2012 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MINEEE~1.EXE C:\Windows\SysWOW64\explorer.exe
PID 2012 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MINEEE~1.EXE C:\Windows\SysWOW64\explorer.exe
PID 2668 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\821e4c194c721f6f40b6a63b71229677.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ACELER~1.EXE
PID 2668 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\821e4c194c721f6f40b6a63b71229677.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ACELER~1.EXE
PID 2668 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\821e4c194c721f6f40b6a63b71229677.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ACELER~1.EXE
PID 2684 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ACELER~1.EXE C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
PID 2684 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ACELER~1.EXE C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
PID 2684 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ACELER~1.EXE C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe

Processes

C:\Users\Admin\AppData\Local\Temp\821e4c194c721f6f40b6a63b71229677.exe

"C:\Users\Admin\AppData\Local\Temp\821e4c194c721f6f40b6a63b71229677.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MINEEE~1.EXE

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MINEEE~1.EXE

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ACELER~1.EXE

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ACELER~1.EXE

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe

dw20.exe -x -s 416

Network

Country Destination Domain Proto
US 8.8.8.8:53 keohack.no-ip.biz udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MINEEE~1.EXE

MD5 3ded0d9f3644be4ee425101d53c9d531
SHA1 c19997e0c8da2243beb858d8d4e992710718705f
SHA256 bfc0210ee77bb884d89be9c24dff0f44866355dfbfb5eae0d1d2a5c93d908467
SHA512 5643a5828206ae6e92f3cc52ac1d35284b1ae2a81549a31f6d25d1e209bdb4222ccb114a6ea6d62936ad431775ecce8905421a62055f653c3503c764a38a1bd1

memory/2012-9-0x0000000010000000-0x00000000100C5000-memory.dmp

memory/2800-10-0x0000000010000000-0x00000000100C5000-memory.dmp

memory/2800-12-0x0000000010000000-0x00000000100C5000-memory.dmp

memory/2840-15-0x0000000010000000-0x00000000100C5000-memory.dmp

memory/2012-16-0x0000000010000000-0x00000000100C5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ACELER~1.EXE

MD5 90ad798c72c142c27204801a41483630
SHA1 ae45cb70ac04c135fc5f1bd1f5eb5093ef9bf676
SHA256 ec5e60507ed862673894935dcc2c7dfd281b166ab5480e094991d3a8779ce665
SHA512 f12c32c801124ec13efd0f48c434e96194352af0d2dcac29d5f611ece31ba62d812242970be45a7f7cdea4372db980e1ae6f353a1f61a34a2bee7e093e22f037

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ACELER~1.EXE

MD5 76440b3728cb0497aa1c57b53f840532
SHA1 f1020a4db921f69c7ddc757b4ad2e0a143ce126c
SHA256 3ea80453395075f9b68d2f90ad935dd1349f250a74b7b019e8fcfc042fe6aba0
SHA512 819b9fd995e3500c397f6f83814afef55e71a9023d75718bb7c411241feff939d1f97138bb2032775037dc58cfb37c6612ab5e6290fc325467be1ec906760256

memory/2840-24-0x0000000010000000-0x00000000100C5000-memory.dmp

memory/2840-23-0x0000000010000000-0x00000000100C5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MINEEE~1.EXE

MD5 8fd2a8bb5ceffbb5f403dfa2881ee410
SHA1 e9253425ebd5c816c08e025da5d0b2cabddb3540
SHA256 a798a7744a2bf3ad2d037b59742e9f44d0056d1db60018ee6bf27f289c38a24c
SHA512 8ebbdbb59a0726f3417392640bac7ece44c722b3de953e61b1db70cc8fe704531f7a9e46862dcc788a39e789e16faf4d596d681aa6668cfda7bb0805de58999f

memory/2684-25-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

memory/2840-27-0x0000000010000000-0x00000000100C5000-memory.dmp

memory/2684-26-0x0000000001F10000-0x0000000001F90000-memory.dmp

memory/2684-28-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

memory/3008-29-0x0000000000460000-0x0000000000461000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\InstallDir\Server.exe

MD5 34a0787524cc12459847e9016dc61bd3
SHA1 488c80408ee54ba46bff315bffdd8fbbc0ba76b9
SHA256 0a0f537efd5cd0697a96e26f01a55c00a8f0123d35b40b4eb2f92d98df136dc8
SHA512 31413b4bf0d3a6991ecbc86b0c44947dffeff638e6236ee453d30cea3992572d1b76f172368d2d60eb34ca8f8c4dd2549c9adf03a42d32040112c7d4e7945ef0

memory/2800-31-0x0000000010000000-0x00000000100C5000-memory.dmp

memory/2684-32-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

memory/2684-33-0x0000000001F10000-0x0000000001F90000-memory.dmp

memory/2840-34-0x0000000010000000-0x00000000100C5000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-30 09:47

Reported

2024-01-30 09:50

Platform

win10v2004-20231215-en

Max time kernel

92s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\821e4c194c721f6f40b6a63b71229677.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MINEEE~1.EXE N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\821e4c194c721f6f40b6a63b71229677.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\821e4c194c721f6f40b6a63b71229677.exe

"C:\Users\Admin\AppData\Local\Temp\821e4c194c721f6f40b6a63b71229677.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MINEEE~1.EXE

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MINEEE~1.EXE

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 175.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 16.234.44.23.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.178.17.96.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MINEEE~1.EXE

MD5 3ded0d9f3644be4ee425101d53c9d531
SHA1 c19997e0c8da2243beb858d8d4e992710718705f
SHA256 bfc0210ee77bb884d89be9c24dff0f44866355dfbfb5eae0d1d2a5c93d908467
SHA512 5643a5828206ae6e92f3cc52ac1d35284b1ae2a81549a31f6d25d1e209bdb4222ccb114a6ea6d62936ad431775ecce8905421a62055f653c3503c764a38a1bd1