xtremerat | 7f55d17b76f302e07edbc21096fcf218713b9ad06be597862a17a79ab288b583

General

Target
834f7ce0d80f71d0fcfbe09862151b23.exe
Size 227KB
Sample240131-dws63aaff6
SHA256 7f55d17b76f302e07edbc21096fcf218713b9ad06be597862a17a79ab288b583
MD5 834f7ce0d80f71d0fcfbe09862151b23
SHA1 632adebc9db71f9114abad45328538f8a28f0162
SHA512 199b3eaa642a2a4a3ab4caa98891d5f0e69e06eaaf8c2dfa7dcda1b9dda7e57d4fb1a0696d3d68d75b6dc3b103ecd4496f8def34c260701fb33562ee1af3080e
SSDEEP 6144:h+sgruDIqjEmKpmFJ5eQzG6gjvkZMPu1ZcOFtym:NMuZba+QDjsZMVOFtym
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat evasion persistence rat spyware trojan upx

Malware Config

Extracted

Family

xtremerat

C2

hackerbnc.no-ip.biz

Signatures

Detect XtremeRAT payload 5 IoCs

resource	yara_rule
behavioral2/memory/3716-14-0x0000000010000000-0x0000000010054000-memory.dmp	family_xtremerat
behavioral2/memory/3716-13-0x0000000010000000-0x0000000010054000-memory.dmp	family_xtremerat
behavioral2/memory/2488-15-0x0000000010000000-0x0000000010054000-memory.dmp	family_xtremerat
behavioral2/memory/3716-16-0x0000000010000000-0x0000000010054000-memory.dmp	family_xtremerat
behavioral2/memory/2488-17-0x0000000010000000-0x0000000010054000-memory.dmp	family_xtremerat

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	834f7ce0d80f71d0fcfbe09862151b23.exe

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	834f7ce0d80f71d0fcfbe09862151b23.exe

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3716-8-0x0000000010000000-0x0000000010054000-memory.dmp	upx
behavioral2/memory/3716-12-0x0000000010000000-0x0000000010054000-memory.dmp	upx
behavioral2/memory/3716-14-0x0000000010000000-0x0000000010054000-memory.dmp	upx
behavioral2/memory/3716-13-0x0000000010000000-0x0000000010054000-memory.dmp	upx
behavioral2/memory/2488-15-0x0000000010000000-0x0000000010054000-memory.dmp	upx
behavioral2/memory/3716-16-0x0000000010000000-0x0000000010054000-memory.dmp	upx
behavioral2/memory/2488-17-0x0000000010000000-0x0000000010054000-memory.dmp	upx

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	834f7ce0d80f71d0fcfbe09862151b23.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	834f7ce0d80f71d0fcfbe09862151b23.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3272 set thread context of 4816	3272	834f7ce0d80f71d0fcfbe09862151b23.exe	85
PID 4816 set thread context of 3716	4816	834f7ce0d80f71d0fcfbe09862151b23.exe	87

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3056	2488	WerFault.exe	88
2568	2488	WerFault.exe	88

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3272	834f7ce0d80f71d0fcfbe09862151b23.exe
4816	834f7ce0d80f71d0fcfbe09862151b23.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 4816	3272	834f7ce0d80f71d0fcfbe09862151b23.exe	85
PID 3272 wrote to memory of 4816	3272	834f7ce0d80f71d0fcfbe09862151b23.exe	85
PID 3272 wrote to memory of 4816	3272	834f7ce0d80f71d0fcfbe09862151b23.exe	85
PID 3272 wrote to memory of 4816	3272	834f7ce0d80f71d0fcfbe09862151b23.exe	85
PID 3272 wrote to memory of 4816	3272	834f7ce0d80f71d0fcfbe09862151b23.exe	85
PID 3272 wrote to memory of 4816	3272	834f7ce0d80f71d0fcfbe09862151b23.exe	85
PID 3272 wrote to memory of 4816	3272	834f7ce0d80f71d0fcfbe09862151b23.exe	85
PID 3272 wrote to memory of 4816	3272	834f7ce0d80f71d0fcfbe09862151b23.exe	85
PID 4816 wrote to memory of 3716	4816	834f7ce0d80f71d0fcfbe09862151b23.exe	87
PID 4816 wrote to memory of 3716	4816	834f7ce0d80f71d0fcfbe09862151b23.exe	87
PID 4816 wrote to memory of 3716	4816	834f7ce0d80f71d0fcfbe09862151b23.exe	87
PID 4816 wrote to memory of 3716	4816	834f7ce0d80f71d0fcfbe09862151b23.exe	87
PID 4816 wrote to memory of 3716	4816	834f7ce0d80f71d0fcfbe09862151b23.exe	87
PID 4816 wrote to memory of 3716	4816	834f7ce0d80f71d0fcfbe09862151b23.exe	87
PID 4816 wrote to memory of 3716	4816	834f7ce0d80f71d0fcfbe09862151b23.exe	87
PID 4816 wrote to memory of 3716	4816	834f7ce0d80f71d0fcfbe09862151b23.exe	87
PID 4816 wrote to memory of 3716	4816	834f7ce0d80f71d0fcfbe09862151b23.exe	87
PID 3716 wrote to memory of 2488	3716	834f7ce0d80f71d0fcfbe09862151b23.exe	88
PID 3716 wrote to memory of 2488	3716	834f7ce0d80f71d0fcfbe09862151b23.exe	88
PID 3716 wrote to memory of 2488	3716	834f7ce0d80f71d0fcfbe09862151b23.exe	88
PID 3716 wrote to memory of 2488	3716	834f7ce0d80f71d0fcfbe09862151b23.exe	88
PID 3716 wrote to memory of 1348	3716	834f7ce0d80f71d0fcfbe09862151b23.exe	89
PID 3716 wrote to memory of 1348	3716	834f7ce0d80f71d0fcfbe09862151b23.exe	89
PID 3716 wrote to memory of 1348	3716	834f7ce0d80f71d0fcfbe09862151b23.exe	89

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	834f7ce0d80f71d0fcfbe09862151b23.exe

C:\Users\Admin\AppData\Local\Temp\834f7ce0d80f71d0fcfbe09862151b23.exe
"C:\Users\Admin\AppData\Local\Temp\834f7ce0d80f71d0fcfbe09862151b23.exe"
1⤵
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3272
- C:\Users\Admin\AppData\Local\Temp\834f7ce0d80f71d0fcfbe09862151b23.exe
  C:\Users\Admin\AppData\Local\Temp\834f7ce0d80f71d0fcfbe09862151b23.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Users\Admin\AppData\Local\Temp\834f7ce0d80f71d0fcfbe09862151b23.exe
    C:\Users\Admin\AppData\Local\Temp\834f7ce0d80f71d0fcfbe09862151b23.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3716
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:2488
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 488
        5⤵
        Program crash
        
        PID:3056
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 508
        5⤵
        Program crash
        
        PID:2568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1348