xtremerat | de215fbe071105e63bad7cf6cb488ca8fa3ac6402c3e679b6f24bbf228fad218

General

Target
Avira_AntiVir_Premium_En_Activation Key-2012/Avira_AntiVir_Premium_En_Activation Key-2012.exe
Size 123KB
Sample240201-m1rcpsddgl
SHA256 f4ec593c1c0aa1f6b54e7c44a31da4e0161dea649a06b7f41f286ae4da834901
MD5 66a173eb1770809c39deb08ab53d522d
SHA1 234f0e5440d1a6e3bb59b32a8afaa158afb96cc2
SHA512 674e472bc0ca36172d0a0ba3e666458bae3b5c584cc8cf35c50d233318a54b6e40c537e8be4045a31597c8092432c18736cbef17bde6666f6acb6ee5986c9014
SSDEEP 3072:b1dlKwgj23+Oz05YoNozau+gIjZ0DGfaWoO7:b1dlZro5ydI6DPWoU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Extracted

Family

xtremerat

C2

avic.zapto.org

Signatures

Detect XtremeRAT payload 3 IoCs

resource	yara_rule
behavioral4/memory/3052-25-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral4/memory/1804-26-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral4/memory/3052-27-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	Avira_AntiVir_Premium_En_Activation Key-2012.exe

Executes dropped EXE 1 IoCs

pid	Process
1804	activation.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/files/0x0007000000023209-20.dat	upx
behavioral4/memory/1804-24-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral4/memory/3052-25-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral4/memory/1804-26-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral4/memory/3052-27-0x0000000010000000-0x000000001004D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1660	3052	WerFault.exe	85
828	3052	WerFault.exe	85

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 1804	4548	Avira_AntiVir_Premium_En_Activation Key-2012.exe	84
PID 4548 wrote to memory of 1804	4548	Avira_AntiVir_Premium_En_Activation Key-2012.exe	84
PID 4548 wrote to memory of 1804	4548	Avira_AntiVir_Premium_En_Activation Key-2012.exe	84
PID 1804 wrote to memory of 3052	1804	activation.exe	85
PID 1804 wrote to memory of 3052	1804	activation.exe	85
PID 1804 wrote to memory of 3052	1804	activation.exe	85
PID 1804 wrote to memory of 3052	1804	activation.exe	85
PID 1804 wrote to memory of 4004	1804	activation.exe	86
PID 1804 wrote to memory of 4004	1804	activation.exe	86
PID 1804 wrote to memory of 4004	1804	activation.exe	86

C:\Users\Admin\AppData\Local\Temp\Avira_AntiVir_Premium_En_Activation Key-2012\Avira_AntiVir_Premium_En_Activation Key-2012.exe
"C:\Users\Admin\AppData\Local\Temp\Avira_AntiVir_Premium_En_Activation Key-2012\Avira_AntiVir_Premium_En_Activation Key-2012.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Users\Admin\AppData\Local\Temp\activation.exe
  "C:\Users\Admin\AppData\Local\Temp\activation.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:3052
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 480
      4⤵
      Program crash
      PID:1660
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 504
      4⤵
      Program crash
      PID:828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3052 -ip 3052
1⤵
PID:1008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3052 -ip 3052
1⤵
PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activation.exe

Path C:\Users\Admin\AppData\Local\Temp\activation.exe
Size 33KB
SHA256 a1e31d9df888ffb07dc84669cef4773e4f00e86c644e24c0c83da7bc08433405
MD5 8dff34bbd074ac6e82b88e8277ee9ce5
SHA1 a90d9f2a6057bc28e8b18364c53d8052556f3950
SHA512 a2e5df1a356de19230c2655ccf3ca5c8e4b3a4cb7606f8ae65532de8139e68ae281f509d48b12f36cc8706d02103ad45507de1dff26f0af44c5507e04d5f4a10
SSDEEP 768:NMuijtHf5g7/IIG3bGcYDBSvFIWuePQDGEsgRMdd5rdL420eLllC:mNW71rcYDAWeoDrsEud5rds
MD5 SHA1 SHA512 SSDEEP

Submit Download

sfx.ini

Path C:\Users\Admin\AppData\Local\Temp\sfx.ini
Size 175B
SHA256 e4430c6a106911d4d6f7444364671e79c5ff2d0eb517f13fb42590bd590a0d1d
MD5 f640f27720afe6c6f49c54efc882aa61
SHA1 3df731fbca9f35c0483a3b3148d994b20f667b3b
SHA512 262e8039fa648d9c52696e752d4b51444a23aa8622da0f27a6e7018bf378b27855380425ac63f72d3ff3320982f36fa17100b1dd946d44143e1232703c6aec74
MD5 SHA1 SHA512

Submit Download

memory/1804-24-0x0000000010000000-0x000000001004D000-memory.dmp

Download

memory/1804-26-0x0000000010000000-0x000000001004D000-memory.dmp

Download

memory/3052-25-0x0000000010000000-0x000000001004D000-memory.dmp

Download

memory/3052-27-0x0000000010000000-0x000000001004D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads