xtremerat | eea3b797f4d9001954be563a1998ee34bb29781acf47abe76a6810c9203b1890

Analysis

max time kernel
90s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 23:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe
Size 796KB
Sample240203-28xxsaeeam
SHA256 eea3b797f4d9001954be563a1998ee34bb29781acf47abe76a6810c9203b1890
MD5 8d9d1e8bc4dc527d44bedcd8ac7c16a6
SHA1 0a2fd33daab48eb130c1363178c2ad5e2b6d0a1d
SHA512 1a95b022dccf88b00eea058d053e9d3294bc560bf5c5bf8d91fa8887e9779bdf9caa2f4b0609eb168514ab563803b83b6bea2d453daddedca8715d34570378e5
SSDEEP 3072:LjGV0FxQor6uW6jQq2b8sZpP7j8JfeT3Ep+7mh5RfrWjT+qbeCuqK:LiVCxQorM6jv2YsZpP8JfedChjr6Nu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Extracted

Family

xtremerat

123boof.no-ip.org

Signatures

Detect XtremeRAT payload 7 IoCs

resource	yara_rule
behavioral2/memory/1424-2-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral2/memory/1424-3-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral2/memory/1424-4-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral2/memory/1424-5-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral2/memory/3364-6-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral2/memory/1424-7-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral2/memory/3364-8-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3668 set thread context of 1424	3668	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe	88
PID 3668 set thread context of 0	3668	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3264	3364	WerFault.exe	89
4312	3364	WerFault.exe	89

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3668	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 1424	3668	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe	88
PID 3668 wrote to memory of 1424	3668	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe	88
PID 3668 wrote to memory of 1424	3668	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe	88
PID 3668 wrote to memory of 1424	3668	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe	88
PID 3668 wrote to memory of 1424	3668	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe	88
PID 3668 wrote to memory of 1424	3668	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe	88
PID 3668 wrote to memory of 1424	3668	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe	88
PID 3668 wrote to memory of 1424	3668	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe	88
PID 3668 wrote to memory of 1424	3668	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe	88
PID 3668 wrote to memory of 1424	3668	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe	88
PID 3668 wrote to memory of 1424	3668	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe	88
PID 3668 wrote to memory of 1424	3668	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe	88
PID 3668 wrote to memory of 1424	3668	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe	88
PID 1424 wrote to memory of 3364	1424	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe	89
PID 1424 wrote to memory of 3364	1424	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe	89
PID 1424 wrote to memory of 3364	1424	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe	89
PID 3668 wrote to memory of 0	3668	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe
PID 3668 wrote to memory of 0	3668	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe
PID 3668 wrote to memory of 0	3668	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe
PID 3668 wrote to memory of 0	3668	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe
PID 3668 wrote to memory of 0	3668	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe
PID 1424 wrote to memory of 3364	1424	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe	89
PID 1424 wrote to memory of 3976	1424	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe	90
PID 1424 wrote to memory of 3976	1424	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe	90
PID 3668 wrote to memory of 0	3668	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe
PID 1424 wrote to memory of 3976	1424	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe	90
PID 3668 wrote to memory of 0	3668	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe
PID 3668 wrote to memory of 0	3668	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe
PID 3668 wrote to memory of 0	3668	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe
PID 3668 wrote to memory of 0	3668	8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe

C:\Users\Admin\AppData\Local\Temp\8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe
"C:\Users\Admin\AppData\Local\Temp\8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Users\Admin\AppData\Local\Temp\8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe
  "C:\Users\Admin\AppData\Local\Temp\8d9d1e8bc4dc527d44bedcd8ac7c16a6.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:3364
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 480
      4⤵
      Program crash
      PID:3264
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 488
      4⤵
      Program crash
      PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3364 -ip 3364
1⤵
PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 3364 -ip 3364
1⤵
PID:3244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1424-2-0x0000000010000000-0x0000000010048000-memory.dmp

Download

memory/1424-3-0x0000000010000000-0x0000000010048000-memory.dmp

Download

memory/1424-4-0x0000000010000000-0x0000000010048000-memory.dmp

Download

memory/1424-5-0x0000000010000000-0x0000000010048000-memory.dmp

Download

memory/1424-7-0x0000000010000000-0x0000000010048000-memory.dmp

Download

memory/3364-6-0x0000000010000000-0x0000000010048000-memory.dmp

Download

memory/3364-8-0x0000000010000000-0x0000000010048000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads