xtremerat | 4aa74c09b33e85f7de851c4caf58f9cbec4f1ac6fdd1ed231e66e0a3335dd840

General

Target

8fbaf88258e1acee8e1c85cb1cd92386.exe
Size

183KB
MD5

8fbaf88258e1acee8e1c85cb1cd92386
SHA1

07375744c64ac222cb863088bb3897533ced6770
SHA256

4aa74c09b33e85f7de851c4caf58f9cbec4f1ac6fdd1ed231e66e0a3335dd840
SHA512

665a1e8cb3e9b2101aa6112ce46227aa0313978ddea5bad696d001bdcd70e9b0dc2c26c5a1894ca67b7e0ec16f6404ecc530cb84bc554194c3442940697efbe3
SSDEEP

3072:hBPe+2TmObY97TkP7r7QYz0vaRUU4I82pdwVP8KmDnYZUpyl+9R2uhYJ5jP:veTmOb0fC/WypdwVkK8nxxhe

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Extracted

Family

xtremerat

C2

headnoip.zapto.org

Signatures

Detect XtremeRAT payload 5 IoCs

resource	yara_rule
behavioral1/memory/2764-8-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral1/memory/2764-7-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral1/memory/2648-11-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral1/memory/2764-12-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral1/memory/2648-13-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2764-3-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/2764-5-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/2764-8-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/2764-7-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/2648-11-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/2764-12-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/2648-13-0x0000000010000000-0x000000001004D000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2220 set thread context of 2764	2220	8fbaf88258e1acee8e1c85cb1cd92386.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2220	8fbaf88258e1acee8e1c85cb1cd92386.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2764	2220	8fbaf88258e1acee8e1c85cb1cd92386.exe	28
PID 2220 wrote to memory of 2764	2220	8fbaf88258e1acee8e1c85cb1cd92386.exe	28
PID 2220 wrote to memory of 2764	2220	8fbaf88258e1acee8e1c85cb1cd92386.exe	28
PID 2220 wrote to memory of 2764	2220	8fbaf88258e1acee8e1c85cb1cd92386.exe	28
PID 2220 wrote to memory of 2764	2220	8fbaf88258e1acee8e1c85cb1cd92386.exe	28
PID 2220 wrote to memory of 2764	2220	8fbaf88258e1acee8e1c85cb1cd92386.exe	28
PID 2220 wrote to memory of 2764	2220	8fbaf88258e1acee8e1c85cb1cd92386.exe	28
PID 2220 wrote to memory of 2764	2220	8fbaf88258e1acee8e1c85cb1cd92386.exe	28
PID 2220 wrote to memory of 2764	2220	8fbaf88258e1acee8e1c85cb1cd92386.exe	28
PID 2764 wrote to memory of 2648	2764	8fbaf88258e1acee8e1c85cb1cd92386.exe	29
PID 2764 wrote to memory of 2648	2764	8fbaf88258e1acee8e1c85cb1cd92386.exe	29
PID 2764 wrote to memory of 2648	2764	8fbaf88258e1acee8e1c85cb1cd92386.exe	29
PID 2764 wrote to memory of 2648	2764	8fbaf88258e1acee8e1c85cb1cd92386.exe	29
PID 2764 wrote to memory of 2648	2764	8fbaf88258e1acee8e1c85cb1cd92386.exe	29
PID 2764 wrote to memory of 2676	2764	8fbaf88258e1acee8e1c85cb1cd92386.exe	30
PID 2764 wrote to memory of 2676	2764	8fbaf88258e1acee8e1c85cb1cd92386.exe	30
PID 2764 wrote to memory of 2676	2764	8fbaf88258e1acee8e1c85cb1cd92386.exe	30
PID 2764 wrote to memory of 2676	2764	8fbaf88258e1acee8e1c85cb1cd92386.exe	30
PID 2764 wrote to memory of 2676	2764	8fbaf88258e1acee8e1c85cb1cd92386.exe	30

C:\Users\Admin\AppData\Local\Temp\8fbaf88258e1acee8e1c85cb1cd92386.exe
"C:\Users\Admin\AppData\Local\Temp\8fbaf88258e1acee8e1c85cb1cd92386.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Users\Admin\AppData\Local\Temp\8fbaf88258e1acee8e1c85cb1cd92386.exe
  "C:\Users\Admin\AppData\Local\Temp\8fbaf88258e1acee8e1c85cb1cd92386.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2648
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2220-0-0x0000000074690000-0x0000000074C3B000-memory.dmp

Filesize
5.7MB

Download
memory/2220-1-0x0000000074690000-0x0000000074C3B000-memory.dmp

Filesize
5.7MB

Download
memory/2220-2-0x0000000000580000-0x00000000005C0000-memory.dmp

Filesize
256KB

Download
memory/2220-6-0x0000000074690000-0x0000000074C3B000-memory.dmp

Filesize
5.7MB

Download
memory/2648-9-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2648-11-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2648-13-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2764-3-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2764-5-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2764-8-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2764-7-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2764-12-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download

Analysis

Sharing