xtremerat | 4aa74c09b33e85f7de851c4caf58f9cbec4f1ac6fdd1ed231e66e0a3335dd840

General

Target

8fbaf88258e1acee8e1c85cb1cd92386.exe
Size

183KB
MD5

8fbaf88258e1acee8e1c85cb1cd92386
SHA1

07375744c64ac222cb863088bb3897533ced6770
SHA256

4aa74c09b33e85f7de851c4caf58f9cbec4f1ac6fdd1ed231e66e0a3335dd840
SHA512

665a1e8cb3e9b2101aa6112ce46227aa0313978ddea5bad696d001bdcd70e9b0dc2c26c5a1894ca67b7e0ec16f6404ecc530cb84bc554194c3442940697efbe3
SSDEEP

3072:hBPe+2TmObY97TkP7r7QYz0vaRUU4I82pdwVP8KmDnYZUpyl+9R2uhYJ5jP:veTmOb0fC/WypdwVkK8nxxhe

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Extracted

Family

xtremerat

C2

headnoip.zapto.org

Signatures

Detect XtremeRAT payload 5 IoCs

resource	yara_rule
behavioral2/memory/764-9-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/764-7-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/2852-10-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/764-11-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/2852-12-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/764-3-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/764-6-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/764-9-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/764-7-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/2852-10-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/764-11-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/2852-12-0x0000000010000000-0x000000001004D000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 800 set thread context of 764	800	8fbaf88258e1acee8e1c85cb1cd92386.exe	87

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1264	2852	WerFault.exe	88
3216	2852	WerFault.exe	88

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	800	8fbaf88258e1acee8e1c85cb1cd92386.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 764	800	8fbaf88258e1acee8e1c85cb1cd92386.exe	87
PID 800 wrote to memory of 764	800	8fbaf88258e1acee8e1c85cb1cd92386.exe	87
PID 800 wrote to memory of 764	800	8fbaf88258e1acee8e1c85cb1cd92386.exe	87
PID 800 wrote to memory of 764	800	8fbaf88258e1acee8e1c85cb1cd92386.exe	87
PID 800 wrote to memory of 764	800	8fbaf88258e1acee8e1c85cb1cd92386.exe	87
PID 800 wrote to memory of 764	800	8fbaf88258e1acee8e1c85cb1cd92386.exe	87
PID 800 wrote to memory of 764	800	8fbaf88258e1acee8e1c85cb1cd92386.exe	87
PID 800 wrote to memory of 764	800	8fbaf88258e1acee8e1c85cb1cd92386.exe	87
PID 764 wrote to memory of 2852	764	8fbaf88258e1acee8e1c85cb1cd92386.exe	88
PID 764 wrote to memory of 2852	764	8fbaf88258e1acee8e1c85cb1cd92386.exe	88
PID 764 wrote to memory of 2852	764	8fbaf88258e1acee8e1c85cb1cd92386.exe	88
PID 764 wrote to memory of 2852	764	8fbaf88258e1acee8e1c85cb1cd92386.exe	88
PID 764 wrote to memory of 1380	764	8fbaf88258e1acee8e1c85cb1cd92386.exe	89
PID 764 wrote to memory of 1380	764	8fbaf88258e1acee8e1c85cb1cd92386.exe	89
PID 764 wrote to memory of 1380	764	8fbaf88258e1acee8e1c85cb1cd92386.exe	89

C:\Users\Admin\AppData\Local\Temp\8fbaf88258e1acee8e1c85cb1cd92386.exe
"C:\Users\Admin\AppData\Local\Temp\8fbaf88258e1acee8e1c85cb1cd92386.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:800
- C:\Users\Admin\AppData\Local\Temp\8fbaf88258e1acee8e1c85cb1cd92386.exe
  "C:\Users\Admin\AppData\Local\Temp\8fbaf88258e1acee8e1c85cb1cd92386.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:764
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2852
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 480
      4⤵
      Program crash
      PID:1264
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 500
      4⤵
      Program crash
      PID:3216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:1380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2852 -ip 2852
1⤵
PID:1872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2852 -ip 2852
1⤵
PID:4104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/764-3-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/764-6-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/764-9-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/764-7-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/764-11-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/800-0-0x00000000747E0000-0x0000000074D91000-memory.dmp

Filesize
5.7MB

Download
memory/800-1-0x00000000747E0000-0x0000000074D91000-memory.dmp

Filesize
5.7MB

Download
memory/800-2-0x00000000009F0000-0x0000000000A00000-memory.dmp

Filesize
64KB

Download
memory/800-8-0x00000000747E0000-0x0000000074D91000-memory.dmp

Filesize
5.7MB

Download
memory/2852-10-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2852-12-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download

Analysis

Sharing