xtremerat | 3571f7682d415ec6783bc3da38b16d6dab4caef92827793faff4c0ebf3f83d8a

General

Target
92ca235c3f86059cc7d1063221473543.exe
Size 65KB
Sample240205-x2xafsega3
SHA256 3571f7682d415ec6783bc3da38b16d6dab4caef92827793faff4c0ebf3f83d8a
MD5 92ca235c3f86059cc7d1063221473543
SHA1 7ae5d9a5f0f5209d5e13e4980aecbdc2d716d87a
SHA512 c7b8a037e9f289c7d1ed13846a5ee9e7a0018baf363d90eddfdced7e9ded263ebcaee16be88e150de4b88787414081fb31e0abf3c4651baee78e4ca760dcb6d8
SSDEEP 768:i8m1Sq4NQErBsH1tzoisBKQI6dObAG/dq8uW29Ifnca/yyR+P2ujfGiZKPA+7Xoy:Qsq+QV4rObAdXWpf/y+7ozNwiOootd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

C2

Detect XtremeRAT payload 7 IoCs

resource	yara_rule
behavioral2/memory/4228-0-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/2484-1-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/2648-2-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/2484-5-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/2484-6-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/4228-7-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/2484-8-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Modifies Installed Components in the registry 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{KE4B0H28-06KN-13JH-6P67-W0OLIFD4312A}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{KE4B0H28-06KN-13JH-6P67-W0OLIFD4312A}\StubPath = "C:\\Windows\\system32\\InstallDir\\csrss.exe restart"	explorer.exe

Adds Run key to start application 2 TTPs 3 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\csrss.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\csrss.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "explorer.exe"	explorer.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\InstallDir\csrss.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\	explorer.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\csrss.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2800	4228	WerFault.exe	84
3088	4228	WerFault.exe	84

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2484	explorer.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 4228	2648	92ca235c3f86059cc7d1063221473543.exe	84
PID 2648 wrote to memory of 4228	2648	92ca235c3f86059cc7d1063221473543.exe	84
PID 2648 wrote to memory of 4228	2648	92ca235c3f86059cc7d1063221473543.exe	84
PID 2648 wrote to memory of 4228	2648	92ca235c3f86059cc7d1063221473543.exe	84
PID 2648 wrote to memory of 2484	2648	92ca235c3f86059cc7d1063221473543.exe	85
PID 2648 wrote to memory of 2484	2648	92ca235c3f86059cc7d1063221473543.exe	85
PID 2648 wrote to memory of 2484	2648	92ca235c3f86059cc7d1063221473543.exe	85
PID 2648 wrote to memory of 2484	2648	92ca235c3f86059cc7d1063221473543.exe	85

C:\Users\Admin\AppData\Local\Temp\92ca235c3f86059cc7d1063221473543.exe
"C:\Users\Admin\AppData\Local\Temp\92ca235c3f86059cc7d1063221473543.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:4228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 480
    3⤵
    - Program crash
    PID:2800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 476
    3⤵
    - Program crash
    PID:3088
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  - Modifies Installed Components in the registry
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:2484