xtremerat | a58eb70c9e826fad3872d70134cb945ef72d0865407b066090408cce53a38b23

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/02/2024, 19:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VirusShare_a91a9b39b94464b44184730ddf5c9ea2.exe
Size 3.9MB
Sample240206-x7k5dafghk
SHA256 a58eb70c9e826fad3872d70134cb945ef72d0865407b066090408cce53a38b23
MD5 a91a9b39b94464b44184730ddf5c9ea2
SHA1 0a07247bf87258f8205f6380819086f0c22d081d
SHA512 3d4bdf2a1745f19d350f0b83d2491d155b3256ca5fe2e74a02bfcc099e906d90f6e1fdcecf13bdeb9689518ddde31584fa85b68c1bfb1b0f40e637440d698e26
SSDEEP 98304:eBXC0RWM6bbpdl6Jz1leThe1hJKS3cTcKlEJZL9TAgAI:elCHM6bbLl6JZlKheJKSMcDZL9TAA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat evasion persistence rat spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol
smtp
Host
smtp.gmail.com
Port
587
Username
[email protected]
Password
asd3q2da211a

Extracted

Family

xtremerat

412341.sytes.net

Signatures

Detect XtremeRAT payload 6 IoCs

resource	yara_rule
behavioral2/files/0x00060000000231ec-29.dat	family_xtremerat
behavioral2/memory/5064-50-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/2984-52-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/2912-58-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/2760-59-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral2/memory/2912-61-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\InstallDir\\Shell.exe"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\InstallDir\\Shell.exe"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\InstallDir\\Shell.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\InstallDir\\Shell.exe"	svchost.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C8DF-B266-909E-HB58-E32B79832EB2}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C8DF-B266-909E-HB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Shell.exe restart"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C8DF-B266-909E-HB58-E32B79832EB2}	Update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C8DF-B266-909E-HB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Shell.exe restart"	Update.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	VirusShare_a91a9b39b94464b44184730ddf5c9ea2.exe

Executes dropped EXE 4 IoCs

pid	Process
3160	Audio.exe
224	setup.exe
2760	Update.exe
452	GLB41BC.tmp

Loads dropped DLL 1 IoCs

pid	Process
452	GLB41BC.tmp

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Shell.exe"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Shell.exe"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Updater = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysAudio.exe"	Audio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Shell.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Shell.exe"	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\GLBSINST.%$D	GLB41BC.tmp

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InstallDir\Shell.exe	Update.exe
File created	C:\Windows\InstallDir\Shell.exe	Update.exe
File opened for modification	C:\Windows\InstallDir\	Update.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4304	2984	WerFault.exe	90
2780	2984	WerFault.exe	90

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4608	reg.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3160	Audio.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2912	explorer.exe
3160	Audio.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 3160	2044	VirusShare_a91a9b39b94464b44184730ddf5c9ea2.exe	85
PID 2044 wrote to memory of 3160	2044	VirusShare_a91a9b39b94464b44184730ddf5c9ea2.exe	85
PID 2044 wrote to memory of 3160	2044	VirusShare_a91a9b39b94464b44184730ddf5c9ea2.exe	85
PID 2044 wrote to memory of 224	2044	VirusShare_a91a9b39b94464b44184730ddf5c9ea2.exe	86
PID 2044 wrote to memory of 224	2044	VirusShare_a91a9b39b94464b44184730ddf5c9ea2.exe	86
PID 2044 wrote to memory of 224	2044	VirusShare_a91a9b39b94464b44184730ddf5c9ea2.exe	86
PID 2044 wrote to memory of 2760	2044	VirusShare_a91a9b39b94464b44184730ddf5c9ea2.exe	87
PID 2044 wrote to memory of 2760	2044	VirusShare_a91a9b39b94464b44184730ddf5c9ea2.exe	87
PID 2044 wrote to memory of 2760	2044	VirusShare_a91a9b39b94464b44184730ddf5c9ea2.exe	87
PID 224 wrote to memory of 452	224	setup.exe	88
PID 224 wrote to memory of 452	224	setup.exe	88
PID 224 wrote to memory of 452	224	setup.exe	88
PID 2760 wrote to memory of 5064	2760	Update.exe	89
PID 2760 wrote to memory of 5064	2760	Update.exe	89
PID 2760 wrote to memory of 5064	2760	Update.exe	89
PID 2760 wrote to memory of 5064	2760	Update.exe	89
PID 2760 wrote to memory of 2984	2760	Update.exe	90
PID 2760 wrote to memory of 2984	2760	Update.exe	90
PID 2760 wrote to memory of 2984	2760	Update.exe	90
PID 2760 wrote to memory of 2984	2760	Update.exe	90
PID 2760 wrote to memory of 2912	2760	Update.exe	96
PID 2760 wrote to memory of 2912	2760	Update.exe	96
PID 2760 wrote to memory of 2912	2760	Update.exe	96
PID 2760 wrote to memory of 2912	2760	Update.exe	96
PID 3160 wrote to memory of 528	3160	Audio.exe	97
PID 3160 wrote to memory of 528	3160	Audio.exe	97
PID 3160 wrote to memory of 528	3160	Audio.exe	97
PID 528 wrote to memory of 4608	528	cmd.exe	99
PID 528 wrote to memory of 4608	528	cmd.exe	99
PID 528 wrote to memory of 4608	528	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\VirusShare_a91a9b39b94464b44184730ddf5c9ea2.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_a91a9b39b94464b44184730ddf5c9ea2.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Users\Admin\AppData\Local\Temp\Audio.exe
  "C:\Users\Admin\AppData\Local\Temp\Audio.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\System32\cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:528
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      Modifies registry key
      PID:4608
- C:\Users\Admin\AppData\Local\Temp\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:224
- - C:\Users\Admin\AppData\Local\Temp\GLB41BC.tmp
    C:\Users\Admin\AppData\Local\Temp\GLB41BC.tmp 4736 C:\Users\Admin\AppData\Local\Temp\setup.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    PID:452
- C:\Users\Admin\AppData\Local\Temp\Update.exe
  "C:\Users\Admin\AppData\Local\Temp\Update.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - Modifies WinLogon for persistence
    - Modifies Installed Components in the registry
    - Adds Run key to start application
    PID:5064
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    PID:2984
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 12
      4⤵
      Program crash
      PID:4304
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 32
      4⤵
      Program crash
      PID:2780
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2984 -ip 2984
1⤵
PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2984 -ip 2984
1⤵
PID:4560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Audio.exe

Path C:\Users\Admin\AppData\Local\Temp\Audio.exe
Size 179KB
SHA256 30812fdfa5b8becc827a632c55f61876ab6b8cd86b9046631a4083bb7290e399
MD5 1da15a41d35b860551f79024d786f519
SHA1 860bc51df0029cff0532659943d696009b894771
SHA512 1d292f1d6566afde75a367e63f64ee7e9fc6a7bf7137e6c7c2dfa3cd11e7271455926bcd8d98653454e9af0695ac4afa765b70e2f6e6b7d8c12b420a8606cb32
SSDEEP 1536:Q4KHFxF+LK82iFW/Py2PhBzgnvc3M3leJcaOtOdTl6Zq7hMZJ5BI:1aFxyK82i4//PhBzgnkalUTl6ZMcrBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

GLB41BC.tmp

Path C:\Users\Admin\AppData\Local\Temp\GLB41BC.tmp
Size 70KB
SHA256 2aba4c054e4145d684c4814b9311a1fdcf42485a268c945a589afddbec006246
MD5 9c4e4277bf7f56318301bcf62452c8e6
SHA1 2092162aada654516ae70b1cf75d0b36964f8716
SHA512 480576de39cd31529546e6f06eea6fea415d55ec54c1b835493ea23ed220ebf43cff2ab6301d39aed275a4664a7bb47bb9bce3bc37256d31dc1bb7e724e19b3d
SSDEEP 1536:3giiJZEE8Wkluxv5jRkGGYFwetgEMh4XWS7rS52+/PgSyTh/w:3sJ6E827kkFwYMemL5PHGTS
MD5 SHA1 SHA512 SSDEEP

Submit Download

GLC4249.tmp

Path C:\Users\Admin\AppData\Local\Temp\GLC4249.tmp
Size 161KB
SHA256 9200949ab6f777df957fc524d4733e2cb47b89a209c07d2be57b4c63cecbf766
MD5 263e81631fb67194dc968dc3f4bdb4e7
SHA1 2998697c503a542d5cf1e25a0d0df18fcd38d66c
SHA512 2eb6fd28ba87f193a35f1c4bd4c6ff29495a3c10fea8bfa0506df97fcae5ca16f2617703137ecb32cf6b7dbd3048507dd4d0c7418845cfdce5c43896aec45dbb
SSDEEP 3072:2mCjwKxGoN9KnL8GGoYMavfrObsJXslyR6J7oo5Gpe/e:NC0K4oNcnL8pdJ3Sb6XjRcGpYe
MD5 SHA1 SHA512 SSDEEP

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\Temp\Update.exe
Size 45KB
SHA256 8070c926913db533326ef061dffca76550bfe9139a60365be604ca2fcef766eb
MD5 76ba75a7ce68516f5e2a76031e5ec185
SHA1 399bed8aef82a85702c48ef3f15c46005fc15979
SHA512 e7caf3284e2668cc52b976b063ac87ffb09b46ec7b2900dfee87a9d0ea95110b3cc11751de942f254f8962b320be49a5866a120dbc971600a60f3f55ecbc4f54
SSDEEP 768:9Br+tjFY90iY6W1jwmDzKgEFQXaklMIAnH8hwfOgw0cYzo4aXJ:jyRh31jxPEFQXak+H84bVo5J
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\setup.exe
Size 2.6MB
SHA256 df13cc50a687c76718dd31c5b5b24fbeb481010c840dc17fca6888fc3679d002
MD5 f1a5e2544a09300d88f82f42ce20a1c5
SHA1 f0700245174c11964cd24839d6d1a9e8ee585a91
SHA512 757e7db69fc7d1556d4c94abca419dd223beb7ccd162df87a81f9333cd268bab148ff6bbcffb000ce59b054f7b662fe8d58157aef811f34ec977408b9d998f84
SSDEEP 49152:pJMd+jp3WlLuFdf37Cc2mV+HiEwqZF1HvG5jIZgkhU+VQ31oX:XqwUtufTCcTVcfz1HvSInIoX
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\setup.exe
Size 1.5MB
SHA256 424e5dbb23977220abb0867dee308a04a7934dee4f8cf5e837c073ff1161fa3e
MD5 d7fe767c8aa03be3d2d9cb3bddb1c8dd
SHA1 59c526a40c96ada72615a8efedef3bbfca5ea0bc
SHA512 8b0d7dc43f66e94ad964871dc2d6ab64079dffbe07002715bce121b472fe767a6baaff0026bc6cec2144e729124b127a02a40982b317b20f1c08b16e3740ba87
SSDEEP 24576:zNHJduFt5suBIb+Mp5FWlLuq9Edf35jRClc72ma2+c8Hi85zG5rgkt3GnJekJZ9I:pJMd+jp3WlLuFdf37Cc2mV+HiEwqZF1u
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\setup.exe
Size 1.2MB
SHA256 c0aef8e02c85478902be84bc998f1956e3bd66cffa9b9aa23ba0a5275e338fda
MD5 ae0d0e3e5b32ff9f838b08d55a53e6b2
SHA1 6a4836e23e5becde02e2c3bafa93bfce9bc09fe0
SHA512 b5c2eb3f0e9c3a82b1ac83ce67456018825d18580ae46ee85f1965e51e02f67d0b67d8cc1ff53517abbc1c4b0316a2b9c80bb861e88f3c8e01a2eaa4fe20506a
SSDEEP 24576:zNHJduFt5suBIb+Mp5FWlLuq9Edf35jRClc72ma2+c8Hi85zG5rgkt3GnJekJZ8:pJMd+jp3WlLuFdf37Cc2mV+HiEwqZ8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2760-59-0x0000000000C80000-0x0000000000C93000-memory.dmp

Download

memory/2912-61-0x0000000000C80000-0x0000000000C93000-memory.dmp

Download

memory/2912-58-0x0000000000C80000-0x0000000000C93000-memory.dmp

Download

memory/2984-52-0x0000000000C80000-0x0000000000C93000-memory.dmp

Download

memory/3160-64-0x00000000015F0000-0x0000000001600000-memory.dmp

Download

memory/3160-39-0x00000000015F0000-0x0000000001600000-memory.dmp

Download

memory/3160-36-0x0000000073AA0000-0x0000000074051000-memory.dmp

Download

memory/3160-21-0x0000000073AA0000-0x0000000074051000-memory.dmp

Download

memory/3160-63-0x00000000015F0000-0x0000000001600000-memory.dmp

Download

memory/3160-65-0x0000000073AA0000-0x0000000074051000-memory.dmp

Download

memory/3160-66-0x0000000073AA0000-0x0000000074051000-memory.dmp

Download

memory/3160-67-0x00000000015F0000-0x0000000001600000-memory.dmp

Download

memory/3160-68-0x00000000015F0000-0x0000000001600000-memory.dmp

Download

memory/3160-69-0x00000000015F0000-0x0000000001600000-memory.dmp

Download

memory/5064-50-0x0000000000C80000-0x0000000000C93000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads