xtremerat | e0849ba088740afd3f09558cc1d9001b019f3bc4901563f5bc7bfedea2d38860

General

Target

982ec0a7e4cc9470cb6885b8d816fa45.exe
Size

956KB
MD5

982ec0a7e4cc9470cb6885b8d816fa45
SHA1

9c550995ab7251f60ad625e5d0251374e7ca73f6
SHA256

e0849ba088740afd3f09558cc1d9001b019f3bc4901563f5bc7bfedea2d38860
SHA512

9c5c7ae76d406057d75b7c64f776fdc5b519bbc4b0fa29c4263e41df097ef0a05e9b934ddd95fb65ba6d1e4bfb0672c395fb22ae4f0524169a0900f03b9be7fd
SSDEEP

12288:A/gctSVTWOWOdT/zvTjv95cTGMaqRL2nOxr/JZLYi8gPRyw7V57R8b8oOmn:A/FtATE67LjeJR7nV1k8Z0

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Extracted

Family

xtremerat

C2

goshare.dyndns.biz

Signatures

Detect XtremeRAT payload 4 IoCs

resource	yara_rule
behavioral1/memory/2684-12-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral1/memory/2728-15-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral1/memory/2684-16-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral1/memory/2728-22-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Executes dropped EXE 1 IoCs

pid	Process
2684	server.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00090000000142cc-9.dat	upx
behavioral1/memory/2684-12-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/2728-15-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/2684-16-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/2728-22-0x0000000010000000-0x000000001004D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3060	982ec0a7e4cc9470cb6885b8d816fa45.exe
3060	982ec0a7e4cc9470cb6885b8d816fa45.exe
3060	982ec0a7e4cc9470cb6885b8d816fa45.exe
3060	982ec0a7e4cc9470cb6885b8d816fa45.exe
3060	982ec0a7e4cc9470cb6885b8d816fa45.exe
3060	982ec0a7e4cc9470cb6885b8d816fa45.exe
3060	982ec0a7e4cc9470cb6885b8d816fa45.exe
3060	982ec0a7e4cc9470cb6885b8d816fa45.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3060	982ec0a7e4cc9470cb6885b8d816fa45.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2684	3060	982ec0a7e4cc9470cb6885b8d816fa45.exe	29
PID 3060 wrote to memory of 2684	3060	982ec0a7e4cc9470cb6885b8d816fa45.exe	29
PID 3060 wrote to memory of 2684	3060	982ec0a7e4cc9470cb6885b8d816fa45.exe	29
PID 3060 wrote to memory of 2684	3060	982ec0a7e4cc9470cb6885b8d816fa45.exe	29
PID 2684 wrote to memory of 2728	2684	server.exe	30
PID 2684 wrote to memory of 2728	2684	server.exe	30
PID 2684 wrote to memory of 2728	2684	server.exe	30
PID 2684 wrote to memory of 2728	2684	server.exe	30
PID 2684 wrote to memory of 2728	2684	server.exe	30
PID 2684 wrote to memory of 3052	2684	server.exe	31
PID 2684 wrote to memory of 3052	2684	server.exe	31
PID 2684 wrote to memory of 3052	2684	server.exe	31
PID 2684 wrote to memory of 3052	2684	server.exe	31
PID 2684 wrote to memory of 3052	2684	server.exe	31

C:\Users\Admin\AppData\Local\Temp\982ec0a7e4cc9470cb6885b8d816fa45.exe
"C:\Users\Admin\AppData\Local\Temp\982ec0a7e4cc9470cb6885b8d816fa45.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Users\Admin\AppData\Local\Temp\server.exe
  "C:\Users\Admin\AppData\Local\Temp\server.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2728
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\server.exe

Filesize
33KB

MD5
687476c1c257083237b9c35c78c991f2

SHA1
792778a5488896d20f6598730dd62b66b2807699

SHA256
63f92f378777374ec67301a0e519694083ad9961ef64d07d69653c4f2444e52e

SHA512
73d829223bba35bf4d0bf22ce01b83b1fb5e782dfdaf5746c3e78af5d424f15448d1a2e9cd9a79f8e792bd18b2da657b326f88cb1644d8a2adbbd393f1f17bf9

Download Submit
memory/2684-16-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2684-12-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2728-13-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2728-15-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2728-22-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/3060-2-0x000007FEF5CD0000-0x000007FEF666D000-memory.dmp

Filesize
9.6MB

Download
memory/3060-3-0x00000000006F0000-0x0000000000744000-memory.dmp

Filesize
336KB

Download
memory/3060-4-0x00000000020D0000-0x0000000002150000-memory.dmp

Filesize
512KB

Download
memory/3060-1-0x00000000020D0000-0x0000000002150000-memory.dmp

Filesize
512KB

Download
memory/3060-0-0x000007FEF5CD0000-0x000007FEF666D000-memory.dmp

Filesize
9.6MB

Download
memory/3060-21-0x00000000020D0000-0x0000000002150000-memory.dmp

Filesize
512KB

Download
memory/3060-20-0x000007FEF5CD0000-0x000007FEF666D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing