xtremerat | c4a11f68afd50e9e3f494522c8a14fc8b824224741d73cc576871a192fd41d78

General

Target
b186d8586fcff7554d677c4ed9035dd6.exe
Size 26KB
Sample240304-h2ps2scf5z
SHA256 c4a11f68afd50e9e3f494522c8a14fc8b824224741d73cc576871a192fd41d78
MD5 b186d8586fcff7554d677c4ed9035dd6
SHA1 6d342b9dd97bbe0cc62e46a247540d87c32608c2
SHA512 586aafc38dcd2da657a27c4ed51426e89a20c85e63f5f0b8d084eda61ef7d66293f4144378b096c397ac54dc2a9c5dc4e7f87d1a403c24f87321fff69c930e02
SSDEEP 384:Spj7eNmfp+UrM8j3Mk8mw2Qwz9cEVWNuOuuOYPq8P9iYwbzuRExgJpIuP414r3:fmfpbM8j8wQwz9caAuxYyuDExEpIuP4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

Detect XtremeRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/4580-4-0x0000000013140000-0x000000001315F000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	b186d8586fcff7554d677c4ed9035dd6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	b186d8586fcff7554d677c4ed9035dd6.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4580-0-0x0000000013140000-0x000000001315F000-memory.dmp	upx
behavioral2/memory/4580-4-0x0000000013140000-0x000000001315F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	b186d8586fcff7554d677c4ed9035dd6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	b186d8586fcff7554d677c4ed9035dd6.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InstallDir\Server.exe	b186d8586fcff7554d677c4ed9035dd6.exe
File created	C:\Windows\InstallDir\Server.exe	b186d8586fcff7554d677c4ed9035dd6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 228	4580	b186d8586fcff7554d677c4ed9035dd6.exe	87
PID 4580 wrote to memory of 228	4580	b186d8586fcff7554d677c4ed9035dd6.exe	87
PID 4580 wrote to memory of 228	4580	b186d8586fcff7554d677c4ed9035dd6.exe	87
PID 4580 wrote to memory of 208	4580	b186d8586fcff7554d677c4ed9035dd6.exe	91
PID 4580 wrote to memory of 208	4580	b186d8586fcff7554d677c4ed9035dd6.exe	91
PID 4580 wrote to memory of 208	4580	b186d8586fcff7554d677c4ed9035dd6.exe	91
PID 4580 wrote to memory of 3208	4580	b186d8586fcff7554d677c4ed9035dd6.exe	92
PID 4580 wrote to memory of 3208	4580	b186d8586fcff7554d677c4ed9035dd6.exe	92
PID 4580 wrote to memory of 3208	4580	b186d8586fcff7554d677c4ed9035dd6.exe	92
PID 4580 wrote to memory of 5096	4580	b186d8586fcff7554d677c4ed9035dd6.exe	93
PID 4580 wrote to memory of 5096	4580	b186d8586fcff7554d677c4ed9035dd6.exe	93
PID 4580 wrote to memory of 5096	4580	b186d8586fcff7554d677c4ed9035dd6.exe	93
PID 4580 wrote to memory of 4872	4580	b186d8586fcff7554d677c4ed9035dd6.exe	95
PID 4580 wrote to memory of 4872	4580	b186d8586fcff7554d677c4ed9035dd6.exe	95
PID 4580 wrote to memory of 4872	4580	b186d8586fcff7554d677c4ed9035dd6.exe	95
PID 4580 wrote to memory of 3296	4580	b186d8586fcff7554d677c4ed9035dd6.exe	97
PID 4580 wrote to memory of 3296	4580	b186d8586fcff7554d677c4ed9035dd6.exe	97
PID 4580 wrote to memory of 3296	4580	b186d8586fcff7554d677c4ed9035dd6.exe	97
PID 4580 wrote to memory of 2352	4580	b186d8586fcff7554d677c4ed9035dd6.exe	98
PID 4580 wrote to memory of 2352	4580	b186d8586fcff7554d677c4ed9035dd6.exe	98
PID 4580 wrote to memory of 2352	4580	b186d8586fcff7554d677c4ed9035dd6.exe	98
PID 4580 wrote to memory of 2552	4580	b186d8586fcff7554d677c4ed9035dd6.exe	99
PID 4580 wrote to memory of 2552	4580	b186d8586fcff7554d677c4ed9035dd6.exe	99

C:\Users\Admin\AppData\Local\Temp\b186d8586fcff7554d677c4ed9035dd6.exe
"C:\Users\Admin\AppData\Local\Temp\b186d8586fcff7554d677c4ed9035dd6.exe"
1⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2552