xtremerat | b927b4cb3dbe1d16df1342c4b3b966f2d133d3a2338eac8f66b49f6d882804b7

General

Target
b20874aaeea56f89b9df659829d75ca9.exe
Size 168KB
Sample240304-ntn5faad92
SHA256 b927b4cb3dbe1d16df1342c4b3b966f2d133d3a2338eac8f66b49f6d882804b7
MD5 b20874aaeea56f89b9df659829d75ca9
SHA1 8ebd7f887ebc00087b61156e3adb5fabea8850fa
SHA512 e0365ed612082b2659021a97c0f3e8dc76d90b8cabb6bba57a3229fa4cc0f0ff5f53a485343d0924288d95fdb89aeac09f079e747ed6fb542de8129b69f1798d
SSDEEP 3072:pGCgP2gwtrP4dlpgc0qZ/RsZDGGewgnl0XbJmjeyZDGGewgNYamae0o:RMuZi/l9jZiOn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

Detect XtremeRAT payload 5 IoCs

resource	yara_rule
behavioral2/memory/4776-7-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/4776-8-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/4504-11-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/4776-12-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/4504-13-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4776-4-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/4776-6-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/4776-7-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/4776-8-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/4504-11-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/4776-12-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/4504-13-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\binary = "C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\randomizer.exe"	b20874aaeea56f89b9df659829d75ca9.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5004 set thread context of 4776	5004	b20874aaeea56f89b9df659829d75ca9.exe	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4756	4504	WerFault.exe	91
1100	4504	WerFault.exe	91

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5004	b20874aaeea56f89b9df659829d75ca9.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 4776	5004	b20874aaeea56f89b9df659829d75ca9.exe	88
PID 5004 wrote to memory of 4776	5004	b20874aaeea56f89b9df659829d75ca9.exe	88
PID 5004 wrote to memory of 4776	5004	b20874aaeea56f89b9df659829d75ca9.exe	88
PID 5004 wrote to memory of 4776	5004	b20874aaeea56f89b9df659829d75ca9.exe	88
PID 5004 wrote to memory of 4776	5004	b20874aaeea56f89b9df659829d75ca9.exe	88
PID 5004 wrote to memory of 4776	5004	b20874aaeea56f89b9df659829d75ca9.exe	88
PID 5004 wrote to memory of 4776	5004	b20874aaeea56f89b9df659829d75ca9.exe	88
PID 5004 wrote to memory of 4776	5004	b20874aaeea56f89b9df659829d75ca9.exe	88
PID 4776 wrote to memory of 4504	4776	b20874aaeea56f89b9df659829d75ca9.exe	91
PID 4776 wrote to memory of 4504	4776	b20874aaeea56f89b9df659829d75ca9.exe	91
PID 4776 wrote to memory of 4504	4776	b20874aaeea56f89b9df659829d75ca9.exe	91
PID 4776 wrote to memory of 4504	4776	b20874aaeea56f89b9df659829d75ca9.exe	91

C:\Users\Admin\AppData\Local\Temp\b20874aaeea56f89b9df659829d75ca9.exe
"C:\Users\Admin\AppData\Local\Temp\b20874aaeea56f89b9df659829d75ca9.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Users\Admin\AppData\Local\Temp\b20874aaeea56f89b9df659829d75ca9.exe
  C:\Users\Admin\AppData\Local\Temp\b20874aaeea56f89b9df659829d75ca9.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:4504
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 456
      4⤵
      Program crash
      PID:4756
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 480
      4⤵
      Program crash
      PID:1100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4504 -ip 4504
1⤵
PID:2764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4504 -ip 4504
1⤵
PID:1700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4504-11-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/4504-13-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/4776-4-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/4776-6-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/4776-7-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/4776-8-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

memory/4776-12-0x0000000000C80000-0x0000000000C95000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads