xtremerat | 18604b855e5f212b6c47919e5ba536afdf7982e770c642ca8384656ed8cf1768

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 18:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b80a57ce75d8c832ac8a8a36c937fa79.exe
Size 96KB
Sample240306-wref8afe6t
SHA256 18604b855e5f212b6c47919e5ba536afdf7982e770c642ca8384656ed8cf1768
MD5 b80a57ce75d8c832ac8a8a36c937fa79
SHA1 b1633673294bd47f9347ac5ae0e36310417373c7
SHA512 bfc9f57eca15430555aaf10c6d154239f157b3061c1b215b4ff1f3ca0436dc5acfabb039ed8ce62d856cd3912fd0b222a9bac316ede507e86587ab260a8c4f26
SSDEEP 1536:04Ufn6t1S89JBfKaub8WaR2XWkgiV22z4/uxCSRrs7thPALSLZGKRsa:04mnTMJJKaubpaRSgiV3uuk8A7P8SdGq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Signatures

Detect XtremeRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/1520-3-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1964 set thread context of 1520	1964	b80a57ce75d8c832ac8a8a36c937fa79.exe	87

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1124	1520	WerFault.exe	87

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1520	1964	b80a57ce75d8c832ac8a8a36c937fa79.exe	87
PID 1964 wrote to memory of 1520	1964	b80a57ce75d8c832ac8a8a36c937fa79.exe	87
PID 1964 wrote to memory of 1520	1964	b80a57ce75d8c832ac8a8a36c937fa79.exe	87
PID 1964 wrote to memory of 1520	1964	b80a57ce75d8c832ac8a8a36c937fa79.exe	87
PID 1964 wrote to memory of 1520	1964	b80a57ce75d8c832ac8a8a36c937fa79.exe	87
PID 1964 wrote to memory of 1520	1964	b80a57ce75d8c832ac8a8a36c937fa79.exe	87
PID 1964 wrote to memory of 1520	1964	b80a57ce75d8c832ac8a8a36c937fa79.exe	87
PID 1964 wrote to memory of 1520	1964	b80a57ce75d8c832ac8a8a36c937fa79.exe	87
PID 1964 wrote to memory of 1520	1964	b80a57ce75d8c832ac8a8a36c937fa79.exe	87
PID 1964 wrote to memory of 1520	1964	b80a57ce75d8c832ac8a8a36c937fa79.exe	87
PID 1964 wrote to memory of 1520	1964	b80a57ce75d8c832ac8a8a36c937fa79.exe	87
PID 1964 wrote to memory of 1520	1964	b80a57ce75d8c832ac8a8a36c937fa79.exe	87
PID 1964 wrote to memory of 1520	1964	b80a57ce75d8c832ac8a8a36c937fa79.exe	87

C:\Users\Admin\AppData\Local\Temp\b80a57ce75d8c832ac8a8a36c937fa79.exe
"C:\Users\Admin\AppData\Local\Temp\b80a57ce75d8c832ac8a8a36c937fa79.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  PID:1520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 12
    3⤵
    - Program crash
    PID:1124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1520 -ip 1520
1⤵
PID:940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1520-3-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/1964-0-0x0000000074610000-0x0000000074BC1000-memory.dmp

Download

memory/1964-1-0x0000000074610000-0x0000000074BC1000-memory.dmp

Download

memory/1964-2-0x0000000001600000-0x0000000001610000-memory.dmp

Download

memory/1964-5-0x0000000074610000-0x0000000074BC1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads