xtremerat | ba86f2acb4fc314a125068e04fb4d60bafb03a3ca37e31b5d01ebc50bf2e90b9

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 19:18

Target

c16540c3dfeff2d394298bfe9d93c043.exe
Size

85KB
MD5

c16540c3dfeff2d394298bfe9d93c043
SHA1

18646f757dae56bf69295596db1c09fa907d79f8
SHA256

ba86f2acb4fc314a125068e04fb4d60bafb03a3ca37e31b5d01ebc50bf2e90b9
SHA512

15378cd0c33285fdc5bcfd6e571b5773fa15670d9657cdc63e0654e1f0979df35eb8e4e199ee3aa8093b1350c327b7c6fef85d92c614f16adebea752619e05dc
SSDEEP

768:28m1Sq4NQErBsH10zoisBKQI6dObAG/dq8uW29Ifnca/yyR+P2ujfGiZKPA+7Xoh:Esq+QVnrObAdXWpf/y+7ozNwiGfEftog

Score

10^/10

Detect XtremeRAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/1512-0-0x0000000010000000-0x000000001004F000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2336	1512	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 2336	1512	c16540c3dfeff2d394298bfe9d93c043.exe	28
PID 1512 wrote to memory of 2336	1512	c16540c3dfeff2d394298bfe9d93c043.exe	28
PID 1512 wrote to memory of 2336	1512	c16540c3dfeff2d394298bfe9d93c043.exe	28
PID 1512 wrote to memory of 2336	1512	c16540c3dfeff2d394298bfe9d93c043.exe	28

C:\Users\Admin\AppData\Local\Temp\c16540c3dfeff2d394298bfe9d93c043.exe
"C:\Users\Admin\AppData\Local\Temp\c16540c3dfeff2d394298bfe9d93c043.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 164
  2⤵
  - Program crash
  PID:2336

memory/1512-0-0x0000000010000000-0x000000001004F000-memory.dmp

Filesize
316KB

Download