xtremerat | 4d7a327e4ea6564ffbfa727fd980f2d41a1582fd1edee25824e9eca55babf5d6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ccd2a0318aad47d51dd98d2136e1c644.exe
Size 65KB
Sample240316-cdr1lsah38
SHA256 4d7a327e4ea6564ffbfa727fd980f2d41a1582fd1edee25824e9eca55babf5d6
MD5 ccd2a0318aad47d51dd98d2136e1c644
SHA1 fb37f0395f997f43090f548a313f534e7e720b54
SHA512 435fbc220511afa6609abeac9e7d2550a87658566047198c6ead50665f068c6f5d1ff192bda20fe2297b2853f9d9f28e8712cc54b7e6b549f8ab6d5eb4027037
SSDEEP 768:e8m1Sq4NQErBsH1tzoisBKQI62ObAG/dqOXHsoAx5JXrUqLOY0pYKnA+7PoNweWo:ssq+QV4UObAdNoAf5UqiYmlArNweF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Extracted

Family

xtremerat

%themagician1970.no-ip.biz

Signatures

Detect XtremeRAT payload 3 IoCs

resource	yara_rule
behavioral2/memory/4724-0-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/2180-1-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/4724-2-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
672	4724	WerFault.exe	89
3024	4724	WerFault.exe	89

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 4724	2180	ccd2a0318aad47d51dd98d2136e1c644.exe	89
PID 2180 wrote to memory of 4724	2180	ccd2a0318aad47d51dd98d2136e1c644.exe	89
PID 2180 wrote to memory of 4724	2180	ccd2a0318aad47d51dd98d2136e1c644.exe	89
PID 2180 wrote to memory of 4724	2180	ccd2a0318aad47d51dd98d2136e1c644.exe	89
PID 2180 wrote to memory of 3752	2180	ccd2a0318aad47d51dd98d2136e1c644.exe	90
PID 2180 wrote to memory of 3752	2180	ccd2a0318aad47d51dd98d2136e1c644.exe	90
PID 2180 wrote to memory of 3752	2180	ccd2a0318aad47d51dd98d2136e1c644.exe	90

C:\Users\Admin\AppData\Local\Temp\ccd2a0318aad47d51dd98d2136e1c644.exe
"C:\Users\Admin\AppData\Local\Temp\ccd2a0318aad47d51dd98d2136e1c644.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:4724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 476
    3⤵
    - Program crash
    PID:672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 488
    3⤵
    - Program crash
    PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4724 -ip 4724
1⤵
PID:3236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4724 -ip 4724
1⤵
PID:3216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2180-1-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/4724-0-0x0000000010000000-0x000000001004A000-memory.dmp

Download

memory/4724-2-0x0000000010000000-0x000000001004A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads