xtremerat | 48cfbdeb4600dfd22582198b12d32538385f7a4f361281161892ff0ae2f9ccaf

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21/03/2024, 18:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dc5362b9b39cf550b34c1272fe15b355.exe
Size 269KB
Sample240321-w7aszagf2y
SHA256 48cfbdeb4600dfd22582198b12d32538385f7a4f361281161892ff0ae2f9ccaf
MD5 dc5362b9b39cf550b34c1272fe15b355
SHA1 6c60bda81bd19686165f8c2070e6e8e1a32948d5
SHA512 f45ba811f2c9072d7b54ace3bbc26295d72ba10c639e3dcc9ef986761caad660933d0bba8c24fcc3c9fb7f67901ce284a38daec4d84249fe22bef6a23a29e0ff
SSDEEP 3072:G/v7xIj0jsCpbqpu+IDzyyJRCvxe1ddRa53apZF8a4EvsagMGh0HDF++4B5hiSnu:MdJjrpRqrXaJ/15++shXhGTNKq8dR3Ra
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Extracted

Family

xtremerat

somee.no-ip.biz

Signatures

Detect XtremeRAT payload 4 IoCs

resource	yara_rule
behavioral2/memory/4808-27-0x0000000000C80000-0x0000000000CE1000-memory.dmp	family_xtremerat
behavioral2/memory/4348-29-0x0000000000C80000-0x0000000000CE1000-memory.dmp	family_xtremerat
behavioral2/memory/2020-30-0x0000000000C80000-0x0000000000CE1000-memory.dmp	family_xtremerat
behavioral2/memory/4348-32-0x0000000000C80000-0x0000000000CE1000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1B3H462O-2D4U-1FBK-5IM1-QWQ763MI2XG1}	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1B3H462O-2D4U-1FBK-5IM1-QWQ763MI2XG1}\StubPath = "C:\\Windows\\system32\\InstallDir\\Server.exe restart"	server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1B3H462O-2D4U-1FBK-5IM1-QWQ763MI2XG1}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1B3H462O-2D4U-1FBK-5IM1-QWQ763MI2XG1}\StubPath = "C:\\Windows\\system32\\InstallDir\\Server.exe restart"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	dc5362b9b39cf550b34c1272fe15b355.exe

Executes dropped EXE 1 IoCs

pid	Process
2020	server.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00080000000231f8-16.dat	upx
behavioral2/memory/2020-19-0x0000000000C80000-0x0000000000CE1000-memory.dmp	upx
behavioral2/memory/4808-27-0x0000000000C80000-0x0000000000CE1000-memory.dmp	upx
behavioral2/memory/4348-29-0x0000000000C80000-0x0000000000CE1000-memory.dmp	upx
behavioral2/memory/2020-30-0x0000000000C80000-0x0000000000CE1000-memory.dmp	upx
behavioral2/memory/4348-32-0x0000000000C80000-0x0000000000CE1000-memory.dmp	upx

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	dc5362b9b39cf550b34c1272fe15b355.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	dc5362b9b39cf550b34c1272fe15b355.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\InstallDir\Server.exe	server.exe
File created	C:\Windows\SysWOW64\InstallDir\Server.exe	server.exe
File opened for modification	C:\Windows\SysWOW64\InstallDir\	server.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	dc5362b9b39cf550b34c1272fe15b355.exe
File created	C:\Windows\assembly\Desktop.ini	dc5362b9b39cf550b34c1272fe15b355.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	dc5362b9b39cf550b34c1272fe15b355.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1636	dc5362b9b39cf550b34c1272fe15b355.exe
Token: 33	1636	dc5362b9b39cf550b34c1272fe15b355.exe
Token: SeIncBasePriorityPrivilege	1636	dc5362b9b39cf550b34c1272fe15b355.exe
Token: 33	1636	dc5362b9b39cf550b34c1272fe15b355.exe
Token: SeIncBasePriorityPrivilege	1636	dc5362b9b39cf550b34c1272fe15b355.exe
Token: 33	1636	dc5362b9b39cf550b34c1272fe15b355.exe
Token: SeIncBasePriorityPrivilege	1636	dc5362b9b39cf550b34c1272fe15b355.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4348	explorer.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2020	1636	dc5362b9b39cf550b34c1272fe15b355.exe	91
PID 1636 wrote to memory of 2020	1636	dc5362b9b39cf550b34c1272fe15b355.exe	91
PID 1636 wrote to memory of 2020	1636	dc5362b9b39cf550b34c1272fe15b355.exe	91
PID 2020 wrote to memory of 4808	2020	server.exe	92
PID 2020 wrote to memory of 4808	2020	server.exe	92
PID 2020 wrote to memory of 4808	2020	server.exe	92
PID 2020 wrote to memory of 4808	2020	server.exe	92
PID 2020 wrote to memory of 4348	2020	server.exe	93
PID 2020 wrote to memory of 4348	2020	server.exe	93
PID 2020 wrote to memory of 4348	2020	server.exe	93
PID 2020 wrote to memory of 4348	2020	server.exe	93

C:\Users\Admin\AppData\Local\Temp\dc5362b9b39cf550b34c1272fe15b355.exe
"C:\Users\Admin\AppData\Local\Temp\dc5362b9b39cf550b34c1272fe15b355.exe"
1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Users\Admin\AppData\Local\Temp\server.exe
  "C:\Users\Admin\AppData\Local\Temp\server.exe"
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - Modifies Installed Components in the registry
    PID:4808
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:4348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

server.exe

Path C:\Users\Admin\AppData\Local\Temp\server.exe
Size 165KB
SHA256 37bb3e1193f4684934a8cf62a68ffde17d044e5f6af3c2f7d6370f7e48b50a6d
MD5 a51f1b4db4bdd656d0c31bc77f1e9a79
SHA1 f2a3e3f725a985d7d24b66bed17cb37f3c05105c
SHA512 8fb4ae8042a887dadb9b7a07b50e61735a75447896c24d28aaa5f811680f4db517ee606d1b1899a00c8a57104ba2ada09666cad9814abb4384ca5b22a424aaae
SSDEEP 3072:QtFw9Whx/qD9iFtgJOE1JLQybTzmJGopTe9YTHu/hz:Qrworq5i/urbTy4eOAHI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1636-10-0x0000000001030000-0x0000000001038000-memory.dmp

Download

memory/1636-33-0x00007FFD317A0000-0x00007FFD32141000-memory.dmp

Download

memory/1636-3-0x00007FFD317A0000-0x00007FFD32141000-memory.dmp

Download

memory/1636-4-0x0000000001040000-0x000000000104A000-memory.dmp

Download

memory/1636-7-0x000000001C080000-0x000000001C090000-memory.dmp

Download

memory/1636-8-0x000000001C1A0000-0x000000001C246000-memory.dmp

Download

memory/1636-9-0x000000001C350000-0x000000001C3EC000-memory.dmp

Download

memory/1636-0-0x00007FFD317A0000-0x00007FFD32141000-memory.dmp

Download

memory/1636-2-0x0000000001070000-0x0000000001080000-memory.dmp

Download

memory/1636-11-0x000000001C5E0000-0x000000001C62C000-memory.dmp

Download

memory/1636-1-0x000000001BA80000-0x000000001BF4E000-memory.dmp

Download

memory/1636-35-0x0000000001070000-0x0000000001080000-memory.dmp

Download

memory/1636-34-0x0000000001070000-0x0000000001080000-memory.dmp

Download

memory/2020-19-0x0000000000C80000-0x0000000000CE1000-memory.dmp

Download

memory/2020-30-0x0000000000C80000-0x0000000000CE1000-memory.dmp

Download

memory/4348-32-0x0000000000C80000-0x0000000000CE1000-memory.dmp

Download

memory/4348-29-0x0000000000C80000-0x0000000000CE1000-memory.dmp

Download

memory/4808-27-0x0000000000C80000-0x0000000000CE1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads