xtremerat | 2bb2c4be0651f02370e5da09829c904eaa193fa0c041f9e3b0820a40cd56b613

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-04-2024 01:06

Target

2bb2c4be0651f02370e5da09829c904eaa193fa0c041f9e3b0820a40cd56b613.exe
Size

309KB
MD5

6d0b197c5b4db07c0a1e434c99144ba9
SHA1

d6f959e7382ee28faa3ed2ea01a02368fc581cec
SHA256

2bb2c4be0651f02370e5da09829c904eaa193fa0c041f9e3b0820a40cd56b613
SHA512

f47613029c8d5888790f8a2eb89a610337c639a71ec91d4798a8c7b6180463e445c0d14cc4fb81ccf237f4679886a7988500734b188ed481dec3aaf3b5ecbb20
SSDEEP

1536:ksq+Q1aZQuIyJp0mgA+FJyHdAEAbLWLY:RY8QoQAEJqsLW

Score

10^/10

Family

xtremerat

hackercool.zapto.org

Detect XtremeRAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1820-0-0x0000000010000000-0x000000001004D479-memory.dmp	family_xtremerat
behavioral2/memory/1820-1-0x0000000010000000-0x000000001004D479-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

UPX dump on OEP (original entry point) 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1820-0-0x0000000010000000-0x000000001004D479-memory.dmp	UPX
behavioral2/memory/1820-1-0x0000000010000000-0x000000001004D479-memory.dmp	UPX

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/1820-0-0x0000000010000000-0x000000001004D479-memory.dmp	upx
behavioral2/memory/1820-1-0x0000000010000000-0x000000001004D479-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1624 1820 WerFault.exe 2bb2c4be0651f02370e5da09829c904eaa193fa0c041f9e3b0820a40cd56b613.exe

pid	pid_target	process	target process
1624	1820	WerFault.exe	2bb2c4be0651f02370e5da09829c904eaa193fa0c041f9e3b0820a40cd56b613.exe

C:\Users\Admin\AppData\Local\Temp\2bb2c4be0651f02370e5da09829c904eaa193fa0c041f9e3b0820a40cd56b613.exe
"C:\Users\Admin\AppData\Local\Temp\2bb2c4be0651f02370e5da09829c904eaa193fa0c041f9e3b0820a40cd56b613.exe"
1⤵
PID:1820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 456
  2⤵
  - Program crash
  PID:1624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1820 -ip 1820
1⤵
PID:4368

memory/1820-0-0x0000000010000000-0x000000001004D479-memory.dmp

Filesize
309KB

Download
memory/1820-1-0x0000000010000000-0x000000001004D479-memory.dmp

Filesize
309KB

Download