xtremerat | 0ec672a4bf4af17b52cf454c2a1304a9b146e7e543f7282abfa94cfe6e578fb0

Analysis

max time kernel
149s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 20:56

Target

0175ea6924fd8a96fc14c63e487efc20_NeikiAnalytics.exe
Size

65KB
MD5

0175ea6924fd8a96fc14c63e487efc20
SHA1

0b2521468684fd860141b550e9dd226f6d59802d
SHA256

0ec672a4bf4af17b52cf454c2a1304a9b146e7e543f7282abfa94cfe6e578fb0
SHA512

5d63dbb65c19e161c4600cfae2906e38633792e9d7ee8b693355460ce8762b06a56096ad367b30d6d9c5bd22bbf0f7702179d27e2c61400a12646ba97cfe0068
SSDEEP

768:88m1Sq4NQErBsH1tzoisBKQI6dObAG/dq8uW29Ifnca/yyR+P2ujfGiXsbs8HFPp:esq+QV4rObAdXWpf/y+YalR

Score

10^/10

Family

xtremerat

vicenpro.zapto.org

Detect XtremeRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1812-2-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/2188-3-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral1/memory/1812-4-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

0175ea6924fd8a96fc14c63e487efc20_NeikiAnalytics.exe

description	pid	process	target process
PID 2188 wrote to memory of 1812	2188	0175ea6924fd8a96fc14c63e487efc20_NeikiAnalytics.exe	svchost.exe
PID 2188 wrote to memory of 1812	2188	0175ea6924fd8a96fc14c63e487efc20_NeikiAnalytics.exe	svchost.exe
PID 2188 wrote to memory of 1812	2188	0175ea6924fd8a96fc14c63e487efc20_NeikiAnalytics.exe	svchost.exe
PID 2188 wrote to memory of 1812	2188	0175ea6924fd8a96fc14c63e487efc20_NeikiAnalytics.exe	svchost.exe
PID 2188 wrote to memory of 1812	2188	0175ea6924fd8a96fc14c63e487efc20_NeikiAnalytics.exe	svchost.exe
PID 2188 wrote to memory of 2868	2188	0175ea6924fd8a96fc14c63e487efc20_NeikiAnalytics.exe	iexplore.exe
PID 2188 wrote to memory of 2868	2188	0175ea6924fd8a96fc14c63e487efc20_NeikiAnalytics.exe	iexplore.exe
PID 2188 wrote to memory of 2868	2188	0175ea6924fd8a96fc14c63e487efc20_NeikiAnalytics.exe	iexplore.exe
PID 2188 wrote to memory of 2868	2188	0175ea6924fd8a96fc14c63e487efc20_NeikiAnalytics.exe	iexplore.exe
PID 2188 wrote to memory of 2868	2188	0175ea6924fd8a96fc14c63e487efc20_NeikiAnalytics.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\0175ea6924fd8a96fc14c63e487efc20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0175ea6924fd8a96fc14c63e487efc20_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:1812
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:2868

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1812-0-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1812-2-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/1812-4-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/2188-3-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download