xtremerat | 434457ba75acc68d61236ead417f5552d50b9168d2405d45ea293557c77c999f

General

Target
139123643ef60464b05381961b15f899.exe
Size 296KB
Sample240628-bysl7steqa
SHA256 434457ba75acc68d61236ead417f5552d50b9168d2405d45ea293557c77c999f
MD5 139123643ef60464b05381961b15f899
SHA1 85e4bd423feff677f124bd098c2280545d59eb47
SHA512 de3636adcacf3b4ea260e210692a6c898d0f618495ae711e2943f1ebd5bcc3aa6063fb8f04166e09c92062ffd85bfcd72c9f76cd4b5461e38a9e3e34b587e744
SSDEEP 1536:XbA36S1au3I9IctmOjUYM05fHkSA+FmJ7TBtsj5KtQEyu:Xk6SMukjUYRkP+FmJ7Vt++l
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Detect XtremeRAT payload 8 IoCs

resource	yara_rule
behavioral2/memory/3076-2-0x0000000010000000-0x0000000010047000-memory.dmp	family_xtremerat
behavioral2/memory/3076-4-0x0000000010000000-0x0000000010047000-memory.dmp	family_xtremerat
behavioral2/memory/3076-3-0x0000000010000000-0x0000000010047000-memory.dmp	family_xtremerat
behavioral2/memory/3076-5-0x0000000010000000-0x0000000010047000-memory.dmp	family_xtremerat
behavioral2/memory/4772-6-0x0000000010000000-0x0000000010047000-memory.dmp	family_xtremerat
behavioral2/memory/3076-8-0x0000000010000000-0x0000000010047000-memory.dmp	family_xtremerat
behavioral2/memory/4772-9-0x0000000010000000-0x0000000010047000-memory.dmp	family_xtremerat
behavioral2/memory/3076-10-0x0000000010000000-0x0000000010047000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

Active Setup

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	139123643ef60464b05381961b15f899.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	139123643ef60464b05381961b15f899.EXE

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	139123643ef60464b05381961b15f899.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	139123643ef60464b05381961b15f899.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4708 set thread context of 3076	4708	139123643ef60464b05381961b15f899.exe	81

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InstallDir\Server.exe	139123643ef60464b05381961b15f899.EXE
File created	C:\Windows\InstallDir\Server.exe	139123643ef60464b05381961b15f899.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3360	4772	WerFault.exe	82
2232	4772	WerFault.exe	82

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4708	139123643ef60464b05381961b15f899.exe
3076	139123643ef60464b05381961b15f899.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 3076	4708	139123643ef60464b05381961b15f899.exe	81
PID 4708 wrote to memory of 3076	4708	139123643ef60464b05381961b15f899.exe	81
PID 4708 wrote to memory of 3076	4708	139123643ef60464b05381961b15f899.exe	81
PID 4708 wrote to memory of 3076	4708	139123643ef60464b05381961b15f899.exe	81
PID 4708 wrote to memory of 3076	4708	139123643ef60464b05381961b15f899.exe	81
PID 4708 wrote to memory of 3076	4708	139123643ef60464b05381961b15f899.exe	81
PID 4708 wrote to memory of 3076	4708	139123643ef60464b05381961b15f899.exe	81
PID 4708 wrote to memory of 3076	4708	139123643ef60464b05381961b15f899.exe	81
PID 4708 wrote to memory of 3076	4708	139123643ef60464b05381961b15f899.exe	81
PID 4708 wrote to memory of 3076	4708	139123643ef60464b05381961b15f899.exe	81
PID 4708 wrote to memory of 3076	4708	139123643ef60464b05381961b15f899.exe	81
PID 4708 wrote to memory of 3076	4708	139123643ef60464b05381961b15f899.exe	81
PID 4708 wrote to memory of 3076	4708	139123643ef60464b05381961b15f899.exe	81
PID 3076 wrote to memory of 4772	3076	139123643ef60464b05381961b15f899.EXE	82
PID 3076 wrote to memory of 4772	3076	139123643ef60464b05381961b15f899.EXE	82
PID 3076 wrote to memory of 4772	3076	139123643ef60464b05381961b15f899.EXE	82
PID 3076 wrote to memory of 4772	3076	139123643ef60464b05381961b15f899.EXE	82