xtremerat | fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222

General

Target

fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe
Size

2.2MB
MD5

5ddbadc6f921bba27a37344cb4592630
SHA1

ccb97f90cdad3d4b114b294a3d0b46912b131b1a
SHA256

fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222
SHA512

5e74c48f4d6ba1f88f9bc4cca7370e537fe593b95acbb37f5c6a112d96b1f1f76d8a7c24595ccbb00f6525a9e897d14faab4b72f0a76b3d8a2261aacffcdc761
SSDEEP

49152:jhbmmP3okl2d47ZDmNpgkWMzvKi5TJfszSNG1f16IAE9ZqxAv6:ZmmvoN6GgkWUv15TVsONG1f1lXJv6

Score

10^/10

xtremerat discovery persistence rat spyware

Malware Config

Extracted

Family

xtremerat

C2

no.myftp.org

Signatures

Detect XtremeRAT payload 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3040-2-0x0000000010000000-0x0000000010263000-memory.dmp	family_xtremerat
behavioral1/memory/2056-8-0x0000000010000000-0x0000000010263000-memory.dmp	family_xtremerat
behavioral1/memory/944-13-0x0000000010000000-0x0000000010263000-memory.dmp	family_xtremerat
behavioral1/memory/2056-18-0x0000000010000000-0x0000000010263000-memory.dmp	family_xtremerat
C:\Windows\SysWOW64\InstallDir\Scalc.exe	family_xtremerat
behavioral1/memory/3040-21-0x0000000010000000-0x0000000010263000-memory.dmp	family_xtremerat
behavioral1/memory/2056-22-0x0000000010000000-0x0000000010263000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Xtremerat family
xtremerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

Processes:

calc.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	calc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\system32\\InstallDir\\Scalc.exe restart"	calc.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\system32\\InstallDir\\Scalc.exe"	svchost.exe

Executes dropped EXE 1 IoCs

Processes:

150MailCracker.exe

pid process

2456 150MailCracker.exe
Loads dropped DLL 1 IoCs

Processes:

fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe

pid process

944 fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe

pid	process
2456	150MailCracker.exe

pid	process
944	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.execalc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\Scalc.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\Scalc.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\Scalc.exe"	calc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\Scalc.exe"	calc.exe

Drops file in System32 directory 4 IoCs

Processes:

calc.exefc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\InstallDir\Scalc.exe	calc.exe
File created	C:\Windows\SysWOW64\InstallDir\Scalc.exe	calc.exe
File created	C:\Windows\SysWOW64\150MailCracker.exe.exe	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe
File created	C:\Windows\SysWOW64\150MailCracker.exe	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exesvchost.execalc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

calc.exe

pid process

2056 calc.exe

pid	process
2056	calc.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe

description	pid	process	target process
PID 944 wrote to memory of 3040	944	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe	svchost.exe
PID 944 wrote to memory of 3040	944	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe	svchost.exe
PID 944 wrote to memory of 3040	944	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe	svchost.exe
PID 944 wrote to memory of 3040	944	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe	svchost.exe
PID 944 wrote to memory of 3040	944	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe	svchost.exe
PID 944 wrote to memory of 2056	944	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe	calc.exe
PID 944 wrote to memory of 2056	944	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe	calc.exe
PID 944 wrote to memory of 2056	944	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe	calc.exe
PID 944 wrote to memory of 2056	944	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe	calc.exe
PID 944 wrote to memory of 2056	944	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe	calc.exe
PID 944 wrote to memory of 2456	944	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe	150MailCracker.exe
PID 944 wrote to memory of 2456	944	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe	150MailCracker.exe
PID 944 wrote to memory of 2456	944	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe	150MailCracker.exe
PID 944 wrote to memory of 2456	944	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe	150MailCracker.exe

C:\Users\Admin\AppData\Local\Temp\fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe
"C:\Users\Admin\AppData\Local\Temp\fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:944
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3040
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2056
- C:\Windows\SysWOW64\150MailCracker.exe
  "C:\Windows\system32\150MailCracker.exe"
  2⤵
  - Executes dropped EXE
  PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Active Setup

1

T1547.014

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Active Setup

1

T1547.014

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\InstallDir\Scalc.exe

Filesize
2.2MB

MD5
5ddbadc6f921bba27a37344cb4592630

SHA1
ccb97f90cdad3d4b114b294a3d0b46912b131b1a

SHA256
fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222

SHA512
5e74c48f4d6ba1f88f9bc4cca7370e537fe593b95acbb37f5c6a112d96b1f1f76d8a7c24595ccbb00f6525a9e897d14faab4b72f0a76b3d8a2261aacffcdc761

Download Submit
\Windows\SysWOW64\150MailCracker.exe

Filesize
2.1MB

MD5
50abd8423444cd6d74227454528a643a

SHA1
67d2662a068a6f96a79203850827dccfdaaf4fe8

SHA256
a18db9a9514ac66c12852d57ac38a66d7479b8fe0b36cd84d09094efab10c34a

SHA512
960a0657af8b2c2d350b214d9a4b751d764a7f15f041addee7f48219dcceaa50932d32cc6c8665de45aec53961892feae57d2e2f2ae7cecc68b72aa1f1e22763

Download Submit
memory/944-13-0x0000000010000000-0x0000000010263000-memory.dmp

Filesize
2.4MB

Download
memory/944-15-0x0000000002E20000-0x0000000003122000-memory.dmp

Filesize
3.0MB

Download
memory/2056-8-0x0000000010000000-0x0000000010263000-memory.dmp

Filesize
2.4MB

Download
memory/2056-18-0x0000000010000000-0x0000000010263000-memory.dmp

Filesize
2.4MB

Download
memory/2056-22-0x0000000010000000-0x0000000010263000-memory.dmp

Filesize
2.4MB

Download
memory/2456-17-0x0000000000400000-0x0000000000702000-memory.dmp

Filesize
3.0MB

Download
memory/2456-20-0x0000000000400000-0x0000000000702000-memory.dmp

Filesize
3.0MB

Download
memory/3040-0-0x0000000010000000-0x0000000010263000-memory.dmp

Filesize
2.4MB

Download
memory/3040-2-0x0000000010000000-0x0000000010263000-memory.dmp

Filesize
2.4MB

Download
memory/3040-21-0x0000000010000000-0x0000000010263000-memory.dmp

Filesize
2.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads