xtremerat | fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222

General

Target

fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe
Size

2.2MB
MD5

5ddbadc6f921bba27a37344cb4592630
SHA1

ccb97f90cdad3d4b114b294a3d0b46912b131b1a
SHA256

fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222
SHA512

5e74c48f4d6ba1f88f9bc4cca7370e537fe593b95acbb37f5c6a112d96b1f1f76d8a7c24595ccbb00f6525a9e897d14faab4b72f0a76b3d8a2261aacffcdc761
SSDEEP

49152:jhbmmP3okl2d47ZDmNpgkWMzvKi5TJfszSNG1f16IAE9ZqxAv6:ZmmvoN6GgkWUv15TVsONG1f1lXJv6

Score

10^/10

xtremerat discovery persistence rat spyware

Malware Config

Extracted

Family

xtremerat

C2

no.myftp.org

Signatures

Detect XtremeRAT payload 6 IoCs

resource	yara_rule
behavioral2/memory/4820-0-0x0000000010000000-0x0000000010263000-memory.dmp	family_xtremerat
behavioral2/memory/2928-1-0x0000000010000000-0x0000000010263000-memory.dmp	family_xtremerat
behavioral2/memory/2928-12-0x0000000010000000-0x0000000010263000-memory.dmp	family_xtremerat
behavioral2/memory/3932-17-0x0000000010000000-0x0000000010263000-memory.dmp	family_xtremerat
behavioral2/memory/4820-19-0x0000000010000000-0x0000000010263000-memory.dmp	family_xtremerat
behavioral2/memory/2928-20-0x0000000010000000-0x0000000010263000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Xtremerat family
xtremerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\system32\\InstallDir\\Scalc.exe restart"	calc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	calc.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe

Executes dropped EXE 1 IoCs

pid	Process
4976	150MailCracker.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\Scalc.exe"	calc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\Scalc.exe"	calc.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\InstallDir\Scalc.exe	calc.exe
File created	C:\Windows\SysWOW64\InstallDir\Scalc.exe	calc.exe
File created	C:\Windows\SysWOW64\150MailCracker.exe.exe	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe
File created	C:\Windows\SysWOW64\150MailCracker.exe	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4328	4820	WerFault.exe	84
1440	4820	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	150MailCracker.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2928	calc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 4820	3932	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe	84
PID 3932 wrote to memory of 4820	3932	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe	84
PID 3932 wrote to memory of 4820	3932	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe	84
PID 3932 wrote to memory of 4820	3932	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe	84
PID 3932 wrote to memory of 2928	3932	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe	86
PID 3932 wrote to memory of 2928	3932	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe	86
PID 3932 wrote to memory of 2928	3932	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe	86
PID 3932 wrote to memory of 2928	3932	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe	86
PID 3932 wrote to memory of 4976	3932	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe	90
PID 3932 wrote to memory of 4976	3932	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe	90
PID 3932 wrote to memory of 4976	3932	fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe	90

C:\Users\Admin\AppData\Local\Temp\fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe
"C:\Users\Admin\AppData\Local\Temp\fc053ada5723297ca0ce1be6c0c2b92fd88142b3e0129b960324f3181d3d1222N.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 480
    3⤵
    - Program crash
    PID:4328
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 488
    3⤵
    - Program crash
    PID:1440
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2928
- C:\Windows\SysWOW64\150MailCracker.exe
  "C:\Windows\system32\150MailCracker.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4820 -ip 4820
1⤵
PID:1776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4820 -ip 4820
1⤵
PID:1552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Active Setup

1

T1547.014

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Active Setup

1

T1547.014

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\150MailCracker.exe

Filesize
2.1MB

MD5
50abd8423444cd6d74227454528a643a

SHA1
67d2662a068a6f96a79203850827dccfdaaf4fe8

SHA256
a18db9a9514ac66c12852d57ac38a66d7479b8fe0b36cd84d09094efab10c34a

SHA512
960a0657af8b2c2d350b214d9a4b751d764a7f15f041addee7f48219dcceaa50932d32cc6c8665de45aec53961892feae57d2e2f2ae7cecc68b72aa1f1e22763

Download Submit
memory/2928-1-0x0000000010000000-0x0000000010263000-memory.dmp

Filesize
2.4MB

Download
memory/2928-12-0x0000000010000000-0x0000000010263000-memory.dmp

Filesize
2.4MB

Download
memory/2928-20-0x0000000010000000-0x0000000010263000-memory.dmp

Filesize
2.4MB

Download
memory/3932-17-0x0000000010000000-0x0000000010263000-memory.dmp

Filesize
2.4MB

Download
memory/4820-0-0x0000000010000000-0x0000000010263000-memory.dmp

Filesize
2.4MB

Download
memory/4820-19-0x0000000010000000-0x0000000010263000-memory.dmp

Filesize
2.4MB

Download
memory/4976-15-0x0000000000400000-0x0000000000702000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads