xtremerat | 2ed234c790c1996d9c08d4b269b98a99b5c502664a5cfa19642b4d48b8948351

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2ed234c790c1996d9c08d4b269b98a99b5c502664a5cfa19642b4d48b8948351.exe
Size 6.0MB
Sample260826-srbtjsfl6x
SHA256 2ed234c790c1996d9c08d4b269b98a99b5c502664a5cfa19642b4d48b8948351
MD5 b80c9c71764716cc2c9c6182ca76dc98
SHA1 614ce262ad6240f4d99efdeeec780ae33a072842
SHA512 2805281ed5c7696a3460fabe5dc1ad79e4b2f093ec08cc063788bf313401b8046b213849ec725bf3b8c415026ea47703970f14db8d3241e9fec7ed3216387f5a
SSDEEP 12288:gCSlL0dFn7o1JsazJruH5AcOPXJ8/FFgntf1lSG4G0nXsoXXtWHMDE7:gCSlmF72VuPOfJ8/FFgntNeG41WHMD
TLSH
T1BA560E87D64EF689DB0495BD4C4D42E026FDD84865036B9E7984AB2CCBE63CE8FDE404
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery xtremerat persistence rat spyware

Malware Config

Extracted

Family

xtremerat

phpconsole.servehttp.com

Signatures

Family: XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Detect XtremeRAT payload 7 IoCs

resource	yara_rule
behavioral1/memory/4788-2-0x0000000010000000-0x00000000100AC000-memory.dmp	family_xtremerat
behavioral1/memory/4788-3-0x0000000010000000-0x00000000100AC000-memory.dmp	family_xtremerat
behavioral1/memory/4788-5-0x0000000010000000-0x00000000100AC000-memory.dmp	family_xtremerat
behavioral1/memory/4788-6-0x0000000010000000-0x00000000100AC000-memory.dmp	family_xtremerat
behavioral1/memory/1644-7-0x0000000010000000-0x00000000100AC000-memory.dmp	family_xtremerat
behavioral1/memory/4788-29-0x0000000010000000-0x00000000100AC000-memory.dmp	family_xtremerat
behavioral1/memory/1644-30-0x0000000010000000-0x00000000100AC000-memory.dmp	family_xtremerat

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\etc\__tmp_rar_sfx_access_check_240689156	127hosts.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	2ed234c790c1996d9c08d4b269b98a99b5c502664a5cfa19642b4d48b8948351.exe

Executes dropped EXE 2 IoCs

pid	Process
3984	127hosts.exe
3920	611Winrar Fake Message.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4832 set thread context of 4788	4832	2ed234c790c1996d9c08d4b269b98a99b5c502664a5cfa19642b4d48b8948351.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3580	1644	WerFault.exe	87
1504	1644	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2ed234c790c1996d9c08d4b269b98a99b5c502664a5cfa19642b4d48b8948351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	127hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	611Winrar Fake Message.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2ed234c790c1996d9c08d4b269b98a99b5c502664a5cfa19642b4d48b8948351.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 4788	4832	2ed234c790c1996d9c08d4b269b98a99b5c502664a5cfa19642b4d48b8948351.exe	86
PID 4832 wrote to memory of 4788	4832	2ed234c790c1996d9c08d4b269b98a99b5c502664a5cfa19642b4d48b8948351.exe	86
PID 4832 wrote to memory of 4788	4832	2ed234c790c1996d9c08d4b269b98a99b5c502664a5cfa19642b4d48b8948351.exe	86
PID 4832 wrote to memory of 4788	4832	2ed234c790c1996d9c08d4b269b98a99b5c502664a5cfa19642b4d48b8948351.exe	86
PID 4832 wrote to memory of 4788	4832	2ed234c790c1996d9c08d4b269b98a99b5c502664a5cfa19642b4d48b8948351.exe	86
PID 4832 wrote to memory of 4788	4832	2ed234c790c1996d9c08d4b269b98a99b5c502664a5cfa19642b4d48b8948351.exe	86
PID 4832 wrote to memory of 4788	4832	2ed234c790c1996d9c08d4b269b98a99b5c502664a5cfa19642b4d48b8948351.exe	86
PID 4832 wrote to memory of 4788	4832	2ed234c790c1996d9c08d4b269b98a99b5c502664a5cfa19642b4d48b8948351.exe	86
PID 4788 wrote to memory of 1644	4788	2ed234c790c1996d9c08d4b269b98a99b5c502664a5cfa19642b4d48b8948351.exe	87
PID 4788 wrote to memory of 1644	4788	2ed234c790c1996d9c08d4b269b98a99b5c502664a5cfa19642b4d48b8948351.exe	87
PID 4788 wrote to memory of 4976	4788	2ed234c790c1996d9c08d4b269b98a99b5c502664a5cfa19642b4d48b8948351.exe	88
PID 4788 wrote to memory of 4976	4788	2ed234c790c1996d9c08d4b269b98a99b5c502664a5cfa19642b4d48b8948351.exe	88
PID 4788 wrote to memory of 3984	4788	2ed234c790c1996d9c08d4b269b98a99b5c502664a5cfa19642b4d48b8948351.exe	93
PID 4788 wrote to memory of 3920	4788	2ed234c790c1996d9c08d4b269b98a99b5c502664a5cfa19642b4d48b8948351.exe	94

C:\Users\Admin\AppData\Local\Temp\2ed234c790c1996d9c08d4b269b98a99b5c502664a5cfa19642b4d48b8948351.exe
"C:\Users\Admin\AppData\Local\Temp\2ed234c790c1996d9c08d4b269b98a99b5c502664a5cfa19642b4d48b8948351.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Users\Admin\AppData\Local\Temp\2ed234c790c1996d9c08d4b269b98a99b5c502664a5cfa19642b4d48b8948351.exe
  "C:\Users\Admin\AppData\Local\Temp\2ed234c790c1996d9c08d4b269b98a99b5c502664a5cfa19642b4d48b8948351.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1644
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 488
      4⤵
      Program crash
      PID:3580
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 496
      4⤵
      Program crash
      PID:1504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4976
- - C:\Users\Admin\AppData\Local\Temp\127hosts.exe
    "C:\Users\Admin\AppData\Local\Temp\127hosts.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3984
- - C:\Users\Admin\AppData\Local\Temp\611Winrar Fake Message.exe
    "C:\Users\Admin\AppData\Local\Temp\611Winrar Fake Message.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1644 -ip 1644
1⤵
PID:4008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1644 -ip 1644
1⤵
PID:1120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

127hosts.exe

Path C:\Users\Admin\AppData\Local\Temp\127hosts.exe
Size 187KB
SHA256 6da0f2da44aeef1650d034c0a10c943f6d8d3796d3af8dac10ec88c5ff1eadeb
MD5 d110f1a2398fabbc05a7d8e2c7e9b14a
SHA1 9a17393f799612782814ca4aec8ef84e3a1a4133
SHA512 a7a3b25e73357d60bacae5e237b220aff3b163ebdb4b4da157017e43af3720112d5a0c5b6113e99d2ca7c7ac852504fec10aaa3f03531ac0f03e246e65a86b65
SSDEEP 3072:ftFw8wzBh6/WBUJ0T5mLfrymI6GwVY3NhA1sFXvmE8HBkgsiAI1xh5oehAwV:lFw8wzBhaEUJ45mCmI6GwVY3KsFXm6eR
TLSH
T1DE14D02376E61179D6632230AFBB5706827DF9349637C60FF780181A7FB4982CA56363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

611Winrar Fake Message.exe

Path C:\Users\Admin\AppData\Local\Temp\611Winrar Fake Message.exe
Size 202KB
SHA256 9d6e4203c256a2b375003e366278d980326dfe1e905e49ae01f194152233ea7e
MD5 4ab526f8d1797ccb5f0f5fe3feba9e23
SHA1 0242c4dd0717865aa4ce0f4884c8805c0065204b
SHA512 0ea2a8fc053eefeb5fbc1ec12e834aee0e090828d525c7e6594100e6cab5eb662e4b51c9f8f0b93f96530ead400971f071c278ac623901c32359324de731641b
SSDEEP 6144:eHTLINfFtWNiHS5Jhm3VC/iVDO5jMMMMMM:e4Nf3eUS5JAFC/iMMMMMMM
TLSH
T188146C37F3C0C833D1A60A7C8C5752B9642ABE112F6C645F7AE47E0D5F792C1792829A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1644-7-0x0000000010000000-0x00000000100AC000-memory.dmp

Download

memory/1644-30-0x0000000010000000-0x00000000100AC000-memory.dmp

Download

memory/3920-32-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3920-31-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4788-3-0x0000000010000000-0x00000000100AC000-memory.dmp

Download

memory/4788-6-0x0000000010000000-0x00000000100AC000-memory.dmp

Download

memory/4788-5-0x0000000010000000-0x00000000100AC000-memory.dmp

Download

memory/4788-29-0x0000000010000000-0x00000000100AC000-memory.dmp

Download

memory/4788-2-0x0000000010000000-0x00000000100AC000-memory.dmp

Download

memory/4832-0-0x0000000000560000-0x0000000000570000-memory.dmp

Download

memory/4832-1-0x0000000075352000-0x0000000075354000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads