Analysis
-
max time kernel
1790s -
max time network
1608s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
05-07-2022 04:03
Static task
static1
Behavioral task
behavioral1
Sample
CF AL CHEATS 2K18/BugTrap.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
CF AL CHEATS 2K18/BugTrap.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
CF AL CHEATS 2K18/CF AL CHEATS.exe
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
CF AL CHEATS 2K18/CF AL CHEATS.exe
Resource
win10v2004-20220414-en
General
-
Target
CF AL CHEATS 2K18/CF AL CHEATS.exe
-
Size
33KB
-
MD5
ff926ad152e49b12044bcf258012a95d
-
SHA1
d7dc9a9f0ce32763dc654b1a8554246e0972c2cf
-
SHA256
3a4707df311d1b499a8c78e7e1c33b4f235de01c55b631e7147a32bf4b3e3830
-
SHA512
54980080ad22afd3a98d0f60d36314a9f65cc28b944d577cc3762437632c3c391762c2dad826a94a5e45bba11d608dca8529e2b12bba5575cd01ddc4f33d02d8
Malware Config
Signatures
-
Detect XtremeRAT Payload 5 IoCs
Processes:
resource yara_rule behavioral4/memory/4328-131-0x0000000000000000-mapping.dmp family_xtremerat behavioral4/memory/4656-132-0x0000000000000000-mapping.dmp family_xtremerat behavioral4/memory/4060-133-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral4/memory/4656-135-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral4/memory/4328-134-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{26I03V08-4S5J-1MHJ-LCHL-C545WL8R5B51} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{26I03V08-4S5J-1MHJ-LCHL-C545WL8R5B51}\StubPath = "C:\\Windows\\system32\\Windows\\Winlogon.exe restart" svchost.exe -
Processes:
resource yara_rule behavioral4/memory/4060-130-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral4/memory/4060-133-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral4/memory/4656-135-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral4/memory/4328-134-0x0000000010000000-0x000000001004D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Atualizar = "C:\\Windows\\system32\\Windows\\Winlogon.exe" svchost.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Windows\\system32\\Windows\\Winlogon.exe" svchost.exe -
Drops file in System32 directory 3 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Windows\Winlogon.exe svchost.exe File created C:\Windows\SysWOW64\Windows\Winlogon.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Windows\ svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3968 4656 WerFault.exe svchost.exe 1120 4328 WerFault.exe svchost.exe 3372 4328 WerFault.exe svchost.exe 4736 4656 WerFault.exe svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
svchost.exepid process 4656 svchost.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
CF AL CHEATS.exedescription pid process target process PID 4060 wrote to memory of 4328 4060 CF AL CHEATS.exe svchost.exe PID 4060 wrote to memory of 4328 4060 CF AL CHEATS.exe svchost.exe PID 4060 wrote to memory of 4328 4060 CF AL CHEATS.exe svchost.exe PID 4060 wrote to memory of 4328 4060 CF AL CHEATS.exe svchost.exe PID 4060 wrote to memory of 4656 4060 CF AL CHEATS.exe svchost.exe PID 4060 wrote to memory of 4656 4060 CF AL CHEATS.exe svchost.exe PID 4060 wrote to memory of 4656 4060 CF AL CHEATS.exe svchost.exe PID 4060 wrote to memory of 4656 4060 CF AL CHEATS.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CF AL CHEATS 2K18\CF AL CHEATS.exe"C:\Users\Admin\AppData\Local\Temp\CF AL CHEATS 2K18\CF AL CHEATS.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 4803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 4883⤵
- Program crash
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 9883⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 9963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4328 -ip 43281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4656 -ip 46561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4656 -ip 46561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4328 -ip 43281⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4060-130-0x0000000010000000-0x000000001004D000-memory.dmpFilesize
308KB
-
memory/4060-133-0x0000000010000000-0x000000001004D000-memory.dmpFilesize
308KB
-
memory/4328-131-0x0000000000000000-mapping.dmp
-
memory/4328-134-0x0000000010000000-0x000000001004D000-memory.dmpFilesize
308KB
-
memory/4656-132-0x0000000000000000-mapping.dmp
-
memory/4656-135-0x0000000010000000-0x000000001004D000-memory.dmpFilesize
308KB