Resubmissions

11-08-2022 15:42

220811-s5dkasbch6 10

31-07-2022 21:07

220731-zyandsgda9 10

Analysis

  • max time kernel
    160s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220722-en
  • submitted
    31-07-2022 21:07

General

  • Target

    5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe

  • Size

    280KB

  • MD5

    ce079d3dad0e1d26bd0fec06249958fc

  • SHA1

    0718bb878a04f653dc31b530579ccb901667ecaa

  • SHA256

    5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4

  • SHA512

    65568bf161e9d7b53e34b335b2fc3d3e77fe4b50aaf4004151a1268bedf13ce4082b97eb425ca7ee301b3f5ca5d6a4a2adbed9bafc48561ac2ae111a6f18a10f

Malware Config

Extracted

Family

xtremerat

C2

temp.ibadvisors.co

Signatures

  • Detect XtremeRAT payload 3 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
    "C:\Users\Admin\AppData\Local\Temp\5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1292
    • C:\Users\Admin\AppData\Local\Temp\5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      "C:\Users\Admin\AppData\Local\Temp\5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe"
      2⤵
        PID:2392

    Network

    • flag-us
      DNS
      temp.ibadvisors.co
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      Remote address:
      8.8.8.8:53
      Request
      temp.ibadvisors.co
      IN A
      Response
    • flag-us
      DNS
      temp.ibadvisors.co
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      Remote address:
      8.8.8.8:53
      Request
      temp.ibadvisors.co
      IN A
      Response
    • flag-us
      DNS
      temp.ibadvisors.co
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      Remote address:
      8.8.8.8:53
      Request
      temp.ibadvisors.co
      IN A
      Response
    • flag-us
      DNS
      temp.ibadvisors.co
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      Remote address:
      8.8.8.8:53
      Request
      temp.ibadvisors.co
      IN A
      Response
    • flag-us
      DNS
      temp.ibadvisors.co
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      Remote address:
      8.8.8.8:53
      Request
      temp.ibadvisors.co
      IN A
      Response
    • flag-us
      DNS
      temp.ibadvisors.co
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      Remote address:
      8.8.8.8:53
      Request
      temp.ibadvisors.co
      IN A
      Response
    • flag-us
      DNS
      temp.ibadvisors.co
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      Remote address:
      8.8.8.8:53
      Request
      temp.ibadvisors.co
      IN A
      Response
    • flag-us
      DNS
      temp.ibadvisors.co
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      Remote address:
      8.8.8.8:53
      Request
      temp.ibadvisors.co
      IN A
      Response
    • flag-us
      DNS
      temp.ibadvisors.co
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      Remote address:
      8.8.8.8:53
      Request
      temp.ibadvisors.co
      IN A
      Response
    • flag-us
      DNS
      temp.ibadvisors.co
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      Remote address:
      8.8.8.8:53
      Request
      temp.ibadvisors.co
      IN A
      Response
    • flag-us
      DNS
      temp.ibadvisors.co
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      Remote address:
      8.8.8.8:53
      Request
      temp.ibadvisors.co
      IN A
      Response
    • flag-us
      DNS
      temp.ibadvisors.co
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      Remote address:
      8.8.8.8:53
      Request
      temp.ibadvisors.co
      IN A
      Response
    • flag-us
      DNS
      temp.ibadvisors.co
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      Remote address:
      8.8.8.8:53
      Request
      temp.ibadvisors.co
      IN A
      Response
    • flag-us
      DNS
      temp.ibadvisors.co
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      Remote address:
      8.8.8.8:53
      Request
      temp.ibadvisors.co
      IN A
      Response
    • flag-us
      DNS
      temp.ibadvisors.co
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      Remote address:
      8.8.8.8:53
      Request
      temp.ibadvisors.co
      IN A
      Response
    • flag-us
      DNS
      temp.ibadvisors.co
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      Remote address:
      8.8.8.8:53
      Request
      temp.ibadvisors.co
      IN A
      Response
    • flag-us
      DNS
      temp.ibadvisors.co
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      Remote address:
      8.8.8.8:53
      Request
      temp.ibadvisors.co
      IN A
      Response
    • flag-us
      DNS
      temp.ibadvisors.co
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      Remote address:
      8.8.8.8:53
      Request
      temp.ibadvisors.co
      IN A
      Response
    • flag-us
      DNS
      temp.ibadvisors.co
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      Remote address:
      8.8.8.8:53
      Request
      temp.ibadvisors.co
      IN A
      Response
    • flag-us
      DNS
      temp.ibadvisors.co
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      Remote address:
      8.8.8.8:53
      Request
      temp.ibadvisors.co
      IN A
      Response
    • flag-us
      DNS
      temp.ibadvisors.co
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      Remote address:
      8.8.8.8:53
      Request
      temp.ibadvisors.co
      IN A
      Response
    • flag-us
      DNS
      temp.ibadvisors.co
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      Remote address:
      8.8.8.8:53
      Request
      temp.ibadvisors.co
      IN A
      Response
    • flag-us
      DNS
      temp.ibadvisors.co
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      Remote address:
      8.8.8.8:53
      Request
      temp.ibadvisors.co
      IN A
      Response
    • flag-us
      DNS
      temp.ibadvisors.co
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      Remote address:
      8.8.8.8:53
      Request
      temp.ibadvisors.co
      IN A
      Response
    • flag-us
      DNS
      temp.ibadvisors.co
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      Remote address:
      8.8.8.8:53
      Request
      temp.ibadvisors.co
      IN A
      Response
    • flag-us
      DNS
      temp.ibadvisors.co
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      Remote address:
      8.8.8.8:53
      Request
      temp.ibadvisors.co
      IN A
      Response
    • 8.238.20.254:80
      92 B
      80 B
      2
      2
    • 8.8.8.8:53
      temp.ibadvisors.co
      dns
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      64 B
      135 B
      1
      1

      DNS Request

      temp.ibadvisors.co

    • 8.8.8.8:53
      temp.ibadvisors.co
      dns
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      64 B
      135 B
      1
      1

      DNS Request

      temp.ibadvisors.co

    • 8.8.8.8:53
      temp.ibadvisors.co
      dns
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      64 B
      135 B
      1
      1

      DNS Request

      temp.ibadvisors.co

    • 8.8.8.8:53
      temp.ibadvisors.co
      dns
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      64 B
      135 B
      1
      1

      DNS Request

      temp.ibadvisors.co

    • 8.8.8.8:53
      temp.ibadvisors.co
      dns
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      64 B
      135 B
      1
      1

      DNS Request

      temp.ibadvisors.co

    • 8.8.8.8:53
      temp.ibadvisors.co
      dns
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      64 B
      135 B
      1
      1

      DNS Request

      temp.ibadvisors.co

    • 8.8.8.8:53
      temp.ibadvisors.co
      dns
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      64 B
      135 B
      1
      1

      DNS Request

      temp.ibadvisors.co

    • 8.8.8.8:53
      temp.ibadvisors.co
      dns
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      64 B
      135 B
      1
      1

      DNS Request

      temp.ibadvisors.co

    • 8.8.8.8:53
      temp.ibadvisors.co
      dns
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      64 B
      135 B
      1
      1

      DNS Request

      temp.ibadvisors.co

    • 8.8.8.8:53
      temp.ibadvisors.co
      dns
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      64 B
      135 B
      1
      1

      DNS Request

      temp.ibadvisors.co

    • 8.8.8.8:53
      temp.ibadvisors.co
      dns
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      64 B
      135 B
      1
      1

      DNS Request

      temp.ibadvisors.co

    • 8.8.8.8:53
      temp.ibadvisors.co
      dns
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      64 B
      135 B
      1
      1

      DNS Request

      temp.ibadvisors.co

    • 8.8.8.8:53
      temp.ibadvisors.co
      dns
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      64 B
      135 B
      1
      1

      DNS Request

      temp.ibadvisors.co

    • 8.8.8.8:53
      temp.ibadvisors.co
      dns
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      64 B
      135 B
      1
      1

      DNS Request

      temp.ibadvisors.co

    • 8.8.8.8:53
      temp.ibadvisors.co
      dns
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      64 B
      135 B
      1
      1

      DNS Request

      temp.ibadvisors.co

    • 8.8.8.8:53
      temp.ibadvisors.co
      dns
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      64 B
      135 B
      1
      1

      DNS Request

      temp.ibadvisors.co

    • 8.8.8.8:53
      temp.ibadvisors.co
      dns
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      64 B
      135 B
      1
      1

      DNS Request

      temp.ibadvisors.co

    • 8.8.8.8:53
      temp.ibadvisors.co
      dns
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      64 B
      135 B
      1
      1

      DNS Request

      temp.ibadvisors.co

    • 8.8.8.8:53
      temp.ibadvisors.co
      dns
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      64 B
      135 B
      1
      1

      DNS Request

      temp.ibadvisors.co

    • 8.8.8.8:53
      temp.ibadvisors.co
      dns
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      64 B
      135 B
      1
      1

      DNS Request

      temp.ibadvisors.co

    • 8.8.8.8:53
      temp.ibadvisors.co
      dns
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      64 B
      135 B
      1
      1

      DNS Request

      temp.ibadvisors.co

    • 8.8.8.8:53
      temp.ibadvisors.co
      dns
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      64 B
      135 B
      1
      1

      DNS Request

      temp.ibadvisors.co

    • 8.8.8.8:53
      temp.ibadvisors.co
      dns
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      64 B
      135 B
      1
      1

      DNS Request

      temp.ibadvisors.co

    • 8.8.8.8:53
      temp.ibadvisors.co
      dns
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      64 B
      135 B
      1
      1

      DNS Request

      temp.ibadvisors.co

    • 8.8.8.8:53
      temp.ibadvisors.co
      dns
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      64 B
      135 B
      1
      1

      DNS Request

      temp.ibadvisors.co

    • 8.8.8.8:53
      temp.ibadvisors.co
      dns
      5e31e481438c885932376ed3ea6314d14a59b76c464cccd334de7dba315ffad4.exe
      64 B
      135 B
      1
      1

      DNS Request

      temp.ibadvisors.co

    • 8.8.8.8:53

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2392-135-0x0000000010000000-0x000000001004D000-memory.dmp

      Filesize

      308KB

    • memory/2392-137-0x0000000010000000-0x000000001004D000-memory.dmp

      Filesize

      308KB

    • memory/2392-138-0x0000000010000000-0x000000001004D000-memory.dmp

      Filesize

      308KB

    • memory/2392-139-0x0000000010000000-0x000000001004D000-memory.dmp

      Filesize

      308KB

    • memory/2392-140-0x0000000010000000-0x000000001004D000-memory.dmp

      Filesize

      308KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.