Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 15:48
Behavioral task
behavioral1
Sample
4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe
Resource
win10v2004-20220901-en
General
-
Target
4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe
-
Size
585KB
-
MD5
55c0e0fb391a3ce4caaac1c49ed1ac00
-
SHA1
868da3a8c72eff600d54be3babe3721489a85500
-
SHA256
4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d
-
SHA512
60a5a4f182a5e0dab19709276746465ae277822b990e95121cbb170d2c4e29a6d71457a4817f88d7f10aa464d2974cbdb4b7eeffe60b9e44d02bf0b30f608df1
-
SSDEEP
12288:Za7XtTWupXNT35AcFqTCC5ktTWupXNT35AcFqTCC5I:ZEhZpXJ3SGqTCCuhZpXJ3SGqTCCm
Malware Config
Extracted
xtremerat
mrdead.no-ip.org
Signatures
-
Detect XtremeRAT payload 6 IoCs
resource yara_rule behavioral1/memory/996-57-0x0000000000000000-mapping.dmp family_xtremerat behavioral1/files/0x0008000000013300-59.dat family_xtremerat behavioral1/memory/1436-62-0x0000000000000000-mapping.dmp family_xtremerat behavioral1/memory/1436-66-0x0000000000C80000-0x0000000000D1A000-memory.dmp family_xtremerat behavioral1/memory/996-65-0x0000000000C80000-0x0000000000D1A000-memory.dmp family_xtremerat behavioral1/memory/1436-67-0x0000000000C80000-0x0000000000D1A000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{13335LDL-NM5Y-46WN-80SC-82Q1O8XG4GO1} 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{13335LDL-NM5Y-46WN-80SC-82Q1O8XG4GO1}\StubPath = "C:\\Windows\\system32\\InstallDir\\Server.exe restart" 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{13335LDL-NM5Y-46WN-80SC-82Q1O8XG4GO1} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{13335LDL-NM5Y-46WN-80SC-82Q1O8XG4GO1}\StubPath = "C:\\Windows\\system32\\InstallDir\\Server.exe restart" svchost.exe -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\Server.exe" svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\Server.exe" 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\Server.exe" 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\Server.exe" svchost.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run svchost.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\InstallDir\Server.exe 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe File created C:\Windows\SysWOW64\InstallDir\Server.exe 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe File opened for modification C:\Windows\SysWOW64\InstallDir\ 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1436 explorer.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1488 wrote to memory of 996 1488 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 28 PID 1488 wrote to memory of 996 1488 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 28 PID 1488 wrote to memory of 996 1488 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 28 PID 1488 wrote to memory of 996 1488 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 28 PID 1488 wrote to memory of 996 1488 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 28 PID 1488 wrote to memory of 1436 1488 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 29 PID 1488 wrote to memory of 1436 1488 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 29 PID 1488 wrote to memory of 1436 1488 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 29 PID 1488 wrote to memory of 1436 1488 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 29 PID 1488 wrote to memory of 1436 1488 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe"C:\Users\Admin\AppData\Local\Temp\4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe"1⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:996
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵
- Suspicious use of SetWindowsHookEx
PID:1436
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
585KB
MD555c0e0fb391a3ce4caaac1c49ed1ac00
SHA1868da3a8c72eff600d54be3babe3721489a85500
SHA2564c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d
SHA51260a5a4f182a5e0dab19709276746465ae277822b990e95121cbb170d2c4e29a6d71457a4817f88d7f10aa464d2974cbdb4b7eeffe60b9e44d02bf0b30f608df1