Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2022 15:48
Behavioral task
behavioral1
Sample
4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe
-
Size
585KB
-
MD5
55c0e0fb391a3ce4caaac1c49ed1ac00
-
SHA1
868da3a8c72eff600d54be3babe3721489a85500
-
SHA256
4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d
-
SHA512
60a5a4f182a5e0dab19709276746465ae277822b990e95121cbb170d2c4e29a6d71457a4817f88d7f10aa464d2974cbdb4b7eeffe60b9e44d02bf0b30f608df1
-
SSDEEP
12288:Za7XtTWupXNT35AcFqTCC5ktTWupXNT35AcFqTCC5I:ZEhZpXJ3SGqTCCuhZpXJ3SGqTCCm
Score
10/10
Malware Config
Extracted
Family
xtremerat
C2
mrdead.no-ip.org
Signatures
-
Detect XtremeRAT payload 3 IoCs
resource yara_rule behavioral2/memory/1348-132-0x0000000000000000-mapping.dmp family_xtremerat behavioral2/files/0x0002000000022e25-133.dat family_xtremerat behavioral2/memory/1348-134-0x0000000000C80000-0x0000000000D1A000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{13335LDL-NM5Y-46WN-80SC-82Q1O8XG4GO1} 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{13335LDL-NM5Y-46WN-80SC-82Q1O8XG4GO1}\StubPath = "C:\\Windows\\system32\\InstallDir\\Server.exe restart" 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{13335LDL-NM5Y-46WN-80SC-82Q1O8XG4GO1} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{13335LDL-NM5Y-46WN-80SC-82Q1O8XG4GO1}\StubPath = "C:\\Windows\\system32\\InstallDir\\Server.exe restart" svchost.exe -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\Server.exe" 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\Server.exe" 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\Server.exe" svchost.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\Server.exe" svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\InstallDir\Server.exe 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe File created C:\Windows\SysWOW64\InstallDir\Server.exe 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe File opened for modification C:\Windows\SysWOW64\InstallDir\ 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe -
Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 640 wrote to memory of 1348 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 85 PID 640 wrote to memory of 1348 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 85 PID 640 wrote to memory of 1348 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 85 PID 640 wrote to memory of 1348 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 85 PID 640 wrote to memory of 4152 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 86 PID 640 wrote to memory of 4152 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 86 PID 640 wrote to memory of 4152 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 86 PID 640 wrote to memory of 3480 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 87 PID 640 wrote to memory of 3480 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 87 PID 640 wrote to memory of 3480 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 87 PID 640 wrote to memory of 3548 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 88 PID 640 wrote to memory of 3548 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 88 PID 640 wrote to memory of 3548 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 88 PID 640 wrote to memory of 2504 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 89 PID 640 wrote to memory of 2504 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 89 PID 640 wrote to memory of 2504 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 89 PID 640 wrote to memory of 204 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 91 PID 640 wrote to memory of 204 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 91 PID 640 wrote to memory of 204 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 91 PID 640 wrote to memory of 4300 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 92 PID 640 wrote to memory of 4300 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 92 PID 640 wrote to memory of 4300 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 92 PID 640 wrote to memory of 4004 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 93 PID 640 wrote to memory of 4004 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 93 PID 640 wrote to memory of 4004 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 93 PID 640 wrote to memory of 4492 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 95 PID 640 wrote to memory of 4492 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 95 PID 640 wrote to memory of 4492 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 95 PID 640 wrote to memory of 4944 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 96 PID 640 wrote to memory of 4944 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 96 PID 640 wrote to memory of 4944 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 96 PID 640 wrote to memory of 3884 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 97 PID 640 wrote to memory of 3884 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 97 PID 640 wrote to memory of 3884 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 97 PID 640 wrote to memory of 3816 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 98 PID 640 wrote to memory of 3816 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 98 PID 640 wrote to memory of 3816 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 98 PID 640 wrote to memory of 5072 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 99 PID 640 wrote to memory of 5072 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 99 PID 640 wrote to memory of 5072 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 99 PID 640 wrote to memory of 1580 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 100 PID 640 wrote to memory of 1580 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 100 PID 640 wrote to memory of 1580 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 100 PID 640 wrote to memory of 4456 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 102 PID 640 wrote to memory of 4456 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 102 PID 640 wrote to memory of 4456 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 102 PID 640 wrote to memory of 1420 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 103 PID 640 wrote to memory of 1420 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 103 PID 640 wrote to memory of 1420 640 4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe"C:\Users\Admin\AppData\Local\Temp\4c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d.exe"1⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:1348
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:4152
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:3480
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:3548
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:2504
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:204
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:4300
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:4004
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:4492
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:4944
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:3884
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:3816
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:5072
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:1580
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:4456
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:1420
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
585KB
MD555c0e0fb391a3ce4caaac1c49ed1ac00
SHA1868da3a8c72eff600d54be3babe3721489a85500
SHA2564c0c9f8c773d5cc77601fe14009e05ebc723e95f586519d0e4fdae5f35fa525d
SHA51260a5a4f182a5e0dab19709276746465ae277822b990e95121cbb170d2c4e29a6d71457a4817f88d7f10aa464d2974cbdb4b7eeffe60b9e44d02bf0b30f608df1