Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/10/2022, 18:04

General

  • Target

    d84051600b4210a62534a91831c2de85668ae6484b769e70ce8233686a9d138b.exe

  • Size

    45KB

  • MD5

    83121fb09c3da34c442aca4478460210

  • SHA1

    e90b458db9298219f24097e9af29d5a6017dcd29

  • SHA256

    d84051600b4210a62534a91831c2de85668ae6484b769e70ce8233686a9d138b

  • SHA512

    af32c11467cc84bdffe912dda99481efd5fde1191afec8431be6187f4b53b1d96d302ae54c27c9b3eb5f8c2dc6ffd07807b5aa16afa42744b57380dcf8d9e765

  • SSDEEP

    768:9Br+tjFY90iY6W1jwmDzKgEFQXaklMIAnH8hwfOgw0cVzowKU:jyRh31jxPEFQXak+H84bUowh

Malware Config

Extracted

Family

xtremerat

C2

furthers.no-ip.biz

Signatures

  • Detect XtremeRAT payload 3 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d84051600b4210a62534a91831c2de85668ae6484b769e70ce8233686a9d138b.exe
    "C:\Users\Admin\AppData\Local\Temp\d84051600b4210a62534a91831c2de85668ae6484b769e70ce8233686a9d138b.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:384
    • C:\Windows\SysWOW64\calc.exe
      calc.exe
      2⤵
        PID:2796
      • C:\Windows\SysWOW64\calc.exe
        calc.exe
        2⤵
          PID:3536
        • C:\Windows\SysWOW64\calc.exe
          calc.exe
          2⤵
          • Suspicious use of SetWindowsHookEx
          PID:5080

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/5080-134-0x0000000000C80000-0x0000000000C93000-memory.dmp

        Filesize

        76KB

      • memory/5080-135-0x0000000000C80000-0x0000000000C93000-memory.dmp

        Filesize

        76KB