Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2022, 18:04
Behavioral task
behavioral1
Sample
d84051600b4210a62534a91831c2de85668ae6484b769e70ce8233686a9d138b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d84051600b4210a62534a91831c2de85668ae6484b769e70ce8233686a9d138b.exe
Resource
win10v2004-20220901-en
General
-
Target
d84051600b4210a62534a91831c2de85668ae6484b769e70ce8233686a9d138b.exe
-
Size
45KB
-
MD5
83121fb09c3da34c442aca4478460210
-
SHA1
e90b458db9298219f24097e9af29d5a6017dcd29
-
SHA256
d84051600b4210a62534a91831c2de85668ae6484b769e70ce8233686a9d138b
-
SHA512
af32c11467cc84bdffe912dda99481efd5fde1191afec8431be6187f4b53b1d96d302ae54c27c9b3eb5f8c2dc6ffd07807b5aa16afa42744b57380dcf8d9e765
-
SSDEEP
768:9Br+tjFY90iY6W1jwmDzKgEFQXaklMIAnH8hwfOgw0cVzowKU:jyRh31jxPEFQXak+H84bUowh
Malware Config
Extracted
xtremerat
furthers.no-ip.biz
Signatures
-
Detect XtremeRAT payload 3 IoCs
resource yara_rule behavioral2/memory/5080-133-0x0000000000000000-mapping.dmp family_xtremerat behavioral2/memory/5080-134-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/5080-135-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} d84051600b4210a62534a91831c2de85668ae6484b769e70ce8233686a9d138b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" d84051600b4210a62534a91831c2de85668ae6484b769e70ce8233686a9d138b.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run d84051600b4210a62534a91831c2de85668ae6484b769e70ce8233686a9d138b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" d84051600b4210a62534a91831c2de85668ae6484b769e70ce8233686a9d138b.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run d84051600b4210a62534a91831c2de85668ae6484b769e70ce8233686a9d138b.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" d84051600b4210a62534a91831c2de85668ae6484b769e70ce8233686a9d138b.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\InstallDir\Server.exe d84051600b4210a62534a91831c2de85668ae6484b769e70ce8233686a9d138b.exe File opened for modification C:\Windows\InstallDir\Server.exe d84051600b4210a62534a91831c2de85668ae6484b769e70ce8233686a9d138b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5080 calc.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 384 wrote to memory of 2796 384 d84051600b4210a62534a91831c2de85668ae6484b769e70ce8233686a9d138b.exe 81 PID 384 wrote to memory of 2796 384 d84051600b4210a62534a91831c2de85668ae6484b769e70ce8233686a9d138b.exe 81 PID 384 wrote to memory of 2796 384 d84051600b4210a62534a91831c2de85668ae6484b769e70ce8233686a9d138b.exe 81 PID 384 wrote to memory of 3536 384 d84051600b4210a62534a91831c2de85668ae6484b769e70ce8233686a9d138b.exe 82 PID 384 wrote to memory of 3536 384 d84051600b4210a62534a91831c2de85668ae6484b769e70ce8233686a9d138b.exe 82 PID 384 wrote to memory of 3536 384 d84051600b4210a62534a91831c2de85668ae6484b769e70ce8233686a9d138b.exe 82 PID 384 wrote to memory of 5080 384 d84051600b4210a62534a91831c2de85668ae6484b769e70ce8233686a9d138b.exe 83 PID 384 wrote to memory of 5080 384 d84051600b4210a62534a91831c2de85668ae6484b769e70ce8233686a9d138b.exe 83 PID 384 wrote to memory of 5080 384 d84051600b4210a62534a91831c2de85668ae6484b769e70ce8233686a9d138b.exe 83 PID 384 wrote to memory of 5080 384 d84051600b4210a62534a91831c2de85668ae6484b769e70ce8233686a9d138b.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\d84051600b4210a62534a91831c2de85668ae6484b769e70ce8233686a9d138b.exe"C:\Users\Admin\AppData\Local\Temp\d84051600b4210a62534a91831c2de85668ae6484b769e70ce8233686a9d138b.exe"1⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Windows\SysWOW64\calc.execalc.exe2⤵PID:2796
-
-
C:\Windows\SysWOW64\calc.execalc.exe2⤵PID:3536
-
-
C:\Windows\SysWOW64\calc.execalc.exe2⤵
- Suspicious use of SetWindowsHookEx
PID:5080
-