Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23/11/2022, 22:08
Static task
static1
Behavioral task
behavioral1
Sample
b93c634e5494c31077e6d87e143c4da80517d3064910e9f786403394c52bd0f6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b93c634e5494c31077e6d87e143c4da80517d3064910e9f786403394c52bd0f6.exe
Resource
win10v2004-20221111-en
General
-
Target
b93c634e5494c31077e6d87e143c4da80517d3064910e9f786403394c52bd0f6.exe
-
Size
732KB
-
MD5
516988b83c8f25c047cc4bfaa24fd7eb
-
SHA1
4ebb58d6c0c7162a82b8432a1b7ad9f7409ebdd7
-
SHA256
b93c634e5494c31077e6d87e143c4da80517d3064910e9f786403394c52bd0f6
-
SHA512
1cea8a4c8f5728a6c3819f1309aaca03fa03cb8f818cd582265eea640ea8f7f7f4a9cd1c56dc6efa36a92230f6de8293a72cd05a098e4ff9cdcdc321afb81ecb
-
SSDEEP
12288:FHs9LkboBd3ndY9giv39REcgWGGNOYH/3p31jaHjQ9OXQHeYMthFkXywWIz1um:FM90i3dtiFREcgWGGNOYHvXOQ9SYMDFG
Malware Config
Extracted
xtremerat
roma1996.no-ip.org
Signatures
-
Detect XtremeRAT payload 9 IoCs
resource yara_rule behavioral1/memory/1100-64-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral1/memory/1100-65-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral1/memory/820-69-0x0000000000000000-mapping.dmp family_xtremerat behavioral1/memory/1984-73-0x0000000000000000-mapping.dmp family_xtremerat behavioral1/memory/1100-74-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral1/memory/1984-76-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral1/memory/820-77-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral1/memory/1984-79-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral1/memory/820-80-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{8B2MO1C2-8803-5U2K-671L-S416G8EKP825} notepad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8B2MO1C2-8803-5U2K-671L-S416G8EKP825}\StubPath = "C:\\Windows\\InstallDir\\svchost.exe restart" notepad.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{8B2MO1C2-8803-5U2K-671L-S416G8EKP825} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8B2MO1C2-8803-5U2K-671L-S416G8EKP825}\StubPath = "C:\\Windows\\InstallDir\\svchost.exe" svchost.exe -
resource yara_rule behavioral1/memory/1100-58-0x0000000010000000-0x0000000010048000-memory.dmp upx behavioral1/memory/1100-62-0x0000000010000000-0x0000000010048000-memory.dmp upx behavioral1/memory/1100-64-0x0000000010000000-0x0000000010048000-memory.dmp upx behavioral1/memory/1100-65-0x0000000010000000-0x0000000010048000-memory.dmp upx behavioral1/memory/1100-74-0x0000000010000000-0x0000000010048000-memory.dmp upx behavioral1/memory/1984-76-0x0000000010000000-0x0000000010048000-memory.dmp upx behavioral1/memory/820-77-0x0000000010000000-0x0000000010048000-memory.dmp upx behavioral1/memory/1984-79-0x0000000010000000-0x0000000010048000-memory.dmp upx behavioral1/memory/820-80-0x0000000010000000-0x0000000010048000-memory.dmp upx -
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\svchost.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\svchost.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "㩃坜湩潤獷卜獹佗㙗尴潮整慰\u2e64硥e엸က엸က㽜" notepad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\svchost.exe" svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run notepad.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run notepad.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run svchost.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\svchost.exe" svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 752 set thread context of 1100 752 b93c634e5494c31077e6d87e143c4da80517d3064910e9f786403394c52bd0f6.exe 27 -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\InstallDir\svchost.exe notepad.exe File created C:\Windows\InstallDir\svchost.exe notepad.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 752 b93c634e5494c31077e6d87e143c4da80517d3064910e9f786403394c52bd0f6.exe 752 b93c634e5494c31077e6d87e143c4da80517d3064910e9f786403394c52bd0f6.exe 1984 notepad.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 752 wrote to memory of 1100 752 b93c634e5494c31077e6d87e143c4da80517d3064910e9f786403394c52bd0f6.exe 27 PID 752 wrote to memory of 1100 752 b93c634e5494c31077e6d87e143c4da80517d3064910e9f786403394c52bd0f6.exe 27 PID 752 wrote to memory of 1100 752 b93c634e5494c31077e6d87e143c4da80517d3064910e9f786403394c52bd0f6.exe 27 PID 752 wrote to memory of 1100 752 b93c634e5494c31077e6d87e143c4da80517d3064910e9f786403394c52bd0f6.exe 27 PID 752 wrote to memory of 1100 752 b93c634e5494c31077e6d87e143c4da80517d3064910e9f786403394c52bd0f6.exe 27 PID 752 wrote to memory of 1100 752 b93c634e5494c31077e6d87e143c4da80517d3064910e9f786403394c52bd0f6.exe 27 PID 752 wrote to memory of 1100 752 b93c634e5494c31077e6d87e143c4da80517d3064910e9f786403394c52bd0f6.exe 27 PID 752 wrote to memory of 1100 752 b93c634e5494c31077e6d87e143c4da80517d3064910e9f786403394c52bd0f6.exe 27 PID 752 wrote to memory of 1100 752 b93c634e5494c31077e6d87e143c4da80517d3064910e9f786403394c52bd0f6.exe 27 PID 1100 wrote to memory of 820 1100 b93c634e5494c31077e6d87e143c4da80517d3064910e9f786403394c52bd0f6.exe 28 PID 1100 wrote to memory of 820 1100 b93c634e5494c31077e6d87e143c4da80517d3064910e9f786403394c52bd0f6.exe 28 PID 1100 wrote to memory of 820 1100 b93c634e5494c31077e6d87e143c4da80517d3064910e9f786403394c52bd0f6.exe 28 PID 1100 wrote to memory of 820 1100 b93c634e5494c31077e6d87e143c4da80517d3064910e9f786403394c52bd0f6.exe 28 PID 1100 wrote to memory of 820 1100 b93c634e5494c31077e6d87e143c4da80517d3064910e9f786403394c52bd0f6.exe 28 PID 1100 wrote to memory of 1984 1100 b93c634e5494c31077e6d87e143c4da80517d3064910e9f786403394c52bd0f6.exe 29 PID 1100 wrote to memory of 1984 1100 b93c634e5494c31077e6d87e143c4da80517d3064910e9f786403394c52bd0f6.exe 29 PID 1100 wrote to memory of 1984 1100 b93c634e5494c31077e6d87e143c4da80517d3064910e9f786403394c52bd0f6.exe 29 PID 1100 wrote to memory of 1984 1100 b93c634e5494c31077e6d87e143c4da80517d3064910e9f786403394c52bd0f6.exe 29 PID 1100 wrote to memory of 1984 1100 b93c634e5494c31077e6d87e143c4da80517d3064910e9f786403394c52bd0f6.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\b93c634e5494c31077e6d87e143c4da80517d3064910e9f786403394c52bd0f6.exe"C:\Users\Admin\AppData\Local\Temp\b93c634e5494c31077e6d87e143c4da80517d3064910e9f786403394c52bd0f6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\b93c634e5494c31077e6d87e143c4da80517d3064910e9f786403394c52bd0f6.exeC:\Users\Admin\AppData\Local\Temp\b93c634e5494c31077e6d87e143c4da80517d3064910e9f786403394c52bd0f6.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:820
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe3⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1984
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
732KB
MD5516988b83c8f25c047cc4bfaa24fd7eb
SHA14ebb58d6c0c7162a82b8432a1b7ad9f7409ebdd7
SHA256b93c634e5494c31077e6d87e143c4da80517d3064910e9f786403394c52bd0f6
SHA5121cea8a4c8f5728a6c3819f1309aaca03fa03cb8f818cd582265eea640ea8f7f7f4a9cd1c56dc6efa36a92230f6de8293a72cd05a098e4ff9cdcdc321afb81ecb