Analysis

  • max time kernel
    135s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23/11/2022, 14:03

General

  • Target

    6c33c0c03e2ed173fcf13e78c5bf6c6b4330fe1e2d4d0ed0a3e08bd7e85df964.exe

  • Size

    520KB

  • MD5

    2e1b2aaeaef46f92436616cf7912f931

  • SHA1

    db8e74884c960d1bc297a6ae15f1aa30d958e3ce

  • SHA256

    6c33c0c03e2ed173fcf13e78c5bf6c6b4330fe1e2d4d0ed0a3e08bd7e85df964

  • SHA512

    0290bd2b250b3c626b38648d83dad74b0f7fc124da63d58cf5fde1f0be86843bccec3ee94237b8b0d775eccdb32334e05a8ad9e93c8274468e0fbc9551546ea1

  • SSDEEP

    12288:RWXClV2A9GguHZ3+IuuD+nij6XENkjHMmQR79DaU:RZIHh/sij6XENkyR79WU

Malware Config

Signatures

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 12 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6c33c0c03e2ed173fcf13e78c5bf6c6b4330fe1e2d4d0ed0a3e08bd7e85df964.exe
    "C:\Users\Admin\AppData\Local\Temp\6c33c0c03e2ed173fcf13e78c5bf6c6b4330fe1e2d4d0ed0a3e08bd7e85df964.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1828
    • C:\Users\Admin\AppData\Local\Temp\6c33c0c03e2ed173fcf13e78c5bf6c6b4330fe1e2d4d0ed0a3e08bd7e85df964.exe
      "C:\Users\Admin\AppData\Local\Temp\6c33c0c03e2ed173fcf13e78c5bf6c6b4330fe1e2d4d0ed0a3e08bd7e85df964.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1476
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:1036
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
            PID:700
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            3⤵
              PID:1240
            • C:\Windows\SysWOW64\explorer.exe
              explorer.exe
              3⤵
                PID:1816
              • C:\Program Files\Internet Explorer\iexplore.exe
                "C:\Program Files\Internet Explorer\iexplore.exe"
                3⤵
                  PID:1876
                • C:\Windows\SysWOW64\explorer.exe
                  explorer.exe
                  3⤵
                    PID:668
                  • C:\Program Files\Internet Explorer\iexplore.exe
                    "C:\Program Files\Internet Explorer\iexplore.exe"
                    3⤵
                      PID:1760
                    • C:\Windows\SysWOW64\explorer.exe
                      explorer.exe
                      3⤵
                        PID:1872
                      • C:\Program Files\Internet Explorer\iexplore.exe
                        "C:\Program Files\Internet Explorer\iexplore.exe"
                        3⤵
                          PID:1692
                        • C:\Windows\SysWOW64\explorer.exe
                          explorer.exe
                          3⤵
                            PID:340
                          • C:\Windows\SysWOW64\explorer.exe
                            explorer.exe
                            3⤵
                              PID:796
                            • C:\Program Files\Internet Explorer\iexplore.exe
                              "C:\Program Files\Internet Explorer\iexplore.exe"
                              3⤵
                                PID:1372
                              • C:\Program Files\Internet Explorer\iexplore.exe
                                "C:\Program Files\Internet Explorer\iexplore.exe"
                                3⤵
                                  PID:1096
                                • C:\Windows\SysWOW64\explorer.exe
                                  explorer.exe
                                  3⤵
                                    PID:812
                                  • C:\Program Files\Internet Explorer\iexplore.exe
                                    "C:\Program Files\Internet Explorer\iexplore.exe"
                                    3⤵
                                      PID:1016
                                    • C:\Windows\SysWOW64\explorer.exe
                                      explorer.exe
                                      3⤵
                                        PID:928
                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                        "C:\Program Files\Internet Explorer\iexplore.exe"
                                        3⤵
                                          PID:868
                                        • C:\Windows\SysWOW64\explorer.exe
                                          explorer.exe
                                          3⤵
                                            PID:1616
                                          • C:\Program Files\Internet Explorer\iexplore.exe
                                            "C:\Program Files\Internet Explorer\iexplore.exe"
                                            3⤵
                                              PID:1820
                                            • C:\Windows\SysWOW64\explorer.exe
                                              explorer.exe
                                              3⤵
                                                PID:484
                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                "C:\Program Files\Internet Explorer\iexplore.exe"
                                                3⤵
                                                  PID:612
                                                • C:\Windows\SysWOW64\explorer.exe
                                                  explorer.exe
                                                  3⤵
                                                    PID:1672
                                                  • C:\Program Files\Internet Explorer\iexplore.exe
                                                    "C:\Program Files\Internet Explorer\iexplore.exe"
                                                    3⤵
                                                      PID:824
                                                    • C:\Windows\SysWOW64\explorer.exe
                                                      explorer.exe
                                                      3⤵
                                                        PID:1008
                                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                                        "C:\Program Files\Internet Explorer\iexplore.exe"
                                                        3⤵
                                                          PID:524
                                                        • C:\Windows\SysWOW64\explorer.exe
                                                          explorer.exe
                                                          3⤵
                                                            PID:1712
                                                          • C:\Program Files\Internet Explorer\iexplore.exe
                                                            "C:\Program Files\Internet Explorer\iexplore.exe"
                                                            3⤵
                                                              PID:2024
                                                            • C:\Windows\SysWOW64\explorer.exe
                                                              explorer.exe
                                                              3⤵
                                                                PID:1680
                                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                                "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                3⤵
                                                                  PID:300
                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                  explorer.exe
                                                                  3⤵
                                                                    PID:1136
                                                                  • C:\Program Files\Internet Explorer\iexplore.exe
                                                                    "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                    3⤵
                                                                      PID:1548
                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                      explorer.exe
                                                                      3⤵
                                                                        PID:1860
                                                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                                                        "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                        3⤵
                                                                          PID:988
                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                          explorer.exe
                                                                          3⤵
                                                                            PID:1540
                                                                          • C:\Windows\{9043-8547-9771-90}\appinit.exe
                                                                            "C:\Windows\{9043-8547-9771-90}\appinit.exe"
                                                                            3⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetThreadContext
                                                                            PID:552
                                                                            • C:\Windows\{9043-8547-9771-90}\appinit.exe
                                                                              "C:\Windows\{9043-8547-9771-90}\appinit.exe"
                                                                              4⤵
                                                                              • Executes dropped EXE
                                                                              • Adds Run key to start application
                                                                              • Suspicious use of SetThreadContext
                                                                              • Drops file in Windows directory
                                                                              PID:1656
                                                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                5⤵
                                                                                  PID:844
                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                  explorer.exe
                                                                                  5⤵
                                                                                  • Adds Run key to start application
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:1608

                                                                        Network

                                                                              MITRE ATT&CK Enterprise v6

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads

                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\E75qVgi25Ft3e12x\E75qVgi25Ft3e12x.dat

                                                                                Filesize

                                                                                2B

                                                                                MD5

                                                                                93e00066d099c0485cfffa1359246d26

                                                                                SHA1

                                                                                bc69a773f37b2f2071e25f755a66d47b871e5d98

                                                                                SHA256

                                                                                3b271649a94ad5be4ef46ecbb6a4e7363e8498b7e69b751737bf30df2e0d1dde

                                                                                SHA512

                                                                                d3dfe508cacae7d36f13908134b5b438b87429fcf93ccb060bcfa346c04633a99e9ca497297418c969537be1da2405171982794055dd0f52e59a82720d3b3d02

                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\E75qVgi25Ft3e12x\E75qVgi25Ft3e12x.nfo

                                                                                Filesize

                                                                                3KB

                                                                                MD5

                                                                                05b1ef8e038e2ad1d7a1cd38e3af1302

                                                                                SHA1

                                                                                7ac8d37378cd67bdd7a42d4e732a67086ca091a5

                                                                                SHA256

                                                                                24d3a86d770068c5e3b2fed62815912faabd2ccf5a229b312406342d9318678b

                                                                                SHA512

                                                                                ed63c082f2708e552f0dd3dc7fb874ab52f37d5793005c8aeb4eb1a4a1281dfe0212853551e7a4ad588f96b24d002ffae33b55cf24b5ace52b4112b4353fe063

                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\E75qVgi25Ft3e12x\E75qVgi25Ft3e12x.nfo

                                                                                Filesize

                                                                                3KB

                                                                                MD5

                                                                                05b1ef8e038e2ad1d7a1cd38e3af1302

                                                                                SHA1

                                                                                7ac8d37378cd67bdd7a42d4e732a67086ca091a5

                                                                                SHA256

                                                                                24d3a86d770068c5e3b2fed62815912faabd2ccf5a229b312406342d9318678b

                                                                                SHA512

                                                                                ed63c082f2708e552f0dd3dc7fb874ab52f37d5793005c8aeb4eb1a4a1281dfe0212853551e7a4ad588f96b24d002ffae33b55cf24b5ace52b4112b4353fe063

                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\E75qVgi25Ft3e12x\E75qVgi25Ft3e12x.svr

                                                                                Filesize

                                                                                358KB

                                                                                MD5

                                                                                ad69242f4bf9548496051bd95ac05e1e

                                                                                SHA1

                                                                                913292f6b83adf41337fd50201ad341500abc8b0

                                                                                SHA256

                                                                                2663fdfe0fe4c37532f919282d035579bf84a895be5971982437cffbd41bdb1b

                                                                                SHA512

                                                                                09bed3adc8427e4aeec4e32dfd0640da71d2839b62973e4bae94f0965c5836028511295d99be878af388789fc020117972c3cf51d5a2ef1899aeb9d43c2fd94e

                                                                              • C:\Windows\{9043-8547-9771-90}\appinit.exe

                                                                                Filesize

                                                                                520KB

                                                                                MD5

                                                                                2e1b2aaeaef46f92436616cf7912f931

                                                                                SHA1

                                                                                db8e74884c960d1bc297a6ae15f1aa30d958e3ce

                                                                                SHA256

                                                                                6c33c0c03e2ed173fcf13e78c5bf6c6b4330fe1e2d4d0ed0a3e08bd7e85df964

                                                                                SHA512

                                                                                0290bd2b250b3c626b38648d83dad74b0f7fc124da63d58cf5fde1f0be86843bccec3ee94237b8b0d775eccdb32334e05a8ad9e93c8274468e0fbc9551546ea1

                                                                              • C:\Windows\{9043-8547-9771-90}\appinit.exe

                                                                                Filesize

                                                                                520KB

                                                                                MD5

                                                                                2e1b2aaeaef46f92436616cf7912f931

                                                                                SHA1

                                                                                db8e74884c960d1bc297a6ae15f1aa30d958e3ce

                                                                                SHA256

                                                                                6c33c0c03e2ed173fcf13e78c5bf6c6b4330fe1e2d4d0ed0a3e08bd7e85df964

                                                                                SHA512

                                                                                0290bd2b250b3c626b38648d83dad74b0f7fc124da63d58cf5fde1f0be86843bccec3ee94237b8b0d775eccdb32334e05a8ad9e93c8274468e0fbc9551546ea1

                                                                              • C:\Windows\{9043-8547-9771-90}\appinit.exe

                                                                                Filesize

                                                                                520KB

                                                                                MD5

                                                                                2e1b2aaeaef46f92436616cf7912f931

                                                                                SHA1

                                                                                db8e74884c960d1bc297a6ae15f1aa30d958e3ce

                                                                                SHA256

                                                                                6c33c0c03e2ed173fcf13e78c5bf6c6b4330fe1e2d4d0ed0a3e08bd7e85df964

                                                                                SHA512

                                                                                0290bd2b250b3c626b38648d83dad74b0f7fc124da63d58cf5fde1f0be86843bccec3ee94237b8b0d775eccdb32334e05a8ad9e93c8274468e0fbc9551546ea1

                                                                              • \Windows\{9043-8547-9771-90}\appinit.exe

                                                                                Filesize

                                                                                520KB

                                                                                MD5

                                                                                2e1b2aaeaef46f92436616cf7912f931

                                                                                SHA1

                                                                                db8e74884c960d1bc297a6ae15f1aa30d958e3ce

                                                                                SHA256

                                                                                6c33c0c03e2ed173fcf13e78c5bf6c6b4330fe1e2d4d0ed0a3e08bd7e85df964

                                                                                SHA512

                                                                                0290bd2b250b3c626b38648d83dad74b0f7fc124da63d58cf5fde1f0be86843bccec3ee94237b8b0d775eccdb32334e05a8ad9e93c8274468e0fbc9551546ea1

                                                                              • \Windows\{9043-8547-9771-90}\appinit.exe

                                                                                Filesize

                                                                                520KB

                                                                                MD5

                                                                                2e1b2aaeaef46f92436616cf7912f931

                                                                                SHA1

                                                                                db8e74884c960d1bc297a6ae15f1aa30d958e3ce

                                                                                SHA256

                                                                                6c33c0c03e2ed173fcf13e78c5bf6c6b4330fe1e2d4d0ed0a3e08bd7e85df964

                                                                                SHA512

                                                                                0290bd2b250b3c626b38648d83dad74b0f7fc124da63d58cf5fde1f0be86843bccec3ee94237b8b0d775eccdb32334e05a8ad9e93c8274468e0fbc9551546ea1

                                                                              • memory/552-90-0x0000000073070000-0x000000007361B000-memory.dmp

                                                                                Filesize

                                                                                5.7MB

                                                                              • memory/1476-61-0x0000000000400000-0x000000000046F000-memory.dmp

                                                                                Filesize

                                                                                444KB

                                                                              • memory/1476-69-0x0000000000400000-0x000000000046F000-memory.dmp

                                                                                Filesize

                                                                                444KB

                                                                              • memory/1476-70-0x0000000000400000-0x000000000046F000-memory.dmp

                                                                                Filesize

                                                                                444KB

                                                                              • memory/1476-71-0x0000000000400000-0x000000000046F000-memory.dmp

                                                                                Filesize

                                                                                444KB

                                                                              • memory/1476-66-0x0000000000400000-0x000000000046F000-memory.dmp

                                                                                Filesize

                                                                                444KB

                                                                              • memory/1476-63-0x0000000000400000-0x000000000046F000-memory.dmp

                                                                                Filesize

                                                                                444KB

                                                                              • memory/1476-62-0x0000000000400000-0x000000000046F000-memory.dmp

                                                                                Filesize

                                                                                444KB

                                                                              • memory/1476-60-0x0000000000400000-0x000000000046F000-memory.dmp

                                                                                Filesize

                                                                                444KB

                                                                              • memory/1476-59-0x0000000000400000-0x000000000046F000-memory.dmp

                                                                                Filesize

                                                                                444KB

                                                                              • memory/1476-57-0x0000000000400000-0x000000000046F000-memory.dmp

                                                                                Filesize

                                                                                444KB

                                                                              • memory/1476-56-0x0000000000400000-0x000000000046F000-memory.dmp

                                                                                Filesize

                                                                                444KB

                                                                              • memory/1476-95-0x0000000000400000-0x000000000046F000-memory.dmp

                                                                                Filesize

                                                                                444KB

                                                                              • memory/1608-102-0x0000000001610000-0x0000000001720000-memory.dmp

                                                                                Filesize

                                                                                1.1MB

                                                                              • memory/1608-108-0x0000000001610000-0x0000000001720000-memory.dmp

                                                                                Filesize

                                                                                1.1MB

                                                                              • memory/1608-118-0x00000000016C5000-0x000000000171E000-memory.dmp

                                                                                Filesize

                                                                                356KB

                                                                              • memory/1608-116-0x0000000001611000-0x00000000016C5000-memory.dmp

                                                                                Filesize

                                                                                720KB

                                                                              • memory/1608-99-0x0000000001610000-0x0000000001720000-memory.dmp

                                                                                Filesize

                                                                                1.1MB

                                                                              • memory/1608-98-0x0000000001610000-0x0000000001720000-memory.dmp

                                                                                Filesize

                                                                                1.1MB

                                                                              • memory/1608-115-0x00000000016C5000-0x000000000171E000-memory.dmp

                                                                                Filesize

                                                                                356KB

                                                                              • memory/1608-105-0x0000000001610000-0x0000000001720000-memory.dmp

                                                                                Filesize

                                                                                1.1MB

                                                                              • memory/1608-111-0x0000000001610000-0x0000000001720000-memory.dmp

                                                                                Filesize

                                                                                1.1MB

                                                                              • memory/1608-110-0x0000000001610000-0x0000000001720000-memory.dmp

                                                                                Filesize

                                                                                1.1MB

                                                                              • memory/1608-112-0x0000000001610000-0x0000000001720000-memory.dmp

                                                                                Filesize

                                                                                1.1MB

                                                                              • memory/1656-93-0x0000000000400000-0x000000000046F000-memory.dmp

                                                                                Filesize

                                                                                444KB

                                                                              • memory/1656-117-0x0000000000400000-0x000000000046F000-memory.dmp

                                                                                Filesize

                                                                                444KB

                                                                              • memory/1656-96-0x0000000000400000-0x000000000046F000-memory.dmp

                                                                                Filesize

                                                                                444KB

                                                                              • memory/1828-67-0x0000000074610000-0x0000000074BBB000-memory.dmp

                                                                                Filesize

                                                                                5.7MB

                                                                              • memory/1828-55-0x0000000074610000-0x0000000074BBB000-memory.dmp

                                                                                Filesize

                                                                                5.7MB

                                                                              • memory/1828-54-0x0000000075611000-0x0000000075613000-memory.dmp

                                                                                Filesize

                                                                                8KB