Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    23/11/2022, 15:10

General

  • Target

    cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe

  • Size

    564KB

  • MD5

    e4c1b78411ca25bb55276168fd860369

  • SHA1

    42d0ac19e6309cde8bf052f2e41fe32d25340fb7

  • SHA256

    cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26

  • SHA512

    1162365cea20f9610f38fe236e475525ff28cef35ee96182689cbf133e2682d75de4309b0d778fcf84a50baca5f9031b370e13bc91d46464f8ac6f4b60ae8888

  • SSDEEP

    12288:v6Wq4aaE6KwyF5L0Y2D1PqL9oCgL/MyZBRhK2JYF4sKqk+F8YHnI:tthEVaPqL9G7MeHK2S3lo

Malware Config

Extracted

Family

xtremerat

C2

xt.no-ip.info

Signatures

  • Detect XtremeRAT payload 9 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SendNotifyMessage 10 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe
    "C:\Users\Admin\AppData\Local\Temp\cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:620
    • C:\Users\Admin\AppData\Local\Temp\cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe
      "C:\Users\Admin\AppData\Local\Temp\cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1252
      • C:\Windows\SysWOW64\svchost.exe
        svchost.exe
        3⤵
          PID:1744
        • C:\Windows\SysWOW64\notepad.exe
          notepad.exe
          3⤵
          • Suspicious use of SetWindowsHookEx
          PID:1816

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/620-65-0x0000000000400000-0x00000000004BA000-memory.dmp

            Filesize

            744KB

          • memory/620-69-0x0000000000400000-0x00000000004BA000-memory.dmp

            Filesize

            744KB

          • memory/620-54-0x0000000075711000-0x0000000075713000-memory.dmp

            Filesize

            8KB

          • memory/620-66-0x0000000002750000-0x000000000280A000-memory.dmp

            Filesize

            744KB

          • memory/1252-67-0x0000000000400000-0x00000000004BA000-memory.dmp

            Filesize

            744KB

          • memory/1252-68-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB

          • memory/1252-63-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB

          • memory/1252-64-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB

          • memory/1252-58-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB

          • memory/1252-56-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB

          • memory/1252-59-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB

          • memory/1252-55-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB

          • memory/1252-70-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB

          • memory/1252-80-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB

          • memory/1744-75-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB

          • memory/1816-81-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB

          • memory/1816-82-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB