Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
23/11/2022, 15:10
Behavioral task
behavioral1
Sample
cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe
Resource
win10v2004-20221111-en
General
-
Target
cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe
-
Size
564KB
-
MD5
e4c1b78411ca25bb55276168fd860369
-
SHA1
42d0ac19e6309cde8bf052f2e41fe32d25340fb7
-
SHA256
cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26
-
SHA512
1162365cea20f9610f38fe236e475525ff28cef35ee96182689cbf133e2682d75de4309b0d778fcf84a50baca5f9031b370e13bc91d46464f8ac6f4b60ae8888
-
SSDEEP
12288:v6Wq4aaE6KwyF5L0Y2D1PqL9oCgL/MyZBRhK2JYF4sKqk+F8YHnI:tthEVaPqL9G7MeHK2S3lo
Malware Config
Extracted
xtremerat
xt.no-ip.info
Signatures
-
Detect XtremeRAT payload 9 IoCs
resource yara_rule behavioral1/memory/1252-64-0x0000000000C80000-0x0000000000C96000-memory.dmp family_xtremerat behavioral1/memory/1252-68-0x0000000000C80000-0x0000000000C96000-memory.dmp family_xtremerat behavioral1/memory/1252-70-0x0000000000C80000-0x0000000000C96000-memory.dmp family_xtremerat behavioral1/memory/1744-73-0x0000000000000000-mapping.dmp family_xtremerat behavioral1/memory/1744-75-0x0000000000C80000-0x0000000000C96000-memory.dmp family_xtremerat behavioral1/memory/1816-78-0x0000000000000000-mapping.dmp family_xtremerat behavioral1/memory/1252-80-0x0000000000C80000-0x0000000000C96000-memory.dmp family_xtremerat behavioral1/memory/1816-81-0x0000000000C80000-0x0000000000C96000-memory.dmp family_xtremerat behavioral1/memory/1816-82-0x0000000000C80000-0x0000000000C96000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
resource yara_rule behavioral1/memory/1252-56-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral1/memory/1252-58-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral1/memory/1252-59-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral1/memory/1252-63-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral1/memory/1252-64-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral1/memory/620-65-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/1252-67-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/1252-68-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral1/memory/620-69-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/1252-70-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral1/memory/1744-75-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral1/memory/1252-80-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral1/memory/1816-81-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral1/memory/1816-82-0x0000000000C80000-0x0000000000C96000-memory.dmp upx -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/620-65-0x0000000000400000-0x00000000004BA000-memory.dmp autoit_exe behavioral1/memory/620-69-0x0000000000400000-0x00000000004BA000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 620 set thread context of 1252 620 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 27 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 10 IoCs
pid Process 620 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 620 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 620 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 620 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 620 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 620 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 620 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 620 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 620 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 620 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe -
Suspicious use of SendNotifyMessage 10 IoCs
pid Process 620 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 620 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 620 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 620 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 620 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 620 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 620 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 620 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 620 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 620 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1816 notepad.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 620 wrote to memory of 1252 620 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 27 PID 620 wrote to memory of 1252 620 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 27 PID 620 wrote to memory of 1252 620 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 27 PID 620 wrote to memory of 1252 620 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 27 PID 620 wrote to memory of 1252 620 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 27 PID 620 wrote to memory of 1252 620 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 27 PID 620 wrote to memory of 1252 620 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 27 PID 620 wrote to memory of 1252 620 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 27 PID 1252 wrote to memory of 1744 1252 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 28 PID 1252 wrote to memory of 1744 1252 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 28 PID 1252 wrote to memory of 1744 1252 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 28 PID 1252 wrote to memory of 1744 1252 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 28 PID 1252 wrote to memory of 1744 1252 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 28 PID 1252 wrote to memory of 1816 1252 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 29 PID 1252 wrote to memory of 1816 1252 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 29 PID 1252 wrote to memory of 1816 1252 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 29 PID 1252 wrote to memory of 1816 1252 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 29 PID 1252 wrote to memory of 1816 1252 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe"C:\Users\Admin\AppData\Local\Temp\cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\AppData\Local\Temp\cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe"C:\Users\Admin\AppData\Local\Temp\cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵PID:1744
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe3⤵
- Suspicious use of SetWindowsHookEx
PID:1816
-
-