Analysis
-
max time kernel
267s -
max time network
285s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23/11/2022, 15:10
Behavioral task
behavioral1
Sample
cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe
Resource
win10v2004-20221111-en
General
-
Target
cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe
-
Size
564KB
-
MD5
e4c1b78411ca25bb55276168fd860369
-
SHA1
42d0ac19e6309cde8bf052f2e41fe32d25340fb7
-
SHA256
cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26
-
SHA512
1162365cea20f9610f38fe236e475525ff28cef35ee96182689cbf133e2682d75de4309b0d778fcf84a50baca5f9031b370e13bc91d46464f8ac6f4b60ae8888
-
SSDEEP
12288:v6Wq4aaE6KwyF5L0Y2D1PqL9oCgL/MyZBRhK2JYF4sKqk+F8YHnI:tthEVaPqL9G7MeHK2S3lo
Malware Config
Extracted
xtremerat
xt.no-ip.info
Signatures
-
Detect XtremeRAT payload 11 IoCs
resource yara_rule behavioral2/memory/2488-139-0x0000000000C80000-0x0000000000C96000-memory.dmp family_xtremerat behavioral2/memory/2488-140-0x0000000000C80000-0x0000000000C96000-memory.dmp family_xtremerat behavioral2/memory/2488-142-0x0000000000C80000-0x0000000000C96000-memory.dmp family_xtremerat behavioral2/memory/4160-143-0x0000000000000000-mapping.dmp family_xtremerat behavioral2/memory/4160-144-0x0000000000C80000-0x0000000000C96000-memory.dmp family_xtremerat behavioral2/memory/4244-145-0x0000000000000000-mapping.dmp family_xtremerat behavioral2/memory/1912-146-0x0000000000000000-mapping.dmp family_xtremerat behavioral2/memory/1912-147-0x0000000000C80000-0x0000000000C96000-memory.dmp family_xtremerat behavioral2/memory/4244-148-0x0000000000C80000-0x0000000000C96000-memory.dmp family_xtremerat behavioral2/memory/2488-149-0x0000000000C80000-0x0000000000C96000-memory.dmp family_xtremerat behavioral2/memory/4244-150-0x0000000000C80000-0x0000000000C96000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
resource yara_rule behavioral2/memory/3132-132-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/3132-133-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/2488-135-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral2/memory/2488-137-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/2488-138-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral2/memory/2488-139-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral2/memory/2488-140-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral2/memory/3132-141-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/2488-142-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral2/memory/4160-144-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral2/memory/1912-147-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral2/memory/4244-148-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral2/memory/2488-149-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral2/memory/4244-150-0x0000000000C80000-0x0000000000C96000-memory.dmp upx -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3132-132-0x0000000000400000-0x00000000004BA000-memory.dmp autoit_exe behavioral2/memory/3132-133-0x0000000000400000-0x00000000004BA000-memory.dmp autoit_exe behavioral2/memory/3132-141-0x0000000000400000-0x00000000004BA000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3132 set thread context of 2488 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 81 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 17 IoCs
pid Process 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe -
Suspicious use of SendNotifyMessage 17 IoCs
pid Process 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4244 notepad.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3132 wrote to memory of 2488 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 81 PID 3132 wrote to memory of 2488 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 81 PID 3132 wrote to memory of 2488 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 81 PID 3132 wrote to memory of 2488 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 81 PID 3132 wrote to memory of 2488 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 81 PID 3132 wrote to memory of 2488 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 81 PID 3132 wrote to memory of 2488 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 81 PID 3132 wrote to memory of 2488 3132 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 81 PID 2488 wrote to memory of 4160 2488 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 82 PID 2488 wrote to memory of 4160 2488 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 82 PID 2488 wrote to memory of 4160 2488 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 82 PID 2488 wrote to memory of 4160 2488 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 82 PID 2488 wrote to memory of 4244 2488 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 83 PID 2488 wrote to memory of 4244 2488 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 83 PID 2488 wrote to memory of 4244 2488 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 83 PID 2488 wrote to memory of 4244 2488 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 83 PID 2488 wrote to memory of 1912 2488 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 84 PID 2488 wrote to memory of 1912 2488 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 84 PID 2488 wrote to memory of 1912 2488 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 84 PID 2488 wrote to memory of 1912 2488 cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe"C:\Users\Admin\AppData\Local\Temp\cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe"C:\Users\Admin\AppData\Local\Temp\cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵PID:4160
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe3⤵
- Suspicious use of SetWindowsHookEx
PID:4244
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe3⤵PID:1912
-
-