Analysis

  • max time kernel
    267s
  • max time network
    285s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/11/2022, 15:10

General

  • Target

    cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe

  • Size

    564KB

  • MD5

    e4c1b78411ca25bb55276168fd860369

  • SHA1

    42d0ac19e6309cde8bf052f2e41fe32d25340fb7

  • SHA256

    cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26

  • SHA512

    1162365cea20f9610f38fe236e475525ff28cef35ee96182689cbf133e2682d75de4309b0d778fcf84a50baca5f9031b370e13bc91d46464f8ac6f4b60ae8888

  • SSDEEP

    12288:v6Wq4aaE6KwyF5L0Y2D1PqL9oCgL/MyZBRhK2JYF4sKqk+F8YHnI:tthEVaPqL9G7MeHK2S3lo

Malware Config

Extracted

Family

xtremerat

C2

xt.no-ip.info

Signatures

  • Detect XtremeRAT payload 11 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 17 IoCs
  • Suspicious use of SendNotifyMessage 17 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe
    "C:\Users\Admin\AppData\Local\Temp\cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3132
    • C:\Users\Admin\AppData\Local\Temp\cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe
      "C:\Users\Admin\AppData\Local\Temp\cfcd66107d3949509eb1778ab187050e364e2ee615fe64326f846149f18e6a26.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2488
      • C:\Windows\SysWOW64\svchost.exe
        svchost.exe
        3⤵
          PID:4160
        • C:\Windows\SysWOW64\notepad.exe
          notepad.exe
          3⤵
          • Suspicious use of SetWindowsHookEx
          PID:4244
        • C:\Windows\SysWOW64\notepad.exe
          notepad.exe
          3⤵
            PID:1912

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/1912-147-0x0000000000C80000-0x0000000000C96000-memory.dmp

              Filesize

              88KB

            • memory/2488-149-0x0000000000C80000-0x0000000000C96000-memory.dmp

              Filesize

              88KB

            • memory/2488-135-0x0000000000C80000-0x0000000000C96000-memory.dmp

              Filesize

              88KB

            • memory/2488-137-0x0000000000400000-0x00000000004BA000-memory.dmp

              Filesize

              744KB

            • memory/2488-138-0x0000000000C80000-0x0000000000C96000-memory.dmp

              Filesize

              88KB

            • memory/2488-139-0x0000000000C80000-0x0000000000C96000-memory.dmp

              Filesize

              88KB

            • memory/2488-140-0x0000000000C80000-0x0000000000C96000-memory.dmp

              Filesize

              88KB

            • memory/2488-142-0x0000000000C80000-0x0000000000C96000-memory.dmp

              Filesize

              88KB

            • memory/3132-141-0x0000000000400000-0x00000000004BA000-memory.dmp

              Filesize

              744KB

            • memory/3132-132-0x0000000000400000-0x00000000004BA000-memory.dmp

              Filesize

              744KB

            • memory/3132-133-0x0000000000400000-0x00000000004BA000-memory.dmp

              Filesize

              744KB

            • memory/4160-144-0x0000000000C80000-0x0000000000C96000-memory.dmp

              Filesize

              88KB

            • memory/4244-148-0x0000000000C80000-0x0000000000C96000-memory.dmp

              Filesize

              88KB

            • memory/4244-150-0x0000000000C80000-0x0000000000C96000-memory.dmp

              Filesize

              88KB