Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    23/11/2022, 16:40

General

  • Target

    f4606574e0be172e8b43d7d4a31fd8d33bca5e8e596cbbf183b7136ff44c1471.exe

  • Size

    2.0MB

  • MD5

    18ec82e6803a882e6409399d5fefb810

  • SHA1

    b1a9b23927bc033f7df59a93349fce0416ad3f5a

  • SHA256

    f4606574e0be172e8b43d7d4a31fd8d33bca5e8e596cbbf183b7136ff44c1471

  • SHA512

    f9b29cb3a4a9412322b5e19939372d74578c1764288a2caf439340feabc3f74dc248d728722c10739db860cfb1e35d0064a25ce294474e0e7cb044b443b3a0d6

  • SSDEEP

    49152:rHFaaHayaoaaaoaGhF3Ow3yaBafimXnhsi:rHFamfBvxnhF3OwiGhe2i

Malware Config

Extracted

Family

xtremerat

C2

muawayhue2.no-ip.org

᪸᳴ਲ਼蠀Sites qmuawayhue2.no-ip.org

Signatures

  • Detect XtremeRAT payload 17 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Executes dropped EXE 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Adds Run key to start application 2 TTPs 9 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f4606574e0be172e8b43d7d4a31fd8d33bca5e8e596cbbf183b7136ff44c1471.exe
    "C:\Users\Admin\AppData\Local\Temp\f4606574e0be172e8b43d7d4a31fd8d33bca5e8e596cbbf183b7136ff44c1471.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:560
    • C:\Users\Admin\AppData\Local\Temp\f4606574e0be172e8b43d7d4a31fd8d33bca5e8e596cbbf183b7136ff44c1471.exe
      "C:\Users\Admin\AppData\Local\Temp\f4606574e0be172e8b43d7d4a31fd8d33bca5e8e596cbbf183b7136ff44c1471.exe"
      2⤵
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:1356
      • C:\Windows\SysWOW64\svchost.exe
        svchost.exe
        3⤵
        • Modifies Installed Components in the registry
        • Adds Run key to start application
        PID:1664
      • C:\Windows\SysWOW64\explorer.exe
        explorer.exe
        3⤵
        • Modifies Installed Components in the registry
        • Adds Run key to start application
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:1504
      • C:\Windows\722lif3 muaway 2014³.exe
        "C:\Windows\722lif3 muaway 2014³.exe"
        3⤵
        • Executes dropped EXE
        PID:1184

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\722lif3 muaway 2014³.exe

          Filesize

          105KB

          MD5

          37060ad5f5fa42f17c9171c74d85a11c

          SHA1

          69a548f7a1f222efbb5883b88b07d165dee5b5a7

          SHA256

          c2799c3284ef8e00b407fd3b36395f12709434e1f09dddb0b246218f733aaa44

          SHA512

          b895a14a405c685ada82e5eeee993d0992edad75aa6051abca8b982466a1ac80c85d68f13a52e43a257235d46a23fb02e65aab4d96022d38ed58bd036932e77b

        • C:\Windows\722lif3 muaway 2014³.exe

          Filesize

          105KB

          MD5

          37060ad5f5fa42f17c9171c74d85a11c

          SHA1

          69a548f7a1f222efbb5883b88b07d165dee5b5a7

          SHA256

          c2799c3284ef8e00b407fd3b36395f12709434e1f09dddb0b246218f733aaa44

          SHA512

          b895a14a405c685ada82e5eeee993d0992edad75aa6051abca8b982466a1ac80c85d68f13a52e43a257235d46a23fb02e65aab4d96022d38ed58bd036932e77b

        • C:\Windows\svchost\svchost.exe

          Filesize

          2.0MB

          MD5

          18ec82e6803a882e6409399d5fefb810

          SHA1

          b1a9b23927bc033f7df59a93349fce0416ad3f5a

          SHA256

          f4606574e0be172e8b43d7d4a31fd8d33bca5e8e596cbbf183b7136ff44c1471

          SHA512

          f9b29cb3a4a9412322b5e19939372d74578c1764288a2caf439340feabc3f74dc248d728722c10739db860cfb1e35d0064a25ce294474e0e7cb044b443b3a0d6

        • memory/1184-89-0x0000000004BC5000-0x0000000004BD6000-memory.dmp

          Filesize

          68KB

        • memory/1184-85-0x0000000000CC0000-0x0000000000CE2000-memory.dmp

          Filesize

          136KB

        • memory/1356-63-0x0000000010000000-0x0000000010065000-memory.dmp

          Filesize

          404KB

        • memory/1356-56-0x0000000010000000-0x0000000010065000-memory.dmp

          Filesize

          404KB

        • memory/1356-65-0x0000000010000000-0x0000000010065000-memory.dmp

          Filesize

          404KB

        • memory/1356-67-0x0000000010000000-0x0000000010065000-memory.dmp

          Filesize

          404KB

        • memory/1356-68-0x0000000076041000-0x0000000076043000-memory.dmp

          Filesize

          8KB

        • memory/1356-69-0x0000000010000000-0x0000000010065000-memory.dmp

          Filesize

          404KB

        • memory/1356-70-0x0000000010000000-0x0000000010065000-memory.dmp

          Filesize

          404KB

        • memory/1356-57-0x0000000010000000-0x0000000010065000-memory.dmp

          Filesize

          404KB

        • memory/1356-59-0x0000000010000000-0x0000000010065000-memory.dmp

          Filesize

          404KB

        • memory/1356-60-0x0000000010000000-0x0000000010065000-memory.dmp

          Filesize

          404KB

        • memory/1356-82-0x0000000010000000-0x0000000010065000-memory.dmp

          Filesize

          404KB

        • memory/1356-62-0x0000000010000000-0x0000000010065000-memory.dmp

          Filesize

          404KB

        • memory/1356-61-0x0000000010000000-0x0000000010065000-memory.dmp

          Filesize

          404KB

        • memory/1504-84-0x00000000743B1000-0x00000000743B3000-memory.dmp

          Filesize

          8KB

        • memory/1504-87-0x0000000010000000-0x0000000010065000-memory.dmp

          Filesize

          404KB

        • memory/1504-91-0x0000000010000000-0x0000000010065000-memory.dmp

          Filesize

          404KB

        • memory/1664-75-0x0000000010000000-0x0000000010065000-memory.dmp

          Filesize

          404KB

        • memory/1664-90-0x0000000010000000-0x0000000010065000-memory.dmp

          Filesize

          404KB