Analysis

  • max time kernel
    157s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/11/2022, 16:40

General

  • Target

    f4606574e0be172e8b43d7d4a31fd8d33bca5e8e596cbbf183b7136ff44c1471.exe

  • Size

    2.0MB

  • MD5

    18ec82e6803a882e6409399d5fefb810

  • SHA1

    b1a9b23927bc033f7df59a93349fce0416ad3f5a

  • SHA256

    f4606574e0be172e8b43d7d4a31fd8d33bca5e8e596cbbf183b7136ff44c1471

  • SHA512

    f9b29cb3a4a9412322b5e19939372d74578c1764288a2caf439340feabc3f74dc248d728722c10739db860cfb1e35d0064a25ce294474e0e7cb044b443b3a0d6

  • SSDEEP

    49152:rHFaaHayaoaaaoaGhF3Ow3yaBafimXnhsi:rHFamfBvxnhF3OwiGhe2i

Malware Config

Extracted

Family

xtremerat

C2

muawayhue2.no-ip.org

᪸᳴ਲ਼蠀Sites qmuawayhue2.no-ip.org

Signatures

  • Detect XtremeRAT payload 11 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Executes dropped EXE 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f4606574e0be172e8b43d7d4a31fd8d33bca5e8e596cbbf183b7136ff44c1471.exe
    "C:\Users\Admin\AppData\Local\Temp\f4606574e0be172e8b43d7d4a31fd8d33bca5e8e596cbbf183b7136ff44c1471.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2804
    • C:\Users\Admin\AppData\Local\Temp\f4606574e0be172e8b43d7d4a31fd8d33bca5e8e596cbbf183b7136ff44c1471.exe
      "C:\Users\Admin\AppData\Local\Temp\f4606574e0be172e8b43d7d4a31fd8d33bca5e8e596cbbf183b7136ff44c1471.exe"
      2⤵
      • Checks computer location settings
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:2408
      • C:\Windows\SysWOW64\svchost.exe
        svchost.exe
        3⤵
          PID:2312
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 484
            4⤵
            • Program crash
            PID:4908
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 480
            4⤵
            • Program crash
            PID:4952
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Modifies Installed Components in the registry
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious use of SetWindowsHookEx
          PID:8
        • C:\Windows\722lif3 muaway 2014³.exe
          "C:\Windows\722lif3 muaway 2014³.exe"
          3⤵
          • Executes dropped EXE
          PID:4580
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2312 -ip 2312
      1⤵
        PID:4308
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2312 -ip 2312
        1⤵
          PID:4884

        Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Windows\722lif3 muaway 2014³.exe

                Filesize

                105KB

                MD5

                37060ad5f5fa42f17c9171c74d85a11c

                SHA1

                69a548f7a1f222efbb5883b88b07d165dee5b5a7

                SHA256

                c2799c3284ef8e00b407fd3b36395f12709434e1f09dddb0b246218f733aaa44

                SHA512

                b895a14a405c685ada82e5eeee993d0992edad75aa6051abca8b982466a1ac80c85d68f13a52e43a257235d46a23fb02e65aab4d96022d38ed58bd036932e77b

              • C:\Windows\722lif3 muaway 2014³.exe

                Filesize

                105KB

                MD5

                37060ad5f5fa42f17c9171c74d85a11c

                SHA1

                69a548f7a1f222efbb5883b88b07d165dee5b5a7

                SHA256

                c2799c3284ef8e00b407fd3b36395f12709434e1f09dddb0b246218f733aaa44

                SHA512

                b895a14a405c685ada82e5eeee993d0992edad75aa6051abca8b982466a1ac80c85d68f13a52e43a257235d46a23fb02e65aab4d96022d38ed58bd036932e77b

              • memory/8-143-0x0000000010000000-0x0000000010065000-memory.dmp

                Filesize

                404KB

              • memory/2312-141-0x0000000010000000-0x0000000010065000-memory.dmp

                Filesize

                404KB

              • memory/2312-142-0x0000000010000000-0x0000000010065000-memory.dmp

                Filesize

                404KB

              • memory/2408-137-0x0000000010000000-0x0000000010065000-memory.dmp

                Filesize

                404KB

              • memory/2408-140-0x0000000010000000-0x0000000010065000-memory.dmp

                Filesize

                404KB

              • memory/2408-136-0x0000000010000000-0x0000000010065000-memory.dmp

                Filesize

                404KB

              • memory/2408-135-0x0000000010000000-0x0000000010065000-memory.dmp

                Filesize

                404KB

              • memory/2408-146-0x0000000010000000-0x0000000010065000-memory.dmp

                Filesize

                404KB

              • memory/4580-148-0x0000000000A80000-0x0000000000AA2000-memory.dmp

                Filesize

                136KB

              • memory/4580-149-0x00000000053E0000-0x000000000547C000-memory.dmp

                Filesize

                624KB

              • memory/4580-150-0x0000000005A60000-0x0000000006004000-memory.dmp

                Filesize

                5.6MB

              • memory/4580-151-0x0000000005550000-0x00000000055E2000-memory.dmp

                Filesize

                584KB

              • memory/4580-152-0x00000000054E0000-0x00000000054EA000-memory.dmp

                Filesize

                40KB

              • memory/4580-153-0x00000000056E0000-0x0000000005736000-memory.dmp

                Filesize

                344KB