Analysis

  • max time kernel
    192s
  • max time network
    197s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/11/2022, 16:40

General

  • Target

    LIF3 Muaway.exe

  • Size

    2.0MB

  • MD5

    18ec82e6803a882e6409399d5fefb810

  • SHA1

    b1a9b23927bc033f7df59a93349fce0416ad3f5a

  • SHA256

    f4606574e0be172e8b43d7d4a31fd8d33bca5e8e596cbbf183b7136ff44c1471

  • SHA512

    f9b29cb3a4a9412322b5e19939372d74578c1764288a2caf439340feabc3f74dc248d728722c10739db860cfb1e35d0064a25ce294474e0e7cb044b443b3a0d6

  • SSDEEP

    49152:rHFaaHayaoaaaoaGhF3Ow3yaBafimXnhsi:rHFamfBvxnhF3OwiGhe2i

Malware Config

Extracted

Family

xtremerat

C2

muawayhue2.no-ip.org

᪸᳴ਲ਼蠀Sites qmuawayhue2.no-ip.org

Signatures

  • Detect XtremeRAT payload 10 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Executes dropped EXE 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LIF3 Muaway.exe
    "C:\Users\Admin\AppData\Local\Temp\LIF3 Muaway.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2712
    • C:\Users\Admin\AppData\Local\Temp\LIF3 Muaway.exe
      "C:\Users\Admin\AppData\Local\Temp\LIF3 Muaway.exe"
      2⤵
      • Checks computer location settings
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:2344
      • C:\Windows\SysWOW64\svchost.exe
        svchost.exe
        3⤵
          PID:3468
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 480
            4⤵
            • Program crash
            PID:1712
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 488
            4⤵
            • Program crash
            PID:1300
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Modifies Installed Components in the registry
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious use of SetWindowsHookEx
          PID:3628
        • C:\Windows\722lif3 muaway 2014³.exe
          "C:\Windows\722lif3 muaway 2014³.exe"
          3⤵
          • Executes dropped EXE
          PID:3264
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3468 -ip 3468
      1⤵
        PID:3428
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3468 -ip 3468
        1⤵
          PID:2724

        Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Windows\722lif3 muaway 2014³.exe

                Filesize

                105KB

                MD5

                37060ad5f5fa42f17c9171c74d85a11c

                SHA1

                69a548f7a1f222efbb5883b88b07d165dee5b5a7

                SHA256

                c2799c3284ef8e00b407fd3b36395f12709434e1f09dddb0b246218f733aaa44

                SHA512

                b895a14a405c685ada82e5eeee993d0992edad75aa6051abca8b982466a1ac80c85d68f13a52e43a257235d46a23fb02e65aab4d96022d38ed58bd036932e77b

              • C:\Windows\722lif3 muaway 2014³.exe

                Filesize

                105KB

                MD5

                37060ad5f5fa42f17c9171c74d85a11c

                SHA1

                69a548f7a1f222efbb5883b88b07d165dee5b5a7

                SHA256

                c2799c3284ef8e00b407fd3b36395f12709434e1f09dddb0b246218f733aaa44

                SHA512

                b895a14a405c685ada82e5eeee993d0992edad75aa6051abca8b982466a1ac80c85d68f13a52e43a257235d46a23fb02e65aab4d96022d38ed58bd036932e77b

              • memory/2344-135-0x0000000010000000-0x0000000010065000-memory.dmp

                Filesize

                404KB

              • memory/2344-136-0x0000000010000000-0x0000000010065000-memory.dmp

                Filesize

                404KB

              • memory/2344-137-0x0000000010000000-0x0000000010065000-memory.dmp

                Filesize

                404KB

              • memory/2344-145-0x0000000010000000-0x0000000010065000-memory.dmp

                Filesize

                404KB

              • memory/2344-140-0x0000000010000000-0x0000000010065000-memory.dmp

                Filesize

                404KB

              • memory/3264-146-0x0000000000C90000-0x0000000000CB2000-memory.dmp

                Filesize

                136KB

              • memory/3264-147-0x00000000056B0000-0x000000000574C000-memory.dmp

                Filesize

                624KB

              • memory/3264-149-0x0000000005D00000-0x00000000062A4000-memory.dmp

                Filesize

                5.6MB

              • memory/3264-150-0x0000000005750000-0x00000000057E2000-memory.dmp

                Filesize

                584KB

              • memory/3264-151-0x0000000005650000-0x000000000565A000-memory.dmp

                Filesize

                40KB

              • memory/3264-152-0x0000000005990000-0x00000000059E6000-memory.dmp

                Filesize

                344KB

              • memory/3468-141-0x0000000010000000-0x0000000010065000-memory.dmp

                Filesize

                404KB

              • memory/3628-148-0x0000000010000000-0x0000000010065000-memory.dmp

                Filesize

                404KB