Analysis

  • max time kernel
    12s
  • max time network
    30s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23/11/2022, 17:31

General

  • Target

    a9c8442965d5fda4de06075b0e306753341775fa0aa1450f8f4d71a68e358f3c.exe

  • Size

    122KB

  • MD5

    54571cd1e4ada7d250f6f08c949df231

  • SHA1

    c0935974b554c9e86d13913c16f16848e0bea4c7

  • SHA256

    a9c8442965d5fda4de06075b0e306753341775fa0aa1450f8f4d71a68e358f3c

  • SHA512

    ec0425202583726ebb257ace7e37818cee7d66812566a6c495a4e3844e154ca739ad8cff569a9cc2ee7af62b35696d062571b7cf3145f06ff4288914a89c49fd

  • SSDEEP

    3072:dMiDIieBK1rtPsU2Dj6ZNKDoAAHUtJ12lD90d6fZh0szVkq:d4JBuEDkwDoALADi6fZhCq

Malware Config

Signatures

  • Detect XtremeRAT payload 11 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a9c8442965d5fda4de06075b0e306753341775fa0aa1450f8f4d71a68e358f3c.exe
    "C:\Users\Admin\AppData\Local\Temp\a9c8442965d5fda4de06075b0e306753341775fa0aa1450f8f4d71a68e358f3c.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1420
    • C:\Users\Admin\AppData\Local\Temp\a9c8442965d5fda4de06075b0e306753341775fa0aa1450f8f4d71a68e358f3c.exe
      "C:\Users\Admin\AppData\Local\Temp\a9c8442965d5fda4de06075b0e306753341775fa0aa1450f8f4d71a68e358f3c.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:276
      • C:\Users\Admin\AppData\Local\Temp\a9c8442965d5fda4de06075b0e306753341775fa0aa1450f8f4d71a68e358f3c.exe
        "C:\Users\Admin\AppData\Local\Temp\a9c8442965d5fda4de06075b0e306753341775fa0aa1450f8f4d71a68e358f3c.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:272
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          4⤵
            PID:1664

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/272-69-0x0000000010000000-0x000000001004A000-memory.dmp

            Filesize

            296KB

          • memory/272-71-0x0000000010000000-0x000000001004A000-memory.dmp

            Filesize

            296KB

          • memory/272-79-0x0000000010000000-0x000000001004A000-memory.dmp

            Filesize

            296KB

          • memory/272-67-0x0000000010000000-0x000000001004A000-memory.dmp

            Filesize

            296KB

          • memory/272-63-0x0000000010000000-0x000000001004A000-memory.dmp

            Filesize

            296KB

          • memory/272-65-0x0000000010000000-0x000000001004A000-memory.dmp

            Filesize

            296KB

          • memory/272-66-0x0000000010000000-0x000000001004A000-memory.dmp

            Filesize

            296KB

          • memory/272-68-0x0000000010000000-0x000000001004A000-memory.dmp

            Filesize

            296KB

          • memory/272-78-0x0000000000400000-0x0000000000448000-memory.dmp

            Filesize

            288KB

          • memory/272-77-0x0000000010000000-0x000000001004A000-memory.dmp

            Filesize

            296KB

          • memory/272-62-0x0000000010000000-0x000000001004A000-memory.dmp

            Filesize

            296KB

          • memory/272-76-0x0000000010000000-0x000000001004A000-memory.dmp

            Filesize

            296KB

          • memory/272-74-0x0000000010000000-0x000000001004A000-memory.dmp

            Filesize

            296KB

          • memory/272-75-0x0000000074D71000-0x0000000074D73000-memory.dmp

            Filesize

            8KB

          • memory/276-73-0x0000000000400000-0x0000000000406000-memory.dmp

            Filesize

            24KB

          • memory/276-56-0x0000000000400000-0x0000000000406000-memory.dmp

            Filesize

            24KB

          • memory/1420-59-0x0000000000400000-0x0000000000448000-memory.dmp

            Filesize

            288KB