Analysis

  • max time kernel
    155s
  • max time network
    158s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    23/11/2022, 17:25

General

  • Target

    cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe

  • Size

    170KB

  • MD5

    04089bb15a915c801c49d538f2499cf9

  • SHA1

    0b6a8a5663e028ebe8ce28d2d2607b42404edd2c

  • SHA256

    cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3

  • SHA512

    3e3cbb0d602dbbce710192d8082563c7c487320684959dbfc56bcaf0b7e824c1e629f96e83c510d247494846cb7cde1d8a4ebed62c50c26682cf5811edad065e

  • SSDEEP

    3072:4bz+PMHBHC3sTuwBzjFqmV8C7X87KbecC1oAgtA8nfGc68JK0tI:4baPqBHwsTuK7V8CwwecpnfGJ8J

Malware Config

Extracted

Family

xtremerat

C2

trx3000.dyndns.biz

Signatures

  • Detect XtremeRAT payload 12 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
    "C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:288
    • C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
      "C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1788
      • C:\Windows\SysWOW64\svchost.exe
        svchost.exe
        3⤵
        • Modifies Installed Components in the registry
        • Adds Run key to start application
        PID:784
      • C:\Windows\SysWOW64\calc.exe
        calc.exe
        3⤵
        • Modifies Installed Components in the registry
        • Adds Run key to start application
        • Drops file in Program Files directory
        • Suspicious use of SetWindowsHookEx
        PID:912

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\InstallDir\Server.exe

          Filesize

          170KB

          MD5

          04089bb15a915c801c49d538f2499cf9

          SHA1

          0b6a8a5663e028ebe8ce28d2d2607b42404edd2c

          SHA256

          cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3

          SHA512

          3e3cbb0d602dbbce710192d8082563c7c487320684959dbfc56bcaf0b7e824c1e629f96e83c510d247494846cb7cde1d8a4ebed62c50c26682cf5811edad065e

        • memory/288-60-0x0000000000400000-0x00000000004BE000-memory.dmp

          Filesize

          760KB

        • memory/784-64-0x0000000010000000-0x0000000010047000-memory.dmp

          Filesize

          284KB

        • memory/784-77-0x0000000010000000-0x0000000010047000-memory.dmp

          Filesize

          284KB

        • memory/784-74-0x0000000010000000-0x0000000010047000-memory.dmp

          Filesize

          284KB

        • memory/912-73-0x0000000010000000-0x0000000010047000-memory.dmp

          Filesize

          284KB

        • memory/912-76-0x0000000010000000-0x0000000010047000-memory.dmp

          Filesize

          284KB

        • memory/1788-63-0x0000000000400000-0x00000000004BE000-memory.dmp

          Filesize

          760KB

        • memory/1788-62-0x0000000010000000-0x0000000010047000-memory.dmp

          Filesize

          284KB

        • memory/1788-61-0x0000000010000000-0x0000000010047000-memory.dmp

          Filesize

          284KB

        • memory/1788-71-0x0000000010000000-0x0000000010047000-memory.dmp

          Filesize

          284KB

        • memory/1788-56-0x0000000010000000-0x0000000010047000-memory.dmp

          Filesize

          284KB

        • memory/1788-59-0x0000000075B11000-0x0000000075B13000-memory.dmp

          Filesize

          8KB

        • memory/1788-58-0x0000000010000000-0x0000000010047000-memory.dmp

          Filesize

          284KB