Analysis

  • max time kernel
    152s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/11/2022, 17:25

General

  • Target

    cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe

  • Size

    170KB

  • MD5

    04089bb15a915c801c49d538f2499cf9

  • SHA1

    0b6a8a5663e028ebe8ce28d2d2607b42404edd2c

  • SHA256

    cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3

  • SHA512

    3e3cbb0d602dbbce710192d8082563c7c487320684959dbfc56bcaf0b7e824c1e629f96e83c510d247494846cb7cde1d8a4ebed62c50c26682cf5811edad065e

  • SSDEEP

    3072:4bz+PMHBHC3sTuwBzjFqmV8C7X87KbecC1oAgtA8nfGc68JK0tI:4baPqBHwsTuK7V8CwwecpnfGJ8J

Malware Config

Extracted

Family

xtremerat

C2

trx3000.dyndns.biz

Signatures

  • Detect XtremeRAT payload 9 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
    "C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5104
    • C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
      "C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2232
      • C:\Windows\SysWOW64\svchost.exe
        svchost.exe
        3⤵
          PID:3440
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 480
            4⤵
            • Program crash
            PID:4272
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 504
            4⤵
            • Program crash
            PID:4392
        • C:\Windows\SysWOW64\calc.exe
          calc.exe
          3⤵
            PID:3044
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 468
              4⤵
              • Program crash
              PID:4348
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 476
              4⤵
              • Program crash
              PID:5048
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3440 -ip 3440
        1⤵
          PID:1504
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 3044 -ip 3044
          1⤵
            PID:4744
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3044 -ip 3044
            1⤵
              PID:4248
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3440 -ip 3440
              1⤵
                PID:5116

              Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • memory/2232-136-0x0000000010000000-0x0000000010047000-memory.dmp

                      Filesize

                      284KB

                    • memory/2232-137-0x0000000010000000-0x0000000010047000-memory.dmp

                      Filesize

                      284KB

                    • memory/2232-139-0x0000000010000000-0x0000000010047000-memory.dmp

                      Filesize

                      284KB

                    • memory/2232-142-0x0000000010000000-0x0000000010047000-memory.dmp

                      Filesize

                      284KB

                    • memory/3044-143-0x0000000010000000-0x0000000010047000-memory.dmp

                      Filesize

                      284KB

                    • memory/3440-144-0x0000000010000000-0x0000000010047000-memory.dmp

                      Filesize

                      284KB

                    • memory/5104-132-0x0000000000400000-0x00000000004BE000-memory.dmp

                      Filesize

                      760KB

                    • memory/5104-138-0x0000000000400000-0x00000000004BE000-memory.dmp

                      Filesize

                      760KB