Analysis
-
max time kernel
152s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23/11/2022, 17:25
Static task
static1
Behavioral task
behavioral1
Sample
cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
Resource
win10v2004-20220812-en
General
-
Target
cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe
-
Size
170KB
-
MD5
04089bb15a915c801c49d538f2499cf9
-
SHA1
0b6a8a5663e028ebe8ce28d2d2607b42404edd2c
-
SHA256
cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3
-
SHA512
3e3cbb0d602dbbce710192d8082563c7c487320684959dbfc56bcaf0b7e824c1e629f96e83c510d247494846cb7cde1d8a4ebed62c50c26682cf5811edad065e
-
SSDEEP
3072:4bz+PMHBHC3sTuwBzjFqmV8C7X87KbecC1oAgtA8nfGc68JK0tI:4baPqBHwsTuK7V8CwwecpnfGJ8J
Malware Config
Extracted
xtremerat
trx3000.dyndns.biz
Signatures
-
Detect XtremeRAT payload 9 IoCs
resource yara_rule behavioral2/memory/2232-135-0x0000000000000000-mapping.dmp family_xtremerat behavioral2/memory/2232-136-0x0000000010000000-0x0000000010047000-memory.dmp family_xtremerat behavioral2/memory/2232-137-0x0000000010000000-0x0000000010047000-memory.dmp family_xtremerat behavioral2/memory/2232-139-0x0000000010000000-0x0000000010047000-memory.dmp family_xtremerat behavioral2/memory/3440-140-0x0000000000000000-mapping.dmp family_xtremerat behavioral2/memory/3044-141-0x0000000000000000-mapping.dmp family_xtremerat behavioral2/memory/2232-142-0x0000000010000000-0x0000000010047000-memory.dmp family_xtremerat behavioral2/memory/3044-143-0x0000000010000000-0x0000000010047000-memory.dmp family_xtremerat behavioral2/memory/3440-144-0x0000000010000000-0x0000000010047000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5104 set thread context of 2232 5104 cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe 81 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 4 IoCs
pid pid_target Process procid_target 4348 3044 WerFault.exe 83 4272 3440 WerFault.exe 82 5048 3044 WerFault.exe 83 4392 3440 WerFault.exe 82 -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5104 cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 5104 wrote to memory of 2232 5104 cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe 81 PID 5104 wrote to memory of 2232 5104 cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe 81 PID 5104 wrote to memory of 2232 5104 cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe 81 PID 5104 wrote to memory of 2232 5104 cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe 81 PID 5104 wrote to memory of 2232 5104 cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe 81 PID 5104 wrote to memory of 2232 5104 cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe 81 PID 5104 wrote to memory of 2232 5104 cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe 81 PID 5104 wrote to memory of 2232 5104 cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe 81 PID 5104 wrote to memory of 2232 5104 cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe 81 PID 5104 wrote to memory of 2232 5104 cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe 81 PID 5104 wrote to memory of 2232 5104 cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe 81 PID 5104 wrote to memory of 2232 5104 cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe 81 PID 5104 wrote to memory of 2232 5104 cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe 81 PID 2232 wrote to memory of 3440 2232 cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe 82 PID 2232 wrote to memory of 3440 2232 cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe 82 PID 2232 wrote to memory of 3440 2232 cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe 82 PID 2232 wrote to memory of 3440 2232 cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe 82 PID 2232 wrote to memory of 3044 2232 cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe 83 PID 2232 wrote to memory of 3044 2232 cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe 83 PID 2232 wrote to memory of 3044 2232 cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe 83 PID 2232 wrote to memory of 3044 2232 cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe"C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe"C:\Users\Admin\AppData\Local\Temp\cfc1a0788c151aa1b2cedc09e2db245d3e9b15398385a7f2eeeb23664ab144f3.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵PID:3440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 4804⤵
- Program crash
PID:4272
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 5044⤵
- Program crash
PID:4392
-
-
-
C:\Windows\SysWOW64\calc.execalc.exe3⤵PID:3044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 4684⤵
- Program crash
PID:4348
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 4764⤵
- Program crash
PID:5048
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3440 -ip 34401⤵PID:1504
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 3044 -ip 30441⤵PID:4744
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3044 -ip 30441⤵PID:4248
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3440 -ip 34401⤵PID:5116