Analysis
-
max time kernel
149s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
23/11/2022, 17:45
Static task
static1
Behavioral task
behavioral1
Sample
f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe
Resource
win10v2004-20221111-en
General
-
Target
f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe
-
Size
479KB
-
MD5
1d8a2c3e1e8bac689e7672308f2e91b8
-
SHA1
87a9d9f1998ca06ef37e43a9ee333b84225dd381
-
SHA256
f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e
-
SHA512
19d604dc7e814e73d7951e4b60aa730d17e0340f02b0d795622bc30a01f5d3a4c7d04ba1cc98d1d2071bbc5928a04ec6266d9dcd63a40c795860d9f470e2f51d
-
SSDEEP
6144:nyC9DPs9z3o/iuWqHWpvh/kPU5HYcry4ZVPr/W0dNOMz5tqYEpd6E/sw1FkkadOM:ySD0NqVWqEv6P0YQVPjW0dkrpoIbkEM
Malware Config
Extracted
xtremerat
maradona.no-ip.org
Signatures
-
Detect XtremeRAT payload 6 IoCs
resource yara_rule behavioral1/memory/1200-63-0x0000000010000000-0x000000001004E000-memory.dmp family_xtremerat behavioral1/memory/1200-64-0x0000000010000000-0x000000001004E000-memory.dmp family_xtremerat behavioral1/memory/1064-68-0x0000000000000000-mapping.dmp family_xtremerat behavioral1/memory/1200-70-0x0000000010000000-0x000000001004E000-memory.dmp family_xtremerat behavioral1/memory/1064-71-0x0000000010000000-0x000000001004E000-memory.dmp family_xtremerat behavioral1/memory/1064-72-0x0000000010000000-0x000000001004E000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
resource yara_rule behavioral1/memory/1200-57-0x0000000010000000-0x000000001004E000-memory.dmp upx behavioral1/memory/1200-62-0x0000000010000000-0x000000001004E000-memory.dmp upx behavioral1/memory/1200-63-0x0000000010000000-0x000000001004E000-memory.dmp upx behavioral1/memory/1200-64-0x0000000010000000-0x000000001004E000-memory.dmp upx behavioral1/memory/1200-70-0x0000000010000000-0x000000001004E000-memory.dmp upx behavioral1/memory/1064-71-0x0000000010000000-0x000000001004E000-memory.dmp upx behavioral1/memory/1064-72-0x0000000010000000-0x000000001004E000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1768 set thread context of 1200 1768 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 27 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1768 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1768 wrote to memory of 1200 1768 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 27 PID 1768 wrote to memory of 1200 1768 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 27 PID 1768 wrote to memory of 1200 1768 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 27 PID 1768 wrote to memory of 1200 1768 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 27 PID 1768 wrote to memory of 1200 1768 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 27 PID 1768 wrote to memory of 1200 1768 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 27 PID 1768 wrote to memory of 1200 1768 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 27 PID 1768 wrote to memory of 1200 1768 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 27 PID 1768 wrote to memory of 1200 1768 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 27 PID 1768 wrote to memory of 1200 1768 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 27 PID 1200 wrote to memory of 1064 1200 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 28 PID 1200 wrote to memory of 1064 1200 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 28 PID 1200 wrote to memory of 1064 1200 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 28 PID 1200 wrote to memory of 1064 1200 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 28 PID 1200 wrote to memory of 1064 1200 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 28 PID 1200 wrote to memory of 536 1200 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 29 PID 1200 wrote to memory of 536 1200 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 29 PID 1200 wrote to memory of 536 1200 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 29 PID 1200 wrote to memory of 536 1200 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 29 PID 1200 wrote to memory of 536 1200 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe"C:\Users\Admin\AppData\Local\Temp\f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe"C:\Users\Admin\AppData\Local\Temp\f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵PID:1064
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:536
-
-