Analysis
-
max time kernel
401s -
max time network
458s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23/11/2022, 17:45
Static task
static1
Behavioral task
behavioral1
Sample
f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe
Resource
win10v2004-20221111-en
General
-
Target
f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe
-
Size
479KB
-
MD5
1d8a2c3e1e8bac689e7672308f2e91b8
-
SHA1
87a9d9f1998ca06ef37e43a9ee333b84225dd381
-
SHA256
f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e
-
SHA512
19d604dc7e814e73d7951e4b60aa730d17e0340f02b0d795622bc30a01f5d3a4c7d04ba1cc98d1d2071bbc5928a04ec6266d9dcd63a40c795860d9f470e2f51d
-
SSDEEP
6144:nyC9DPs9z3o/iuWqHWpvh/kPU5HYcry4ZVPr/W0dNOMz5tqYEpd6E/sw1FkkadOM:ySD0NqVWqEv6P0YQVPjW0dkrpoIbkEM
Malware Config
Extracted
xtremerat
maradona.no-ip.org
Signatures
-
Detect XtremeRAT payload 5 IoCs
resource yara_rule behavioral2/memory/4560-142-0x0000000010000000-0x000000001004E000-memory.dmp family_xtremerat behavioral2/memory/4560-143-0x0000000010000000-0x000000001004E000-memory.dmp family_xtremerat behavioral2/memory/3056-144-0x0000000000000000-mapping.dmp family_xtremerat behavioral2/memory/4560-145-0x0000000010000000-0x000000001004E000-memory.dmp family_xtremerat behavioral2/memory/3056-146-0x0000000010000000-0x000000001004E000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
resource yara_rule behavioral2/memory/4560-137-0x0000000010000000-0x000000001004E000-memory.dmp upx behavioral2/memory/4560-140-0x0000000010000000-0x000000001004E000-memory.dmp upx behavioral2/memory/4560-142-0x0000000010000000-0x000000001004E000-memory.dmp upx behavioral2/memory/4560-143-0x0000000010000000-0x000000001004E000-memory.dmp upx behavioral2/memory/4560-145-0x0000000010000000-0x000000001004E000-memory.dmp upx behavioral2/memory/3056-146-0x0000000010000000-0x000000001004E000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3404 set thread context of 4560 3404 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 81 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 5052 3056 WerFault.exe 82 -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3404 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3404 wrote to memory of 4560 3404 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 81 PID 3404 wrote to memory of 4560 3404 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 81 PID 3404 wrote to memory of 4560 3404 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 81 PID 3404 wrote to memory of 4560 3404 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 81 PID 3404 wrote to memory of 4560 3404 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 81 PID 3404 wrote to memory of 4560 3404 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 81 PID 3404 wrote to memory of 4560 3404 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 81 PID 3404 wrote to memory of 4560 3404 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 81 PID 3404 wrote to memory of 4560 3404 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 81 PID 4560 wrote to memory of 3056 4560 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 82 PID 4560 wrote to memory of 3056 4560 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 82 PID 4560 wrote to memory of 3056 4560 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 82 PID 4560 wrote to memory of 3056 4560 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 82 PID 4560 wrote to memory of 3372 4560 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 83 PID 4560 wrote to memory of 3372 4560 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 83 PID 4560 wrote to memory of 3372 4560 f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe"C:\Users\Admin\AppData\Local\Temp\f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe"C:\Users\Admin\AppData\Local\Temp\f56647b2c3fa9fd5b437352927181156b61474ed277cfd32785d5f4249f3927e.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵PID:3056
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 5004⤵
- Program crash
PID:5052
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵PID:3372
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3056 -ip 30561⤵PID:628
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3056 -ip 30561⤵PID:528