Analysis
-
max time kernel
159s -
max time network
176s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23/11/2022, 19:26
Behavioral task
behavioral1
Sample
67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe
Resource
win10v2004-20220812-en
General
-
Target
67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe
-
Size
46KB
-
MD5
3ed737aa806679a8f967360abe8cdcfd
-
SHA1
7ebd7c27d3b3de22e4717d6722f2092897942d52
-
SHA256
67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209
-
SHA512
c6f44e2bcea50eebd0052e6c0a978c2aad35aa22d8dd3ac17f81240557f4a3fac6d170a2b9ff7b9365d78a54e35004b50066a5e750f11ec852bf3e432b6dc0de
-
SSDEEP
768:VIsF8HdbKjV8BX7Vy6K7eIVwn4kuY1n6ZVdBnJin:VIsF5CBX7VX9Iy446ZVD
Malware Config
Extracted
xtremerat
oudy.no-ip.biz
Signatures
-
Detect XtremeRAT payload 7 IoCs
resource yara_rule behavioral1/memory/1076-55-0x0000000000C80000-0x0000000000CA5000-memory.dmp family_xtremerat behavioral1/memory/1104-58-0x0000000000000000-mapping.dmp family_xtremerat behavioral1/memory/332-63-0x0000000000000000-mapping.dmp family_xtremerat behavioral1/memory/1104-65-0x0000000000C80000-0x0000000000CA5000-memory.dmp family_xtremerat behavioral1/memory/332-66-0x0000000000C80000-0x0000000000CA5000-memory.dmp family_xtremerat behavioral1/memory/1076-67-0x0000000000C80000-0x0000000000CA5000-memory.dmp family_xtremerat behavioral1/memory/332-68-0x0000000000C80000-0x0000000000CA5000-memory.dmp family_xtremerat -
Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\WIN 7\\HACKO.exe" 67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\WIN 7\\HACKO.exe" 67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\WIN 7\\HACKO.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\WIN 7\\HACKO.exe" svchost.exe -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Adds policy Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\svchost = "C:\\Windows\\WIN 7\\HACKO.exe" 67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\svchost = "C:\\Windows\\WIN 7\\HACKO.exe" 67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\svchost = "C:\\Windows\\WIN 7\\HACKO.exe" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\svchost = "C:\\Windows\\WIN 7\\HACKO.exe" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{EPN7AS00-1R0D-K47C-E2K5-0DKM312VCSX6} 67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EPN7AS00-1R0D-K47C-E2K5-0DKM312VCSX6}\StubPath = "C:\\Windows\\WIN 7\\HACKO.exe restart" 67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{EPN7AS00-1R0D-K47C-E2K5-0DKM312VCSX6} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EPN7AS00-1R0D-K47C-E2K5-0DKM312VCSX6}\StubPath = "C:\\Windows\\WIN 7\\HACKO.exe restart" svchost.exe -
resource yara_rule behavioral1/memory/1076-55-0x0000000000C80000-0x0000000000CA5000-memory.dmp upx behavioral1/files/0x00070000000133af-60.dat upx behavioral1/memory/1104-65-0x0000000000C80000-0x0000000000CA5000-memory.dmp upx behavioral1/memory/332-66-0x0000000000C80000-0x0000000000CA5000-memory.dmp upx behavioral1/memory/1076-67-0x0000000000C80000-0x0000000000CA5000-memory.dmp upx behavioral1/memory/332-68-0x0000000000C80000-0x0000000000CA5000-memory.dmp upx -
Adds Run key to start application 2 TTPs 16 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\svchost = "C:\\Windows\\WIN 7\\HACKO.exe" 67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\svchost = "C:\\Windows\\WIN 7\\HACKO.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\WIN 7\\HACKO.exe" 67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\WIN 7\\HACKO.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\svchost = "C:\\Windows\\WIN 7\\HACKO.exe" 67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run 67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\WIN 7\\HACKO.exe" 67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\WIN 7\\HACKO.exe" svchost.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run svchost.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\svchost = "C:\\Windows\\WIN 7\\HACKO.exe" svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\WIN 7\HACKO.exe 67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe File created C:\Windows\WIN 7\HACKO.exe 67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe File opened for modification C:\Windows\WIN 7\ 67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 332 svchost.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1076 wrote to memory of 1104 1076 67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe 28 PID 1076 wrote to memory of 1104 1076 67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe 28 PID 1076 wrote to memory of 1104 1076 67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe 28 PID 1076 wrote to memory of 1104 1076 67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe 28 PID 1076 wrote to memory of 1104 1076 67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe 28 PID 1076 wrote to memory of 332 1076 67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe 29 PID 1076 wrote to memory of 332 1076 67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe 29 PID 1076 wrote to memory of 332 1076 67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe 29 PID 1076 wrote to memory of 332 1076 67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe 29 PID 1076 wrote to memory of 332 1076 67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe"C:\Users\Admin\AppData\Local\Temp\67ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209.exe"1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:1104
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Suspicious use of SetWindowsHookEx
PID:332
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD53ed737aa806679a8f967360abe8cdcfd
SHA17ebd7c27d3b3de22e4717d6722f2092897942d52
SHA25667ded0a6cc387c821388f74c3a7feffda231bfb23c40b7f7aacc3d6a2c107209
SHA512c6f44e2bcea50eebd0052e6c0a978c2aad35aa22d8dd3ac17f81240557f4a3fac6d170a2b9ff7b9365d78a54e35004b50066a5e750f11ec852bf3e432b6dc0de