Analysis

  • max time kernel
    145s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    23/11/2022, 20:18

General

  • Target

    90c70ced614e55e04cfa71b77dcfea8272317f496bb406849eb719f70cccd71a.exe

  • Size

    1.2MB

  • MD5

    eede44f9fff359762f09d0d819c97e0f

  • SHA1

    17cc6ca62f6542ac183a7530335f5ba478a71e21

  • SHA256

    90c70ced614e55e04cfa71b77dcfea8272317f496bb406849eb719f70cccd71a

  • SHA512

    cf41c3e6b9c586b31190813aa7c00c750bb00e9fb03ed3f21e4e686da6b22fe0686eb4de83e52c7dd6a80642fd9b09561ab62179147ae23beff1916fecad1424

  • SSDEEP

    24576:Ft24ot2EiSDXv8WN7ZXJVrTtjxak7WehQe5Zee1yR3:RYZiSbkE5rTtjXXBZ/1s

Malware Config

Extracted

Family

xtremerat

C2

goodday.zapto.org

Šꮨ妘tvnew.otzo.com

Signatures

  • Detect XtremeRAT payload 6 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\90c70ced614e55e04cfa71b77dcfea8272317f496bb406849eb719f70cccd71a.exe
    "C:\Users\Admin\AppData\Local\Temp\90c70ced614e55e04cfa71b77dcfea8272317f496bb406849eb719f70cccd71a.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:900
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\doc.doc"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1108
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1044
      • C:\Users\Admin\AppData\Local\Temp\Skpe.exe
        "C:\Users\Admin\AppData\Local\Temp\Skpe.exe"
        2⤵
        • Executes dropped EXE
        • Checks BIOS information in registry
        • Loads dropped DLL
        • Enumerates connected drives
        • Suspicious use of SetThreadContext
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1812
        • C:\Users\Admin\AppData\Local\Temp\Skpe.exe
          C:\Users\Admin\AppData\Local\Temp\Skpe.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1156
          • C:\Windows\SysWOW64\sethc.exe
            sethc.exe
            4⤵
            • Suspicious use of SetWindowsHookEx
            PID:1988

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\Skpe.exe

            Filesize

            1.5MB

            MD5

            0946f59f7a3718e24ca16f089f7974f6

            SHA1

            143e879d7bb1b0322844c288a5c8c0aa88d78a29

            SHA256

            d357ab68c3253d5b235ea42fb65633e3d1993ee12b9135125e8b8c360566deec

            SHA512

            0e4ead1184a474c98bb2deb4f7450246559f3b713541a75a7084f861ee4239303796f3ab8ea16e02b4c0cda76437676bce7c58cf470e0adaf775a71fc51a5842

          • C:\Users\Admin\AppData\Local\Temp\Skpe.exe

            Filesize

            1.5MB

            MD5

            0946f59f7a3718e24ca16f089f7974f6

            SHA1

            143e879d7bb1b0322844c288a5c8c0aa88d78a29

            SHA256

            d357ab68c3253d5b235ea42fb65633e3d1993ee12b9135125e8b8c360566deec

            SHA512

            0e4ead1184a474c98bb2deb4f7450246559f3b713541a75a7084f861ee4239303796f3ab8ea16e02b4c0cda76437676bce7c58cf470e0adaf775a71fc51a5842

          • C:\Users\Admin\AppData\Local\Temp\Skpe.exe

            Filesize

            1.5MB

            MD5

            0946f59f7a3718e24ca16f089f7974f6

            SHA1

            143e879d7bb1b0322844c288a5c8c0aa88d78a29

            SHA256

            d357ab68c3253d5b235ea42fb65633e3d1993ee12b9135125e8b8c360566deec

            SHA512

            0e4ead1184a474c98bb2deb4f7450246559f3b713541a75a7084f861ee4239303796f3ab8ea16e02b4c0cda76437676bce7c58cf470e0adaf775a71fc51a5842

          • C:\Users\Admin\AppData\Local\Temp\doc.doc

            Filesize

            28KB

            MD5

            2dc148f5161f0914a2ca0136b088ed44

            SHA1

            cb47e69bb0fce98c6a16b687e05bba97143822bf

            SHA256

            84730b81737bf67aa69383aa304a89b5b4da29190d8d6268f80b6e4df90d9463

            SHA512

            e5a951481ca01eccc3c77069642256ca6822e837240c9b9cee78305570fd05998a98d9dae0e80e71811d7a4953df54d1b2fd732d35fb5e8729dfbfd773cfff21

          • \Users\Admin\AppData\Local\Temp\Skpe.exe

            Filesize

            1.5MB

            MD5

            0946f59f7a3718e24ca16f089f7974f6

            SHA1

            143e879d7bb1b0322844c288a5c8c0aa88d78a29

            SHA256

            d357ab68c3253d5b235ea42fb65633e3d1993ee12b9135125e8b8c360566deec

            SHA512

            0e4ead1184a474c98bb2deb4f7450246559f3b713541a75a7084f861ee4239303796f3ab8ea16e02b4c0cda76437676bce7c58cf470e0adaf775a71fc51a5842

          • \Users\Admin\AppData\Local\Temp\Skpe.exe

            Filesize

            1.5MB

            MD5

            0946f59f7a3718e24ca16f089f7974f6

            SHA1

            143e879d7bb1b0322844c288a5c8c0aa88d78a29

            SHA256

            d357ab68c3253d5b235ea42fb65633e3d1993ee12b9135125e8b8c360566deec

            SHA512

            0e4ead1184a474c98bb2deb4f7450246559f3b713541a75a7084f861ee4239303796f3ab8ea16e02b4c0cda76437676bce7c58cf470e0adaf775a71fc51a5842

          • \Users\Admin\AppData\Local\Temp\Skpe.exe

            Filesize

            1.5MB

            MD5

            0946f59f7a3718e24ca16f089f7974f6

            SHA1

            143e879d7bb1b0322844c288a5c8c0aa88d78a29

            SHA256

            d357ab68c3253d5b235ea42fb65633e3d1993ee12b9135125e8b8c360566deec

            SHA512

            0e4ead1184a474c98bb2deb4f7450246559f3b713541a75a7084f861ee4239303796f3ab8ea16e02b4c0cda76437676bce7c58cf470e0adaf775a71fc51a5842

          • \Users\Admin\AppData\Local\Temp\Skpe.exe

            Filesize

            1.5MB

            MD5

            0946f59f7a3718e24ca16f089f7974f6

            SHA1

            143e879d7bb1b0322844c288a5c8c0aa88d78a29

            SHA256

            d357ab68c3253d5b235ea42fb65633e3d1993ee12b9135125e8b8c360566deec

            SHA512

            0e4ead1184a474c98bb2deb4f7450246559f3b713541a75a7084f861ee4239303796f3ab8ea16e02b4c0cda76437676bce7c58cf470e0adaf775a71fc51a5842

          • \Users\Admin\AppData\Local\Temp\Skpe.exe

            Filesize

            1.5MB

            MD5

            0946f59f7a3718e24ca16f089f7974f6

            SHA1

            143e879d7bb1b0322844c288a5c8c0aa88d78a29

            SHA256

            d357ab68c3253d5b235ea42fb65633e3d1993ee12b9135125e8b8c360566deec

            SHA512

            0e4ead1184a474c98bb2deb4f7450246559f3b713541a75a7084f861ee4239303796f3ab8ea16e02b4c0cda76437676bce7c58cf470e0adaf775a71fc51a5842

          • \Users\Admin\AppData\Local\Temp\Skpe.exe

            Filesize

            1.5MB

            MD5

            0946f59f7a3718e24ca16f089f7974f6

            SHA1

            143e879d7bb1b0322844c288a5c8c0aa88d78a29

            SHA256

            d357ab68c3253d5b235ea42fb65633e3d1993ee12b9135125e8b8c360566deec

            SHA512

            0e4ead1184a474c98bb2deb4f7450246559f3b713541a75a7084f861ee4239303796f3ab8ea16e02b4c0cda76437676bce7c58cf470e0adaf775a71fc51a5842

          • \Users\Admin\AppData\Local\Temp\Skpe.exe

            Filesize

            1.5MB

            MD5

            0946f59f7a3718e24ca16f089f7974f6

            SHA1

            143e879d7bb1b0322844c288a5c8c0aa88d78a29

            SHA256

            d357ab68c3253d5b235ea42fb65633e3d1993ee12b9135125e8b8c360566deec

            SHA512

            0e4ead1184a474c98bb2deb4f7450246559f3b713541a75a7084f861ee4239303796f3ab8ea16e02b4c0cda76437676bce7c58cf470e0adaf775a71fc51a5842

          • memory/900-56-0x0000000001DA0000-0x0000000001DB0000-memory.dmp

            Filesize

            64KB

          • memory/900-54-0x0000000076121000-0x0000000076123000-memory.dmp

            Filesize

            8KB

          • memory/900-71-0x00000000034A0000-0x000000000379E000-memory.dmp

            Filesize

            3.0MB

          • memory/1044-104-0x000007FEFBD81000-0x000007FEFBD83000-memory.dmp

            Filesize

            8KB

          • memory/1108-67-0x00000000726D1000-0x00000000726D4000-memory.dmp

            Filesize

            12KB

          • memory/1108-74-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

          • memory/1108-75-0x000000007113D000-0x0000000071148000-memory.dmp

            Filesize

            44KB

          • memory/1108-70-0x0000000070151000-0x0000000070153000-memory.dmp

            Filesize

            8KB

          • memory/1108-106-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

          • memory/1108-101-0x000000007113D000-0x0000000071148000-memory.dmp

            Filesize

            44KB

          • memory/1108-107-0x000000007113D000-0x0000000071148000-memory.dmp

            Filesize

            44KB

          • memory/1156-93-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB

          • memory/1156-94-0x0000000000400000-0x00000000006FE000-memory.dmp

            Filesize

            3.0MB

          • memory/1156-77-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB

          • memory/1156-82-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB

          • memory/1156-88-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB

          • memory/1156-90-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB

          • memory/1156-91-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB

          • memory/1156-78-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB

          • memory/1156-81-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB

          • memory/1156-100-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB

          • memory/1812-80-0x0000000000400000-0x00000000006FE000-memory.dmp

            Filesize

            3.0MB

          • memory/1812-85-0x0000000005700000-0x0000000005704000-memory.dmp

            Filesize

            16KB

          • memory/1812-73-0x0000000000400000-0x00000000006FE000-memory.dmp

            Filesize

            3.0MB

          • memory/1812-72-0x0000000000400000-0x00000000006FE000-memory.dmp

            Filesize

            3.0MB

          • memory/1812-66-0x0000000000400000-0x00000000006FE000-memory.dmp

            Filesize

            3.0MB

          • memory/1988-99-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB

          • memory/1988-102-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB