Analysis
-
max time kernel
156s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23/11/2022, 20:27
Behavioral task
behavioral1
Sample
8e9db5a2df7bacb20ef8615c41b6ef136b9c37c169d2aed09dc879de4a589438.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8e9db5a2df7bacb20ef8615c41b6ef136b9c37c169d2aed09dc879de4a589438.exe
Resource
win10v2004-20221111-en
General
-
Target
8e9db5a2df7bacb20ef8615c41b6ef136b9c37c169d2aed09dc879de4a589438.exe
-
Size
27KB
-
MD5
589b6259111cea353ece5a00fcddeb5f
-
SHA1
dbede510bb820a26b7154e83d580dda0c3892114
-
SHA256
8e9db5a2df7bacb20ef8615c41b6ef136b9c37c169d2aed09dc879de4a589438
-
SHA512
a05e0acb1ed8023779fc6fb7e2ea052d9e33a5ea59fb15a6d6dbe63756fe5aea1a3e0bab0ca875cb47e502c1cea5aaabddffa37139b2fe19171366327ac9499d
-
SSDEEP
768:3DvUGW+cwg39Sa4ee3nsCmOesTEOoANY:wGBcDB4z3VnesGh
Malware Config
Extracted
xtremerat
fons.no-ip.info
C:\Users\Publfons.no-ip.biz
Signatures
-
Detect XtremeRAT payload 5 IoCs
resource yara_rule behavioral1/memory/1996-55-0x0000000010000000-0x0000000010049000-memory.dmp family_xtremerat behavioral1/memory/1964-58-0x0000000000000000-mapping.dmp family_xtremerat behavioral1/memory/1996-60-0x0000000010000000-0x0000000010049000-memory.dmp family_xtremerat behavioral1/memory/1964-61-0x0000000010000000-0x0000000010049000-memory.dmp family_xtremerat behavioral1/memory/1964-62-0x0000000010000000-0x0000000010049000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
resource yara_rule behavioral1/memory/1996-55-0x0000000010000000-0x0000000010049000-memory.dmp upx behavioral1/memory/1996-60-0x0000000010000000-0x0000000010049000-memory.dmp upx behavioral1/memory/1964-61-0x0000000010000000-0x0000000010049000-memory.dmp upx behavioral1/memory/1964-62-0x0000000010000000-0x0000000010049000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1996 wrote to memory of 1964 1996 8e9db5a2df7bacb20ef8615c41b6ef136b9c37c169d2aed09dc879de4a589438.exe 27 PID 1996 wrote to memory of 1964 1996 8e9db5a2df7bacb20ef8615c41b6ef136b9c37c169d2aed09dc879de4a589438.exe 27 PID 1996 wrote to memory of 1964 1996 8e9db5a2df7bacb20ef8615c41b6ef136b9c37c169d2aed09dc879de4a589438.exe 27 PID 1996 wrote to memory of 1964 1996 8e9db5a2df7bacb20ef8615c41b6ef136b9c37c169d2aed09dc879de4a589438.exe 27 PID 1996 wrote to memory of 1964 1996 8e9db5a2df7bacb20ef8615c41b6ef136b9c37c169d2aed09dc879de4a589438.exe 27 PID 1996 wrote to memory of 1000 1996 8e9db5a2df7bacb20ef8615c41b6ef136b9c37c169d2aed09dc879de4a589438.exe 28 PID 1996 wrote to memory of 1000 1996 8e9db5a2df7bacb20ef8615c41b6ef136b9c37c169d2aed09dc879de4a589438.exe 28 PID 1996 wrote to memory of 1000 1996 8e9db5a2df7bacb20ef8615c41b6ef136b9c37c169d2aed09dc879de4a589438.exe 28 PID 1996 wrote to memory of 1000 1996 8e9db5a2df7bacb20ef8615c41b6ef136b9c37c169d2aed09dc879de4a589438.exe 28 PID 1996 wrote to memory of 1000 1996 8e9db5a2df7bacb20ef8615c41b6ef136b9c37c169d2aed09dc879de4a589438.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e9db5a2df7bacb20ef8615c41b6ef136b9c37c169d2aed09dc879de4a589438.exe"C:\Users\Admin\AppData\Local\Temp\8e9db5a2df7bacb20ef8615c41b6ef136b9c37c169d2aed09dc879de4a589438.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵PID:1964
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵PID:1000
-