Analysis
-
max time kernel
37s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 21:58
Static task
static1
Behavioral task
behavioral1
Sample
96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe
Resource
win10v2004-20220812-en
General
-
Target
96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe
-
Size
984KB
-
MD5
6edee3f6a9eee3733d27991a3a6d5608
-
SHA1
47eb27c4e6f1e86e45eedd63f744aa7c426b3918
-
SHA256
96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84
-
SHA512
ae4e927c5d808292359b34eacf44ebc0d0ecf107c60e209555afaf596ff17d19acced2195229c8eca214dc4320739ef68cf9087182f89dd65a31e248f84255de
-
SSDEEP
24576:YN74AuHCuqcpjN0Va63ViVIOqccf5RTNRXkdOGObsOm:mMAICuqcv0wNIvVN9kdOGObZm
Malware Config
Signatures
-
Detect XtremeRAT payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/2024-62-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/2024-65-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/2024-66-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/2024-64-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/2024-63-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/2024-68-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/2024-69-0x000000001000D0F4-mapping.dmp family_xtremerat behavioral1/memory/2024-70-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Wine 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exepid process 1708 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exedescription pid process target process PID 1708 set thread context of 2024 1708 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exepid process 1708 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe 1708 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe 1708 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe 1708 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe 1708 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exepid process 1708 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe 1708 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.execmd.exenet.exedescription pid process target process PID 1708 wrote to memory of 1352 1708 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe cmd.exe PID 1708 wrote to memory of 1352 1708 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe cmd.exe PID 1708 wrote to memory of 1352 1708 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe cmd.exe PID 1708 wrote to memory of 1352 1708 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe cmd.exe PID 1708 wrote to memory of 2024 1708 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe PID 1708 wrote to memory of 2024 1708 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe PID 1708 wrote to memory of 2024 1708 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe PID 1708 wrote to memory of 2024 1708 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe PID 1708 wrote to memory of 2024 1708 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe PID 1708 wrote to memory of 2024 1708 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe PID 1708 wrote to memory of 2024 1708 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe PID 1708 wrote to memory of 2024 1708 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe PID 1708 wrote to memory of 2024 1708 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe PID 1708 wrote to memory of 2024 1708 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe PID 1708 wrote to memory of 2024 1708 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe PID 1708 wrote to memory of 2024 1708 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe 96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe PID 1352 wrote to memory of 1792 1352 cmd.exe net.exe PID 1352 wrote to memory of 1792 1352 cmd.exe net.exe PID 1352 wrote to memory of 1792 1352 cmd.exe net.exe PID 1352 wrote to memory of 1792 1352 cmd.exe net.exe PID 1792 wrote to memory of 364 1792 net.exe net1.exe PID 1792 wrote to memory of 364 1792 net.exe net1.exe PID 1792 wrote to memory of 364 1792 net.exe net1.exe PID 1792 wrote to memory of 364 1792 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe"C:\Users\Admin\AppData\Local\Temp\96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c net stop MpsSvc2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵
-
C:\Users\Admin\AppData\Local\Temp\96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exeC:\Users\Admin\AppData\Local\Temp\96fff1d8e819a6f87c10e54b7c14caa75965e5eacd6b6e260f998f6c87ce9b84.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/364-77-0x0000000000000000-mapping.dmp
-
memory/1352-58-0x0000000000000000-mapping.dmp
-
memory/1708-71-0x0000000000400000-0x00000000005DA000-memory.dmpFilesize
1.9MB
-
memory/1708-55-0x0000000077540000-0x00000000776C0000-memory.dmpFilesize
1.5MB
-
memory/1708-56-0x0000000000400000-0x00000000005DA000-memory.dmpFilesize
1.9MB
-
memory/1708-57-0x0000000075451000-0x0000000075453000-memory.dmpFilesize
8KB
-
memory/1708-54-0x0000000000400000-0x00000000005DA000-memory.dmpFilesize
1.9MB
-
memory/1708-75-0x00000000006C0000-0x00000000006C4000-memory.dmpFilesize
16KB
-
memory/1708-74-0x0000000077540000-0x00000000776C0000-memory.dmpFilesize
1.5MB
-
memory/1792-73-0x0000000000000000-mapping.dmp
-
memory/2024-59-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/2024-63-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/2024-68-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/2024-69-0x000000001000D0F4-mapping.dmp
-
memory/2024-70-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/2024-64-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/2024-66-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/2024-65-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/2024-62-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/2024-76-0x0000000000400000-0x00000000005DA000-memory.dmpFilesize
1.9MB
-
memory/2024-60-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB