Analysis
-
max time kernel
35s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 04:26
Static task
static1
Behavioral task
behavioral1
Sample
1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe
Resource
win10v2004-20220901-en
General
-
Target
1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe
-
Size
1004KB
-
MD5
ac9f763e91e7a45b541cc5d46947e9db
-
SHA1
ea043d1326925faf827e529ccb304281b9137914
-
SHA256
1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a
-
SHA512
e3ab77da18869d9a5908aeec2acd49809c3062c5617f09d06d74228ba5d37be8741dcdfbbcbc549c99ad5ac03fb4fceceade7cf32a1733f2af4561d184ea17a4
-
SSDEEP
24576:Yb9mF2c+YdlItkGOinouiRYm1I1y4sIfDTSoUA+stJXVmaip9wV:g46YnEkgoim8s0est11V
Malware Config
Signatures
-
Detect XtremeRAT payload 11 IoCs
Processes:
resource yara_rule behavioral1/memory/1940-61-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/1940-62-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/1940-63-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/1940-65-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/1940-64-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/1940-67-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/1940-68-0x000000001000D0F4-mapping.dmp family_xtremerat behavioral1/memory/1940-70-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/1940-72-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/1940-75-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/1940-79-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Wine 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exepid process 1160 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exedescription pid process target process PID 1160 set thread context of 1940 1160 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exepid process 1160 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe 1160 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe 1160 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe 1160 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe 1160 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exepid process 1160 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe 1160 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.execmd.exe1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exenet.exedescription pid process target process PID 1160 wrote to memory of 1360 1160 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe cmd.exe PID 1160 wrote to memory of 1360 1160 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe cmd.exe PID 1160 wrote to memory of 1360 1160 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe cmd.exe PID 1160 wrote to memory of 1360 1160 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe cmd.exe PID 1160 wrote to memory of 1940 1160 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe PID 1160 wrote to memory of 1940 1160 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe PID 1160 wrote to memory of 1940 1160 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe PID 1160 wrote to memory of 1940 1160 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe PID 1160 wrote to memory of 1940 1160 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe PID 1160 wrote to memory of 1940 1160 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe PID 1160 wrote to memory of 1940 1160 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe PID 1160 wrote to memory of 1940 1160 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe PID 1160 wrote to memory of 1940 1160 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe PID 1160 wrote to memory of 1940 1160 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe PID 1160 wrote to memory of 1940 1160 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe PID 1160 wrote to memory of 1940 1160 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe PID 1360 wrote to memory of 584 1360 cmd.exe net.exe PID 1360 wrote to memory of 584 1360 cmd.exe net.exe PID 1360 wrote to memory of 584 1360 cmd.exe net.exe PID 1360 wrote to memory of 584 1360 cmd.exe net.exe PID 1940 wrote to memory of 1792 1940 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe iexplore.exe PID 1940 wrote to memory of 1792 1940 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe iexplore.exe PID 1940 wrote to memory of 1792 1940 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe iexplore.exe PID 1940 wrote to memory of 1792 1940 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe iexplore.exe PID 584 wrote to memory of 1748 584 net.exe net1.exe PID 584 wrote to memory of 1748 584 net.exe net1.exe PID 584 wrote to memory of 1748 584 net.exe net1.exe PID 584 wrote to memory of 1748 584 net.exe net1.exe PID 1940 wrote to memory of 1792 1940 1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe"C:\Users\Admin\AppData\Local\Temp\1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c net stop MpsSvc2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵
-
C:\Users\Admin\AppData\Local\Temp\1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exeC:\Users\Admin\AppData\Local\Temp\1920d2d779f35775563fab909cb58a89e1befee4cc91ba4c6eb636917a805a1a.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/584-73-0x0000000000000000-mapping.dmp
-
memory/1160-69-0x0000000000400000-0x00000000005E1000-memory.dmpFilesize
1.9MB
-
memory/1160-55-0x0000000077480000-0x0000000077600000-memory.dmpFilesize
1.5MB
-
memory/1160-56-0x0000000075A91000-0x0000000075A93000-memory.dmpFilesize
8KB
-
memory/1160-80-0x0000000005140000-0x0000000005321000-memory.dmpFilesize
1.9MB
-
memory/1160-54-0x0000000000400000-0x00000000005E1000-memory.dmpFilesize
1.9MB
-
memory/1160-76-0x00000000006C0000-0x00000000006C4000-memory.dmpFilesize
16KB
-
memory/1160-74-0x0000000077480000-0x0000000077600000-memory.dmpFilesize
1.5MB
-
memory/1360-57-0x0000000000000000-mapping.dmp
-
memory/1748-78-0x0000000000000000-mapping.dmp
-
memory/1940-61-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/1940-63-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/1940-68-0x000000001000D0F4-mapping.dmp
-
memory/1940-64-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/1940-70-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/1940-72-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/1940-65-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/1940-67-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/1940-62-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/1940-75-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/1940-77-0x0000000000400000-0x00000000005E1000-memory.dmpFilesize
1.9MB
-
memory/1940-59-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/1940-79-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/1940-58-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB