Overview

overview

10

Static

static

d53abe32da...af.exe

windows7-x64

10

d53abe32da...af.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af

  • Size

    405KB

  • Sample

    221125-sznhbabg3v

  • MD5

    acb6797410609685f65ce25978fbbc71

  • SHA1

    79d4daf4cc98668cf62cf6e1d5e3628e6edbd8b2

  • SHA256

    d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af

  • SHA512

    d3aa92f9bd9876a00cfd079550e6fa82bd2d3d51fc2aea4ed94bf107da0bf6f1093f3abb6a25702711ce8caf722ba089d520f3111586278fa73ba977a6208d5e

  • SSDEEP

    12288:VkqF3zfVnl6VCB+lHOWbtOBEtV1H8UTAti5:VkqF3hoAyx2Vc5

Score
10/10
xtremeratpersistenceratspywareupx

Malware Config

Targets

    • Target

      d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af

    • Size

      405KB

    • MD5

      acb6797410609685f65ce25978fbbc71

    • SHA1

      79d4daf4cc98668cf62cf6e1d5e3628e6edbd8b2

    • SHA256

      d53abe32da6fc5f9fff8a4e5950c934a754beaeec5b4eb0c793583a5219a73af

    • SHA512

      d3aa92f9bd9876a00cfd079550e6fa82bd2d3d51fc2aea4ed94bf107da0bf6f1093f3abb6a25702711ce8caf722ba089d520f3111586278fa73ba977a6208d5e

    • SSDEEP

      12288:VkqF3zfVnl6VCB+lHOWbtOBEtV1H8UTAti5:VkqF3hoAyx2Vc5

    Score
    10/10
    xtremeratpersistenceratspywareupx

    • Modifies WinLogon for persistence

      persistence

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks