Analysis

  • max time kernel
    151s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    06/12/2022, 16:49

General

  • Target

    cfbad8243044fa4e00f23ed44c24ee3ff50e5b01dcb7c483dbb6d71675236c9e.exe

  • Size

    217KB

  • MD5

    b4f5bfc0ab0cc3d6b7a6b9653784de56

  • SHA1

    c5314c708dbcd5d2f76bdab8ea3848c2bc1777c9

  • SHA256

    cfbad8243044fa4e00f23ed44c24ee3ff50e5b01dcb7c483dbb6d71675236c9e

  • SHA512

    f94b3d6f024e64fa8761a4db9dbb5c8d308752d487fb3f859ae5d22ef950ebf200787c9d491462248fedcbbd031b6c8d1c3c3c0415b0f13b2777a237b4d314e4

  • SSDEEP

    3072:D1dlKwgj23+Oz05YoNozPTQydKKQR4KQS+2YkX4NX1enJ0fVTdCqBzIwPwR/3HFX:D1dlZro5yPTQyoKjh2Yn91285dFz1mH9

Malware Config

Extracted

Family

xtremerat

C2

mjed10.no-ip.info

remoteback.no-ip.biz

Signatures

  • Detect XtremeRAT payload 6 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cfbad8243044fa4e00f23ed44c24ee3ff50e5b01dcb7c483dbb6d71675236c9e.exe
    "C:\Users\Admin\AppData\Local\Temp\cfbad8243044fa4e00f23ed44c24ee3ff50e5b01dcb7c483dbb6d71675236c9e.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1196
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Hmas.doc"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:940
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:528
      • C:\Users\Admin\AppData\Local\Temp\text.exe
        "C:\Users\Admin\AppData\Local\Temp\text.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1908
        • C:\Users\Admin\AppData\Local\Temp\text.exe
          "C:\Users\Admin\AppData\Local\Temp\text.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1876
          • C:\Windows\SysWOW64\svchost.exe
            svchost.exe
            4⤵
              PID:1824
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              4⤵
                PID:1600

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\Hmas.doc

          Filesize

          109KB

          MD5

          38b3a3a2f3679d1f12dc76208aeef7d2

          SHA1

          eece72da5420c5ea8501a8273a0e1bd6fe59148b

          SHA256

          05b12df7e9ee980fcad3ce4b0dd8335578a458be4328ea895d1cb9247ee2ac30

          SHA512

          619870731a2a6bda44bf92bf035f1d8a5001fe7a6300b990a841dbedb1354487bba477c739dc7c82790ae81d0d0a6bb176f963df355b97ffebe5512c138ade72

        • C:\Users\Admin\AppData\Local\Temp\text.exe

          Filesize

          133KB

          MD5

          97576fa7a236679dbe3abe1a4e852026

          SHA1

          410f01060635c3aed10cc2eda9b1bd17a2771b66

          SHA256

          dc8ebbec5bd6c01c2665f66e4df7fbafc0572608869c768d9e8653bd99974cda

          SHA512

          7ee1389b41cbe7c241bd788f5b13b90b25af5319a30898dc085b9ba86a9fd517b54e377d3d00123e5b491212e4b378f25c8dd7af3557d3583cb5516c4dc9b91d

        • C:\Users\Admin\AppData\Local\Temp\text.exe

          Filesize

          133KB

          MD5

          97576fa7a236679dbe3abe1a4e852026

          SHA1

          410f01060635c3aed10cc2eda9b1bd17a2771b66

          SHA256

          dc8ebbec5bd6c01c2665f66e4df7fbafc0572608869c768d9e8653bd99974cda

          SHA512

          7ee1389b41cbe7c241bd788f5b13b90b25af5319a30898dc085b9ba86a9fd517b54e377d3d00123e5b491212e4b378f25c8dd7af3557d3583cb5516c4dc9b91d

        • C:\Users\Admin\AppData\Local\Temp\text.exe

          Filesize

          133KB

          MD5

          97576fa7a236679dbe3abe1a4e852026

          SHA1

          410f01060635c3aed10cc2eda9b1bd17a2771b66

          SHA256

          dc8ebbec5bd6c01c2665f66e4df7fbafc0572608869c768d9e8653bd99974cda

          SHA512

          7ee1389b41cbe7c241bd788f5b13b90b25af5319a30898dc085b9ba86a9fd517b54e377d3d00123e5b491212e4b378f25c8dd7af3557d3583cb5516c4dc9b91d

        • \Users\Admin\AppData\Local\Temp\text.exe

          Filesize

          133KB

          MD5

          97576fa7a236679dbe3abe1a4e852026

          SHA1

          410f01060635c3aed10cc2eda9b1bd17a2771b66

          SHA256

          dc8ebbec5bd6c01c2665f66e4df7fbafc0572608869c768d9e8653bd99974cda

          SHA512

          7ee1389b41cbe7c241bd788f5b13b90b25af5319a30898dc085b9ba86a9fd517b54e377d3d00123e5b491212e4b378f25c8dd7af3557d3583cb5516c4dc9b91d

        • \Users\Admin\AppData\Local\Temp\text.exe

          Filesize

          133KB

          MD5

          97576fa7a236679dbe3abe1a4e852026

          SHA1

          410f01060635c3aed10cc2eda9b1bd17a2771b66

          SHA256

          dc8ebbec5bd6c01c2665f66e4df7fbafc0572608869c768d9e8653bd99974cda

          SHA512

          7ee1389b41cbe7c241bd788f5b13b90b25af5319a30898dc085b9ba86a9fd517b54e377d3d00123e5b491212e4b378f25c8dd7af3557d3583cb5516c4dc9b91d

        • \Users\Admin\AppData\Local\Temp\text.exe

          Filesize

          133KB

          MD5

          97576fa7a236679dbe3abe1a4e852026

          SHA1

          410f01060635c3aed10cc2eda9b1bd17a2771b66

          SHA256

          dc8ebbec5bd6c01c2665f66e4df7fbafc0572608869c768d9e8653bd99974cda

          SHA512

          7ee1389b41cbe7c241bd788f5b13b90b25af5319a30898dc085b9ba86a9fd517b54e377d3d00123e5b491212e4b378f25c8dd7af3557d3583cb5516c4dc9b91d

        • memory/528-63-0x000007FEFB641000-0x000007FEFB643000-memory.dmp

          Filesize

          8KB

        • memory/940-62-0x0000000070B9D000-0x0000000070BA8000-memory.dmp

          Filesize

          44KB

        • memory/940-66-0x0000000070B9D000-0x0000000070BA8000-memory.dmp

          Filesize

          44KB

        • memory/940-64-0x0000000070B9D000-0x0000000070BA8000-memory.dmp

          Filesize

          44KB

        • memory/940-58-0x000000005FFF0000-0x0000000060000000-memory.dmp

          Filesize

          64KB

        • memory/940-57-0x000000006FBB1000-0x000000006FBB3000-memory.dmp

          Filesize

          8KB

        • memory/940-56-0x0000000072131000-0x0000000072134000-memory.dmp

          Filesize

          12KB

        • memory/940-65-0x000000005FFF0000-0x0000000060000000-memory.dmp

          Filesize

          64KB

        • memory/1196-54-0x0000000074E41000-0x0000000074E43000-memory.dmp

          Filesize

          8KB

        • memory/1824-82-0x0000000010000000-0x000000001004D000-memory.dmp

          Filesize

          308KB

        • memory/1824-89-0x0000000010000000-0x000000001004D000-memory.dmp

          Filesize

          308KB

        • memory/1824-87-0x0000000010000000-0x000000001004D000-memory.dmp

          Filesize

          308KB

        • memory/1876-75-0x0000000010000000-0x000000001004D000-memory.dmp

          Filesize

          308KB

        • memory/1876-81-0x0000000010000000-0x000000001004D000-memory.dmp

          Filesize

          308KB

        • memory/1876-80-0x0000000010000000-0x000000001004D000-memory.dmp

          Filesize

          308KB

        • memory/1876-86-0x0000000010000000-0x000000001004D000-memory.dmp

          Filesize

          308KB

        • memory/1876-88-0x0000000010000000-0x000000001004D000-memory.dmp

          Filesize

          308KB