Analysis

  • max time kernel
    25s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    26/12/2023, 22:18

General

  • Target

    92463f77f40595d193ec96d7110ca7d9.exe

  • Size

    597KB

  • MD5

    92463f77f40595d193ec96d7110ca7d9

  • SHA1

    a1ef00f5635ade5de097373d89710cf00f16bfe3

  • SHA256

    3ea0ae2b4f2ef54ec31a155fd20c493ebc6aae640aadf20a2731f50e3e1242f0

  • SHA512

    59116d3df98e5ac0aecffc71328cc3d6065bbc193df1fc2555ebcc71783a3cdc16600ef54a6bf6aabcb3de6a230fc592bf302c8a879d817b6a6e3dcc5df7b7a5

  • SSDEEP

    12288:WqucHnZrJ2WFtJMOqf2Q1/1MoF5+eh8aWvp2g1iqoY3t+vVLtT/:tr0YtKOqr1i+H6aWvpX3uVLtT/

Malware Config

Signatures

  • Detect XtremeRAT payload 6 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Adds policy Run key to start application 2 TTPs 8 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\92463f77f40595d193ec96d7110ca7d9.exe
    "C:\Users\Admin\AppData\Local\Temp\92463f77f40595d193ec96d7110ca7d9.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2228
    • C:\Users\Admin\AppData\Local\Temp\92463f77f40595d193ec96d7110ca7d9.exe
      2⤵
      • Adds policy Run key to start application
      • Modifies Installed Components in the registry
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:2144
  • C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    1⤵
    • Adds policy Run key to start application
    • Modifies Installed Components in the registry
    PID:2168
  • C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2556
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    1⤵
      PID:2412

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2144-6-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB

          • memory/2144-7-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB

          • memory/2144-31-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB

          • memory/2144-16-0x0000000000400000-0x000000000073D000-memory.dmp

            Filesize

            3.2MB

          • memory/2144-17-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB

          • memory/2144-15-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB

          • memory/2144-5-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB

          • memory/2144-13-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB

          • memory/2144-10-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB

          • memory/2144-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

            Filesize

            4KB

          • memory/2168-26-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB

          • memory/2228-0-0x0000000000400000-0x000000000073D000-memory.dmp

            Filesize

            3.2MB

          • memory/2228-2-0x0000000000400000-0x000000000073D000-memory.dmp

            Filesize

            3.2MB

          • memory/2228-14-0x00000000036B0000-0x00000000039ED000-memory.dmp

            Filesize

            3.2MB

          • memory/2228-12-0x0000000000400000-0x000000000073D000-memory.dmp

            Filesize

            3.2MB

          • memory/2556-30-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB

          • memory/2556-33-0x0000000000C80000-0x0000000000C96000-memory.dmp

            Filesize

            88KB