Analysis
-
max time kernel
25s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 22:18
Static task
static1
Behavioral task
behavioral1
Sample
92463f77f40595d193ec96d7110ca7d9.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
92463f77f40595d193ec96d7110ca7d9.exe
Resource
win10v2004-20231215-en
General
-
Target
92463f77f40595d193ec96d7110ca7d9.exe
-
Size
597KB
-
MD5
92463f77f40595d193ec96d7110ca7d9
-
SHA1
a1ef00f5635ade5de097373d89710cf00f16bfe3
-
SHA256
3ea0ae2b4f2ef54ec31a155fd20c493ebc6aae640aadf20a2731f50e3e1242f0
-
SHA512
59116d3df98e5ac0aecffc71328cc3d6065bbc193df1fc2555ebcc71783a3cdc16600ef54a6bf6aabcb3de6a230fc592bf302c8a879d817b6a6e3dcc5df7b7a5
-
SSDEEP
12288:WqucHnZrJ2WFtJMOqf2Q1/1MoF5+eh8aWvp2g1iqoY3t+vVLtT/:tr0YtKOqr1i+H6aWvpX3uVLtT/
Malware Config
Signatures
-
Detect XtremeRAT payload 6 IoCs
resource yara_rule behavioral1/memory/2144-17-0x0000000000C80000-0x0000000000C96000-memory.dmp family_xtremerat behavioral1/memory/2144-15-0x0000000000C80000-0x0000000000C96000-memory.dmp family_xtremerat behavioral1/memory/2556-30-0x0000000000C80000-0x0000000000C96000-memory.dmp family_xtremerat behavioral1/memory/2168-26-0x0000000000C80000-0x0000000000C96000-memory.dmp family_xtremerat behavioral1/memory/2144-31-0x0000000000C80000-0x0000000000C96000-memory.dmp family_xtremerat behavioral1/memory/2556-33-0x0000000000C80000-0x0000000000C96000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Adds policy Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Updater = "C:\\Windows\\UpdaterWin\\update.exe" 92463f77f40595d193ec96d7110ca7d9.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 92463f77f40595d193ec96d7110ca7d9.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Updater = "C:\\Windows\\UpdaterWin\\update.exe" 92463f77f40595d193ec96d7110ca7d9.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Updater = "C:\\Windows\\UpdaterWin\\update.exe" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Updater = "C:\\Windows\\UpdaterWin\\update.exe" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 92463f77f40595d193ec96d7110ca7d9.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\UpdaterWin\\update.exe restart" svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} 92463f77f40595d193ec96d7110ca7d9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\UpdaterWin\\update.exe restart" 92463f77f40595d193ec96d7110ca7d9.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} svchost.exe -
resource yara_rule behavioral1/memory/2144-17-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral1/memory/2144-15-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral1/memory/2144-13-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral1/memory/2556-30-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral1/memory/2168-26-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral1/memory/2144-10-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral1/memory/2144-6-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral1/memory/2144-7-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral1/memory/2144-31-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral1/memory/2556-33-0x0000000000C80000-0x0000000000C96000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2228 set thread context of 2144 2228 92463f77f40595d193ec96d7110ca7d9.exe 19 -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\UpdaterWin\update.exe 92463f77f40595d193ec96d7110ca7d9.exe File created C:\Windows\UpdaterWin\update.exe 92463f77f40595d193ec96d7110ca7d9.exe File opened for modification C:\Windows\UpdaterWin\ 92463f77f40595d193ec96d7110ca7d9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2228 92463f77f40595d193ec96d7110ca7d9.exe 2228 92463f77f40595d193ec96d7110ca7d9.exe 2556 explorer.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2228 wrote to memory of 2144 2228 92463f77f40595d193ec96d7110ca7d9.exe 19 PID 2228 wrote to memory of 2144 2228 92463f77f40595d193ec96d7110ca7d9.exe 19 PID 2228 wrote to memory of 2144 2228 92463f77f40595d193ec96d7110ca7d9.exe 19 PID 2228 wrote to memory of 2144 2228 92463f77f40595d193ec96d7110ca7d9.exe 19 PID 2228 wrote to memory of 2144 2228 92463f77f40595d193ec96d7110ca7d9.exe 19 PID 2228 wrote to memory of 2144 2228 92463f77f40595d193ec96d7110ca7d9.exe 19 PID 2228 wrote to memory of 2144 2228 92463f77f40595d193ec96d7110ca7d9.exe 19 PID 2228 wrote to memory of 2144 2228 92463f77f40595d193ec96d7110ca7d9.exe 19 PID 2144 wrote to memory of 2168 2144 92463f77f40595d193ec96d7110ca7d9.exe 16 PID 2144 wrote to memory of 2168 2144 92463f77f40595d193ec96d7110ca7d9.exe 16 PID 2144 wrote to memory of 2168 2144 92463f77f40595d193ec96d7110ca7d9.exe 16 PID 2144 wrote to memory of 2168 2144 92463f77f40595d193ec96d7110ca7d9.exe 16 PID 2144 wrote to memory of 2168 2144 92463f77f40595d193ec96d7110ca7d9.exe 16 PID 2144 wrote to memory of 2412 2144 92463f77f40595d193ec96d7110ca7d9.exe 18 PID 2144 wrote to memory of 2412 2144 92463f77f40595d193ec96d7110ca7d9.exe 18 PID 2144 wrote to memory of 2412 2144 92463f77f40595d193ec96d7110ca7d9.exe 18 PID 2144 wrote to memory of 2412 2144 92463f77f40595d193ec96d7110ca7d9.exe 18 PID 2144 wrote to memory of 2556 2144 92463f77f40595d193ec96d7110ca7d9.exe 17 PID 2144 wrote to memory of 2556 2144 92463f77f40595d193ec96d7110ca7d9.exe 17 PID 2144 wrote to memory of 2556 2144 92463f77f40595d193ec96d7110ca7d9.exe 17 PID 2144 wrote to memory of 2556 2144 92463f77f40595d193ec96d7110ca7d9.exe 17 PID 2144 wrote to memory of 2556 2144 92463f77f40595d193ec96d7110ca7d9.exe 17
Processes
-
C:\Users\Admin\AppData\Local\Temp\92463f77f40595d193ec96d7110ca7d9.exe"C:\Users\Admin\AppData\Local\Temp\92463f77f40595d193ec96d7110ca7d9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\92463f77f40595d193ec96d7110ca7d9.exe2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2144
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe1⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
PID:2168
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe1⤵
- Suspicious use of SetWindowsHookEx
PID:2556
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"1⤵PID:2412