Analysis

  • max time kernel
    152s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2023, 22:18

General

  • Target

    92463f77f40595d193ec96d7110ca7d9.exe

  • Size

    597KB

  • MD5

    92463f77f40595d193ec96d7110ca7d9

  • SHA1

    a1ef00f5635ade5de097373d89710cf00f16bfe3

  • SHA256

    3ea0ae2b4f2ef54ec31a155fd20c493ebc6aae640aadf20a2731f50e3e1242f0

  • SHA512

    59116d3df98e5ac0aecffc71328cc3d6065bbc193df1fc2555ebcc71783a3cdc16600ef54a6bf6aabcb3de6a230fc592bf302c8a879d817b6a6e3dcc5df7b7a5

  • SSDEEP

    12288:WqucHnZrJ2WFtJMOqf2Q1/1MoF5+eh8aWvp2g1iqoY3t+vVLtT/:tr0YtKOqr1i+H6aWvpX3uVLtT/

Malware Config

Signatures

  • Detect XtremeRAT payload 5 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Adds policy Run key to start application 2 TTPs 8 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\92463f77f40595d193ec96d7110ca7d9.exe
    "C:\Users\Admin\AppData\Local\Temp\92463f77f40595d193ec96d7110ca7d9.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4968
    • C:\Users\Admin\AppData\Local\Temp\92463f77f40595d193ec96d7110ca7d9.exe
      2⤵
      • Adds policy Run key to start application
      • Modifies Installed Components in the registry
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:1936
      • C:\Windows\SysWOW64\svchost.exe
        svchost.exe
        3⤵
        • Adds policy Run key to start application
        • Modifies Installed Components in the registry
        PID:2884
      • C:\Windows\SysWOW64\explorer.exe
        explorer.exe
        3⤵
          PID:3332
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
          3⤵
            PID:936
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            3⤵
              PID:852
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
              3⤵
                PID:2508
              • C:\Windows\SysWOW64\explorer.exe
                explorer.exe
                3⤵
                • Suspicious use of SetWindowsHookEx
                PID:4536
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                3⤵
                  PID:4592

            Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Windows\UpdaterWin\update.exe

                    Filesize

                    92KB

                    MD5

                    ec0ed29f0f219f10b95e807bea9388a7

                    SHA1

                    01377f44b70103cc3666be777f70485c9baeaf37

                    SHA256

                    ebc59363d110fd29e8a8bef24a303dacf9b018bccc778265114047460929740e

                    SHA512

                    e89587940cfa2398edeee973def00373480aa763ea9b471edd06dc363658cfc28cf4c8bb0fdca1f9be1ae3b0d8905f6cb51c30e18a12b702964bb57fc8052792

                  • memory/1936-5-0x0000000000C80000-0x0000000000C96000-memory.dmp

                    Filesize

                    88KB

                  • memory/1936-10-0x0000000000C80000-0x0000000000C96000-memory.dmp

                    Filesize

                    88KB

                  • memory/1936-7-0x0000000000C80000-0x0000000000C96000-memory.dmp

                    Filesize

                    88KB

                  • memory/1936-20-0x0000000000C80000-0x0000000000C96000-memory.dmp

                    Filesize

                    88KB

                  • memory/2884-17-0x0000000000C80000-0x0000000000C96000-memory.dmp

                    Filesize

                    88KB

                  • memory/4536-19-0x0000000000C80000-0x0000000000C96000-memory.dmp

                    Filesize

                    88KB

                  • memory/4536-22-0x0000000000C80000-0x0000000000C96000-memory.dmp

                    Filesize

                    88KB

                  • memory/4968-0-0x0000000000400000-0x000000000073D000-memory.dmp

                    Filesize

                    3.2MB

                  • memory/4968-2-0x0000000000400000-0x000000000073D000-memory.dmp

                    Filesize

                    3.2MB

                  • memory/4968-8-0x0000000000400000-0x000000000073D000-memory.dmp

                    Filesize

                    3.2MB