Analysis

  • max time kernel
    147s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    26/12/2023, 21:28

General

  • Target

    8ffb95d5e237a22a2773b17e34a4c6b0.exe

  • Size

    668KB

  • MD5

    8ffb95d5e237a22a2773b17e34a4c6b0

  • SHA1

    7e74c23a6d66fc6ad4d6a5397642476af48735ad

  • SHA256

    31eb4492dbdb099fae987f89fdb66fcd2a79367d6112a7f4a3ae47fdfa9e62d5

  • SHA512

    e8a3c594e6d0009ad6cfe1f7d3341dcadac3fb536c001e0490c6b5f702abf904a30efc3964f797894c1aabbe03eb310d79ebf3e436b2a80c51dcc29de7f2aca8

  • SSDEEP

    12288:+OqBS5JJ/+EkGz1lr3nxGteN4r3t8UOGz624SitfLmygYuV:/CSYE7z193Rit8UJ62BmhgjV

Malware Config

Extracted

Family

xtremerat

C2

sweetma198.no-ip.info

Signatures

  • Detect XtremeRAT payload 12 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 3 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 8 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe
    "C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3068
    • C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe
      C:\Users\Admin\AppData\Local\Temp\8ffb95d5e237a22a2773b17e34a4c6b0.exe
      2⤵
      • Modifies Installed Components in the registry
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:2004
      • C:\Windows\SysWOW64\svchost.exe
        svchost.exe
        3⤵
        • Modifies Installed Components in the registry
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2672
        • C:\Windows\InstallDir\skypa.exe
          "C:\Windows\InstallDir\skypa.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:1968
          • C:\Windows\InstallDir\skypa.exe
            C:\Windows\InstallDir\skypa.exe
            5⤵
            • Executes dropped EXE
            PID:1684
      • C:\Windows\SysWOW64\explorer.exe
        explorer.exe
        3⤵
        • Loads dropped DLL
        • Drops desktop.ini file(s)
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2856
        • C:\Windows\InstallDir\skypa.exe
          "C:\Windows\InstallDir\skypa.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2640
          • C:\Windows\InstallDir\skypa.exe
            C:\Windows\InstallDir\skypa.exe
            5⤵
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of SetThreadContext
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:2860
            • C:\Windows\SysWOW64\explorer.exe
              explorer.exe
              6⤵
              • Modifies Installed Components in the registry
              • Adds Run key to start application
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              PID:544

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\a24hcUtl1.cfg

          Filesize

          1KB

          MD5

          3c4d3cd283491acb2b8be880e6515e34

          SHA1

          24a402254b7b16a007a334655e811fee25bfac61

          SHA256

          077c026e8eaa149a9a0b3b2f361f1d5d90852bd082d40d5366f70a3b783100e5

          SHA512

          ec420ca447b53ec38b1ac879d8e03ad7f89babf8ce0f81d91d0befae0402f594e6a7f229763d6a3a1483a4d8658cdd5e581a7bf35d496c98402460d608a970c1

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\a24hcUtl1.dat

          Filesize

          2B

          MD5

          84cad01fdb44ae58dbe6c3973dcd87f5

          SHA1

          4700b42849fb35be323774820bf1bc8019d26c80

          SHA256

          8b1f194be530240c18bf0b1ee0d038e750fab8b24c6bd25c864297e5ebb41fa6

          SHA512

          6e10d3ec4724c1aca9ff3f6a26292ba80065d18e8e9395f1474c0a298008f25e312e2f7024e7d10aab3264764e69a25553cc20afd23090f83921d20e42b989ab

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\a24hcUtl1.xtr

          Filesize

          343KB

          MD5

          6426d400c96fb9ffef4eaa54f6647f4c

          SHA1

          70a37871aff432790b6adf7d3fc4eb929476e082

          SHA256

          98bba0cf4c57ecd35b227f45e4aa6dd50ef7cfb1160235cc14687c96eb09fa3c

          SHA512

          2c8b4d3ab066cbfca6cf0c8d89d5044152b5e3d7100249cbedd1c816e3a4a94efc8bc6b79c1dab4bdf96e3ce476d6caccf625cfbe0aff3bf5e7a29dfcfa948c5

        • C:\Windows\InstallDir\skypa.exe

          Filesize

          93KB

          MD5

          391211f48801d386ad55f2327543c4c0

          SHA1

          5d77cd181341594311ce384b451ab9bdf4bb607b

          SHA256

          53fbae69f1cda07a6cc91fe4833c6f2a73178bcd5da3216514fc854c0ca5c2ef

          SHA512

          b2dd1358f353192aab5a5aa2bbc762f1f28a1aacca21543a9a2c44d887bfcf8de36d5a524bd3b4f05a758ea12ec70784087fbb063d1d782410b5fe73169dbe89

        • C:\Windows\InstallDir\skypa.exe

          Filesize

          381KB

          MD5

          77602e679bc6f083bc49aae4f658adb5

          SHA1

          21cf0e86ad3febf0da71444bb879399e0754032f

          SHA256

          4c35b58be0d9a61037790b82b7b9d5b08bf695af7e3a0c75ea2a3e5efb1cd359

          SHA512

          ee5b8a18f03673a53023a2f2d2d6178457c4111ab7a154e4fab6bdef23d1be2599a79271da5c7523f7ade151077eb86c070bb0f41d7a3f2cf42f6f4f025f31fa

        • C:\Windows\InstallDir\skypa.exe

          Filesize

          192KB

          MD5

          37ae693d4a9a755b9c620bf5473bd3d1

          SHA1

          54af2c11b8aae8d6cfe855b250f53a5051728215

          SHA256

          bbb5b65c4320858bbc4016265cfc49baf1bcff7b9495e4ec29c5576f5f638421

          SHA512

          96c6eb3dad16b5c7e6e4300983501e390d38415b50515e6412c70b6af7046933aaa7b15edf12676f5ea530273bd83d5e3ed37ed926382f51c682e4570324607d

        • \Windows\InstallDir\skypa.exe

          Filesize

          668KB

          MD5

          8ffb95d5e237a22a2773b17e34a4c6b0

          SHA1

          7e74c23a6d66fc6ad4d6a5397642476af48735ad

          SHA256

          31eb4492dbdb099fae987f89fdb66fcd2a79367d6112a7f4a3ae47fdfa9e62d5

          SHA512

          e8a3c594e6d0009ad6cfe1f7d3341dcadac3fb536c001e0490c6b5f702abf904a30efc3964f797894c1aabbe03eb310d79ebf3e436b2a80c51dcc29de7f2aca8

        • \Windows\InstallDir\skypa.exe

          Filesize

          64KB

          MD5

          1ad8c36c519b748fbe1aa79b574573fa

          SHA1

          d783363eeb161fbd096b5657c2a27480b3e1f79a

          SHA256

          44ca58e48755b2148b09dce0fcc79a4a87495110cb3c9a4b9fbfb1530c29ceaf

          SHA512

          8bc7fa99e860b07e478f4d1357c98f484ad649a2e2223deabfffe62350f68d0948669fdd503257bb891aa2c32b1d7d7c44fe6dfd4402e71ca3331b47d4b1b684

        • memory/544-79-0x0000000001610000-0x0000000001712000-memory.dmp

          Filesize

          1.0MB

        • memory/544-76-0x0000000001610000-0x0000000001712000-memory.dmp

          Filesize

          1.0MB

        • memory/544-121-0x0000000000130000-0x0000000000131000-memory.dmp

          Filesize

          4KB

        • memory/544-90-0x0000000001610000-0x0000000001712000-memory.dmp

          Filesize

          1.0MB

        • memory/544-89-0x0000000001610000-0x0000000001712000-memory.dmp

          Filesize

          1.0MB

        • memory/544-88-0x0000000000130000-0x0000000000131000-memory.dmp

          Filesize

          4KB

        • memory/544-86-0x0000000001610000-0x0000000001712000-memory.dmp

          Filesize

          1.0MB

        • memory/544-87-0x0000000001610000-0x0000000001712000-memory.dmp

          Filesize

          1.0MB

        • memory/544-85-0x0000000001610000-0x0000000001712000-memory.dmp

          Filesize

          1.0MB

        • memory/544-82-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/544-81-0x0000000001610000-0x0000000001712000-memory.dmp

          Filesize

          1.0MB

        • memory/544-77-0x0000000001610000-0x0000000001712000-memory.dmp

          Filesize

          1.0MB

        • memory/2004-0-0x0000000000C80000-0x0000000000CE9000-memory.dmp

          Filesize

          420KB

        • memory/2004-1-0x0000000000C80000-0x0000000000CE9000-memory.dmp

          Filesize

          420KB

        • memory/2004-4-0x0000000000C80000-0x0000000000CE9000-memory.dmp

          Filesize

          420KB

        • memory/2004-12-0x0000000000C80000-0x0000000000CE9000-memory.dmp

          Filesize

          420KB

        • memory/2004-7-0x0000000000C80000-0x0000000000CE9000-memory.dmp

          Filesize

          420KB

        • memory/2004-10-0x0000000000C80000-0x0000000000CE9000-memory.dmp

          Filesize

          420KB

        • memory/2004-2-0x0000000000C80000-0x0000000000CE9000-memory.dmp

          Filesize

          420KB

        • memory/2004-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2004-18-0x0000000000C80000-0x0000000000CE9000-memory.dmp

          Filesize

          420KB

        • memory/2004-14-0x0000000000C80000-0x0000000000CE9000-memory.dmp

          Filesize

          420KB

        • memory/2640-51-0x0000000023240000-0x000000002326A000-memory.dmp

          Filesize

          168KB

        • memory/2672-28-0x0000000000C80000-0x0000000000CE9000-memory.dmp

          Filesize

          420KB

        • memory/2856-46-0x0000000000C80000-0x0000000000CE9000-memory.dmp

          Filesize

          420KB

        • memory/2856-32-0x0000000000C80000-0x0000000000CE9000-memory.dmp

          Filesize

          420KB

        • memory/2856-40-0x0000000000C80000-0x0000000000CE9000-memory.dmp

          Filesize

          420KB

        • memory/2856-34-0x0000000000C80000-0x0000000000CE9000-memory.dmp

          Filesize

          420KB

        • memory/3068-19-0x0000000023240000-0x000000002326A000-memory.dmp

          Filesize

          168KB