Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2023, 17:09

General

  • Target

    7f3288ccbcf8a013ab271528d5592fd2.exe

  • Size

    538KB

  • MD5

    7f3288ccbcf8a013ab271528d5592fd2

  • SHA1

    ae67dc40bfa75756af5d6b63168bdba9f9fc3d63

  • SHA256

    52b4760df29374cf59babed736100e689a10ecf9a8ab651d28010f6489fb4e46

  • SHA512

    7a31e4d5ad204ef70803ad6e9aa2ab80eb2d4bcf04f11a24033c171b9820742edc8fa79b2e4dacc4f5103369067baa303b77722613509319c2e35e54da57731a

  • SSDEEP

    12288:7E6SXHwL6D6N7fn5nPKK/lGRgOUqmq9kR6lhKX0d2eaG7OElJlW:Y6SXtD6Rn5PKK/cRgOnmq9g6Ser7OElO

Malware Config

Signatures

  • Detect XtremeRAT payload 6 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7f3288ccbcf8a013ab271528d5592fd2.exe
    "C:\Users\Admin\AppData\Local\Temp\7f3288ccbcf8a013ab271528d5592fd2.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3768
    • C:\Users\Admin\AppData\Local\Temp\7f3288ccbcf8a013ab271528d5592fd2.exe
      "C:\Users\Admin\AppData\Local\Temp\7f3288ccbcf8a013ab271528d5592fd2.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4352
  • C:\Users\Admin\AppData\Local\Temp\7f3288ccbcf8a013ab271528d5592fd2.exe
    1⤵
    • Modifies Installed Components in the registry
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:3076
    • C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      2⤵
      • Modifies Installed Components in the registry
      • Adds Run key to start application
      PID:4136
    • C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:3892

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Gy7rQ.xtr

          Filesize

          150KB

          MD5

          bf28f8fb31a4f40582f6101327d87699

          SHA1

          dba0a546428f6e8762e2b380ca610af2bcf2b652

          SHA256

          c3950ff601608fb705d1ec47860db16089e5869037be61563c5aad6540d27518

          SHA512

          c788e88f5f1cec1aa200de2f34e0fc1d1e7a4af8c3cce6406ded6b2bb1884b8ee5240cdfb621d3ebf453f13b07512df031f599d24c2eb02545fdf1dd6931220d

        • memory/3076-46-0x0000000000C80000-0x0000000000C96000-memory.dmp

          Filesize

          88KB

        • memory/3076-59-0x0000000000C80000-0x0000000000C96000-memory.dmp

          Filesize

          88KB

        • memory/3076-49-0x0000000000C80000-0x0000000000C96000-memory.dmp

          Filesize

          88KB

        • memory/3076-51-0x0000000000C80000-0x0000000000C96000-memory.dmp

          Filesize

          88KB

        • memory/3076-52-0x0000000000C80000-0x0000000000C96000-memory.dmp

          Filesize

          88KB

        • memory/3768-20-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

          Filesize

          4KB

        • memory/3768-34-0x0000000003AD0000-0x0000000003AD1000-memory.dmp

          Filesize

          4KB

        • memory/3768-11-0x0000000002220000-0x0000000002221000-memory.dmp

          Filesize

          4KB

        • memory/3768-10-0x0000000003A30000-0x0000000003A31000-memory.dmp

          Filesize

          4KB

        • memory/3768-15-0x0000000002290000-0x0000000002291000-memory.dmp

          Filesize

          4KB

        • memory/3768-17-0x00000000022C0000-0x00000000022C1000-memory.dmp

          Filesize

          4KB

        • memory/3768-0-0x0000000000400000-0x00000000004E7000-memory.dmp

          Filesize

          924KB

        • memory/3768-22-0x0000000002B80000-0x0000000002B81000-memory.dmp

          Filesize

          4KB

        • memory/3768-25-0x00000000022B0000-0x00000000022B1000-memory.dmp

          Filesize

          4KB

        • memory/3768-27-0x00000000006D0000-0x00000000006D1000-memory.dmp

          Filesize

          4KB

        • memory/3768-30-0x0000000003A40000-0x0000000003A41000-memory.dmp

          Filesize

          4KB

        • memory/3768-29-0x0000000003A50000-0x0000000003A51000-memory.dmp

          Filesize

          4KB

        • memory/3768-28-0x0000000003A60000-0x0000000003A61000-memory.dmp

          Filesize

          4KB

        • memory/3768-26-0x0000000000540000-0x0000000000541000-memory.dmp

          Filesize

          4KB

        • memory/3768-24-0x0000000002BE0000-0x0000000002BE1000-memory.dmp

          Filesize

          4KB

        • memory/3768-23-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

          Filesize

          4KB

        • memory/3768-21-0x0000000002B90000-0x0000000002B91000-memory.dmp

          Filesize

          4KB

        • memory/3768-19-0x0000000002300000-0x0000000002301000-memory.dmp

          Filesize

          4KB

        • memory/3768-18-0x0000000002280000-0x0000000002281000-memory.dmp

          Filesize

          4KB

        • memory/3768-16-0x00000000022F0000-0x00000000022F1000-memory.dmp

          Filesize

          4KB

        • memory/3768-14-0x00000000022A0000-0x00000000022A1000-memory.dmp

          Filesize

          4KB

        • memory/3768-12-0x0000000003A20000-0x0000000003A23000-memory.dmp

          Filesize

          12KB

        • memory/3768-32-0x0000000003AE0000-0x0000000003AE1000-memory.dmp

          Filesize

          4KB

        • memory/3768-9-0x0000000002240000-0x0000000002241000-memory.dmp

          Filesize

          4KB

        • memory/3768-37-0x0000000003B10000-0x0000000003B11000-memory.dmp

          Filesize

          4KB

        • memory/3768-41-0x0000000003B30000-0x0000000003B31000-memory.dmp

          Filesize

          4KB

        • memory/3768-42-0x00000000021C0000-0x0000000002220000-memory.dmp

          Filesize

          384KB

        • memory/3768-43-0x0000000003B60000-0x0000000003B61000-memory.dmp

          Filesize

          4KB

        • memory/3768-39-0x0000000000400000-0x00000000004E7000-memory.dmp

          Filesize

          924KB

        • memory/3768-1-0x00000000021C0000-0x0000000002220000-memory.dmp

          Filesize

          384KB

        • memory/3768-8-0x00000000021A0000-0x00000000021A1000-memory.dmp

          Filesize

          4KB

        • memory/3768-5-0x0000000002160000-0x0000000002161000-memory.dmp

          Filesize

          4KB

        • memory/3768-7-0x0000000002250000-0x0000000002251000-memory.dmp

          Filesize

          4KB

        • memory/3768-4-0x0000000002230000-0x0000000002231000-memory.dmp

          Filesize

          4KB

        • memory/3768-2-0x0000000002180000-0x0000000002181000-memory.dmp

          Filesize

          4KB

        • memory/3768-40-0x0000000003B40000-0x0000000003B41000-memory.dmp

          Filesize

          4KB

        • memory/3768-36-0x0000000003B20000-0x0000000003B21000-memory.dmp

          Filesize

          4KB

        • memory/3768-3-0x0000000002170000-0x0000000002171000-memory.dmp

          Filesize

          4KB

        • memory/3892-58-0x0000000000C80000-0x0000000000C96000-memory.dmp

          Filesize

          88KB

        • memory/3892-61-0x0000000000C80000-0x0000000000C96000-memory.dmp

          Filesize

          88KB

        • memory/4136-56-0x0000000000C80000-0x0000000000C96000-memory.dmp

          Filesize

          88KB

        • memory/4352-35-0x0000000000400000-0x0000000000419000-memory.dmp

          Filesize

          100KB

        • memory/4352-31-0x0000000000400000-0x0000000000419000-memory.dmp

          Filesize

          100KB

        • memory/4352-48-0x0000000000400000-0x0000000000419000-memory.dmp

          Filesize

          100KB

        • memory/4352-45-0x0000000000400000-0x0000000000419000-memory.dmp

          Filesize

          100KB