Analysis

  • max time kernel
    139s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2023, 19:31

General

  • Target

    88bdbcaac918aecc7d234869c72ad4cd.exe

  • Size

    223KB

  • MD5

    88bdbcaac918aecc7d234869c72ad4cd

  • SHA1

    32ec06a262002d09df0c4572818885215fc91f16

  • SHA256

    27af0279ea91d157ec2fc9d0b5f1d5794a1c60656192d94cb19c578a40718175

  • SHA512

    06ef922bcc544d50c41aa98c684860736dc08378c8cec7b8b81315354c01d0867e4c1e442e9f30c8b71339a58b86c5fbd010cbedc04c01ebbd4083f5dfd255a4

  • SSDEEP

    6144:RYZe7PheEH+UEuQTs+NLIj13/zQ2I56EvcZnjbTo6:ie7PhIUXcn813bc56Eoo6

Malware Config

Extracted

Family

xtremerat

C2

untra.no-ip.biz

Signatures

  • Detect XtremeRAT payload 6 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 57 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\88bdbcaac918aecc7d234869c72ad4cd.exe
    "C:\Users\Admin\AppData\Local\Temp\88bdbcaac918aecc7d234869c72ad4cd.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4080
    • C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      2⤵
        PID:2980
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        2⤵
          PID:4436
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
          2⤵
            PID:3148
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
            2⤵
              PID:1880
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
              2⤵
                PID:4100
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                2⤵
                  PID:4596
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                  2⤵
                    PID:4372
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                    2⤵
                      PID:1280
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                      2⤵
                        PID:1820
                      • C:\Windows\InstallDir\Server.exe
                        "C:\Windows\InstallDir\Server.exe"
                        2⤵
                        • Modifies Installed Components in the registry
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:4776
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                          3⤵
                            PID:4508
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                            3⤵
                              PID:1096
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                              3⤵
                                PID:3920
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                3⤵
                                  PID:4400
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                  3⤵
                                    PID:4676
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                    3⤵
                                      PID:4432
                                • C:\Windows\SysWOW64\svchost.exe
                                  svchost.exe
                                  1⤵
                                    PID:4496
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                    1⤵
                                      PID:4592
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                      1⤵
                                        PID:3244

                                      Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • memory/2980-18-0x0000000000C80000-0x0000000000CA1000-memory.dmp

                                              Filesize

                                              132KB

                                            • memory/4080-5-0x0000000077152000-0x0000000077153000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4080-1-0x00000000006B0000-0x00000000006FE000-memory.dmp

                                              Filesize

                                              312KB

                                            • memory/4080-8-0x0000000000930000-0x0000000000940000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/4080-7-0x00000000766A0000-0x0000000076790000-memory.dmp

                                              Filesize

                                              960KB

                                            • memory/4080-11-0x0000000000960000-0x0000000000970000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/4080-6-0x00000000009E0000-0x00000000009F0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/4080-10-0x0000000000C80000-0x0000000000CA1000-memory.dmp

                                              Filesize

                                              132KB

                                            • memory/4080-3-0x0000000000930000-0x0000000000940000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/4080-4-0x0000000000960000-0x0000000000970000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/4080-2-0x0000000000C80000-0x0000000000CA1000-memory.dmp

                                              Filesize

                                              132KB

                                            • memory/4080-9-0x00000000009E0000-0x00000000009F0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/4080-0-0x0000000000560000-0x0000000000561000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4080-78-0x0000000000C80000-0x0000000000CA1000-memory.dmp

                                              Filesize

                                              132KB

                                            • memory/4080-81-0x00000000766A0000-0x0000000076790000-memory.dmp

                                              Filesize

                                              960KB

                                            • memory/4080-82-0x00000000006B0000-0x00000000006FE000-memory.dmp

                                              Filesize

                                              312KB

                                            • memory/4496-96-0x0000000000C80000-0x0000000000CA1000-memory.dmp

                                              Filesize

                                              132KB

                                            • memory/4776-91-0x0000000000C80000-0x0000000000CA1000-memory.dmp

                                              Filesize

                                              132KB

                                            • memory/4776-90-0x0000000002320000-0x0000000002330000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/4776-89-0x0000000002380000-0x0000000002390000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/4776-88-0x00000000766A0000-0x0000000076790000-memory.dmp

                                              Filesize

                                              960KB

                                            • memory/4776-87-0x0000000002200000-0x0000000002210000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/4776-86-0x0000000077152000-0x0000000077153000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4776-85-0x0000000002320000-0x0000000002330000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/4776-84-0x0000000002380000-0x0000000002390000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/4776-83-0x00000000020C0000-0x000000000210E000-memory.dmp

                                              Filesize

                                              312KB

                                            • memory/4776-92-0x0000000002200000-0x0000000002210000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/4776-80-0x00000000004B0000-0x00000000004B1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4776-79-0x0000000000C80000-0x0000000000CA1000-memory.dmp

                                              Filesize

                                              132KB

                                            • memory/4776-98-0x0000000000C80000-0x0000000000CA1000-memory.dmp

                                              Filesize

                                              132KB

                                            • memory/4776-100-0x00000000766A0000-0x0000000076790000-memory.dmp

                                              Filesize

                                              960KB

                                            • memory/4776-99-0x00000000020C0000-0x000000000210E000-memory.dmp

                                              Filesize

                                              312KB