Analysis
-
max time kernel
139s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 19:31
Static task
static1
Behavioral task
behavioral1
Sample
88bdbcaac918aecc7d234869c72ad4cd.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
88bdbcaac918aecc7d234869c72ad4cd.exe
Resource
win10v2004-20231215-en
General
-
Target
88bdbcaac918aecc7d234869c72ad4cd.exe
-
Size
223KB
-
MD5
88bdbcaac918aecc7d234869c72ad4cd
-
SHA1
32ec06a262002d09df0c4572818885215fc91f16
-
SHA256
27af0279ea91d157ec2fc9d0b5f1d5794a1c60656192d94cb19c578a40718175
-
SHA512
06ef922bcc544d50c41aa98c684860736dc08378c8cec7b8b81315354c01d0867e4c1e442e9f30c8b71339a58b86c5fbd010cbedc04c01ebbd4083f5dfd255a4
-
SSDEEP
6144:RYZe7PheEH+UEuQTs+NLIj13/zQ2I56EvcZnjbTo6:ie7PhIUXcn813bc56Eoo6
Malware Config
Extracted
xtremerat
untra.no-ip.biz
Signatures
-
Detect XtremeRAT payload 6 IoCs
resource yara_rule behavioral2/memory/4080-10-0x0000000000C80000-0x0000000000CA1000-memory.dmp family_xtremerat behavioral2/memory/2980-18-0x0000000000C80000-0x0000000000CA1000-memory.dmp family_xtremerat behavioral2/memory/4496-96-0x0000000000C80000-0x0000000000CA1000-memory.dmp family_xtremerat behavioral2/memory/4776-91-0x0000000000C80000-0x0000000000CA1000-memory.dmp family_xtremerat behavioral2/memory/4080-78-0x0000000000C80000-0x0000000000CA1000-memory.dmp family_xtremerat behavioral2/memory/4776-98-0x0000000000C80000-0x0000000000CA1000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{H285T2W7-608M-1G1P-BJQS-IB10AI67G7X2} 88bdbcaac918aecc7d234869c72ad4cd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{H285T2W7-608M-1G1P-BJQS-IB10AI67G7X2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" 88bdbcaac918aecc7d234869c72ad4cd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{H285T2W7-608M-1G1P-BJQS-IB10AI67G7X2} Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{H285T2W7-608M-1G1P-BJQS-IB10AI67G7X2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" Server.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation 88bdbcaac918aecc7d234869c72ad4cd.exe -
Executes dropped EXE 1 IoCs
pid Process 4776 Server.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" 88bdbcaac918aecc7d234869c72ad4cd.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" 88bdbcaac918aecc7d234869c72ad4cd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\InstallDir\Server.exe 88bdbcaac918aecc7d234869c72ad4cd.exe File created C:\Windows\InstallDir\Server.exe 88bdbcaac918aecc7d234869c72ad4cd.exe File opened for modification C:\Windows\InstallDir\ 88bdbcaac918aecc7d234869c72ad4cd.exe File opened for modification C:\Windows\InstallDir\Server.exe Server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 4080 wrote to memory of 2980 4080 88bdbcaac918aecc7d234869c72ad4cd.exe 21 PID 4080 wrote to memory of 2980 4080 88bdbcaac918aecc7d234869c72ad4cd.exe 21 PID 4080 wrote to memory of 2980 4080 88bdbcaac918aecc7d234869c72ad4cd.exe 21 PID 4080 wrote to memory of 2980 4080 88bdbcaac918aecc7d234869c72ad4cd.exe 21 PID 4080 wrote to memory of 4436 4080 88bdbcaac918aecc7d234869c72ad4cd.exe 23 PID 4080 wrote to memory of 4436 4080 88bdbcaac918aecc7d234869c72ad4cd.exe 23 PID 4080 wrote to memory of 4436 4080 88bdbcaac918aecc7d234869c72ad4cd.exe 23 PID 4080 wrote to memory of 3148 4080 88bdbcaac918aecc7d234869c72ad4cd.exe 30 PID 4080 wrote to memory of 3148 4080 88bdbcaac918aecc7d234869c72ad4cd.exe 30 PID 4080 wrote to memory of 3148 4080 88bdbcaac918aecc7d234869c72ad4cd.exe 30 PID 4080 wrote to memory of 1880 4080 88bdbcaac918aecc7d234869c72ad4cd.exe 46 PID 4080 wrote to memory of 1880 4080 88bdbcaac918aecc7d234869c72ad4cd.exe 46 PID 4080 wrote to memory of 1880 4080 88bdbcaac918aecc7d234869c72ad4cd.exe 46 PID 4080 wrote to memory of 4100 4080 88bdbcaac918aecc7d234869c72ad4cd.exe 61 PID 4080 wrote to memory of 4100 4080 88bdbcaac918aecc7d234869c72ad4cd.exe 61 PID 4080 wrote to memory of 4100 4080 88bdbcaac918aecc7d234869c72ad4cd.exe 61 PID 4080 wrote to memory of 4596 4080 88bdbcaac918aecc7d234869c72ad4cd.exe 75 PID 4080 wrote to memory of 4596 4080 88bdbcaac918aecc7d234869c72ad4cd.exe 75 PID 4080 wrote to memory of 4596 4080 88bdbcaac918aecc7d234869c72ad4cd.exe 75 PID 4080 wrote to memory of 4372 4080 88bdbcaac918aecc7d234869c72ad4cd.exe 89 PID 4080 wrote to memory of 4372 4080 88bdbcaac918aecc7d234869c72ad4cd.exe 89 PID 4080 wrote to memory of 4372 4080 88bdbcaac918aecc7d234869c72ad4cd.exe 89 PID 4080 wrote to memory of 1280 4080 88bdbcaac918aecc7d234869c72ad4cd.exe 102 PID 4080 wrote to memory of 1280 4080 88bdbcaac918aecc7d234869c72ad4cd.exe 102 PID 4080 wrote to memory of 1280 4080 88bdbcaac918aecc7d234869c72ad4cd.exe 102 PID 4080 wrote to memory of 1820 4080 88bdbcaac918aecc7d234869c72ad4cd.exe 103 PID 4080 wrote to memory of 1820 4080 88bdbcaac918aecc7d234869c72ad4cd.exe 103 PID 4080 wrote to memory of 4776 4080 88bdbcaac918aecc7d234869c72ad4cd.exe 109 PID 4080 wrote to memory of 4776 4080 88bdbcaac918aecc7d234869c72ad4cd.exe 109 PID 4080 wrote to memory of 4776 4080 88bdbcaac918aecc7d234869c72ad4cd.exe 109 PID 4776 wrote to memory of 4496 4776 Server.exe 106 PID 4776 wrote to memory of 4496 4776 Server.exe 106 PID 4776 wrote to memory of 4496 4776 Server.exe 106 PID 4776 wrote to memory of 4496 4776 Server.exe 106 PID 4776 wrote to memory of 4592 4776 Server.exe 107 PID 4776 wrote to memory of 4592 4776 Server.exe 107 PID 4776 wrote to memory of 4592 4776 Server.exe 107 PID 4776 wrote to memory of 3244 4776 Server.exe 108 PID 4776 wrote to memory of 3244 4776 Server.exe 108 PID 4776 wrote to memory of 3244 4776 Server.exe 108 PID 4776 wrote to memory of 4508 4776 Server.exe 110 PID 4776 wrote to memory of 4508 4776 Server.exe 110 PID 4776 wrote to memory of 4508 4776 Server.exe 110 PID 4776 wrote to memory of 1096 4776 Server.exe 111 PID 4776 wrote to memory of 1096 4776 Server.exe 111 PID 4776 wrote to memory of 1096 4776 Server.exe 111 PID 4776 wrote to memory of 3920 4776 Server.exe 112 PID 4776 wrote to memory of 3920 4776 Server.exe 112 PID 4776 wrote to memory of 3920 4776 Server.exe 112 PID 4776 wrote to memory of 4400 4776 Server.exe 114 PID 4776 wrote to memory of 4400 4776 Server.exe 114 PID 4776 wrote to memory of 4400 4776 Server.exe 114 PID 4776 wrote to memory of 4676 4776 Server.exe 115 PID 4776 wrote to memory of 4676 4776 Server.exe 115 PID 4776 wrote to memory of 4676 4776 Server.exe 115 PID 4776 wrote to memory of 4432 4776 Server.exe 116 PID 4776 wrote to memory of 4432 4776 Server.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\88bdbcaac918aecc7d234869c72ad4cd.exe"C:\Users\Admin\AppData\Local\Temp\88bdbcaac918aecc7d234869c72ad4cd.exe"1⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵PID:2980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:4436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:3148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:1880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:4100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:4596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:4372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:1280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:1820
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵PID:4508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵PID:1096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵PID:3920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵PID:4400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵PID:4676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵PID:4432
-
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe1⤵PID:4496
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"1⤵PID:4592
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"1⤵PID:3244