Analysis
-
max time kernel
148s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 18:51
Static task
static1
Behavioral task
behavioral1
Sample
85cc2fe2f271f615bb4fe4b9107461c4.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
85cc2fe2f271f615bb4fe4b9107461c4.exe
Resource
win10v2004-20231215-en
General
-
Target
85cc2fe2f271f615bb4fe4b9107461c4.exe
-
Size
109KB
-
MD5
85cc2fe2f271f615bb4fe4b9107461c4
-
SHA1
f30cfec3c082a42a1623b4b024f31605e960c9ef
-
SHA256
000b4632c1849889a989210d6794eaa9338379a416456755c2e00f1a1e939447
-
SHA512
645cb2cbdff113f4eb49cbec63866770374f7fa85b6d22517f8760d33a748623adb640caead2279bbbd33f871b07a85f5740930640f3a1bc62d54821d903440c
-
SSDEEP
3072:YmBS5BuIPHxD8Un3lrn70YdyD2hSjZdxm:BYZpDrn15hkZdxm
Malware Config
Extracted
xtremerat
vvnv12.no-ip.biz
Signatures
-
Detect XtremeRAT payload 8 IoCs
resource yara_rule behavioral2/memory/2092-6-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral2/memory/2092-7-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral2/memory/4652-8-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral2/memory/2092-11-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral2/memory/4652-12-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral2/memory/2092-4-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral2/memory/2092-3-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral2/memory/2092-13-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} 85cc2fe2f271f615bb4fe4b9107461c4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\Windows Genuine Update\\Advantage.exe restart" 85cc2fe2f271f615bb4fe4b9107461c4.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Genuine Update = "C:\\Windows\\Windows Genuine Update\\Advantage.exe" 85cc2fe2f271f615bb4fe4b9107461c4.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Genuine Update = "C:\\Windows\\Windows Genuine Update\\Advantage.exe" 85cc2fe2f271f615bb4fe4b9107461c4.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 748 set thread context of 2092 748 85cc2fe2f271f615bb4fe4b9107461c4.exe 30 -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Windows Genuine Update\Advantage.exe 85cc2fe2f271f615bb4fe4b9107461c4.exe File created C:\Windows\Windows Genuine Update\Advantage.exe 85cc2fe2f271f615bb4fe4b9107461c4.exe File opened for modification C:\Windows\Windows Genuine Update\ 85cc2fe2f271f615bb4fe4b9107461c4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 4584 4652 WerFault.exe 24 740 4652 WerFault.exe 24 -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 748 85cc2fe2f271f615bb4fe4b9107461c4.exe 2092 85cc2fe2f271f615bb4fe4b9107461c4.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 748 wrote to memory of 2092 748 85cc2fe2f271f615bb4fe4b9107461c4.exe 30 PID 748 wrote to memory of 2092 748 85cc2fe2f271f615bb4fe4b9107461c4.exe 30 PID 748 wrote to memory of 2092 748 85cc2fe2f271f615bb4fe4b9107461c4.exe 30 PID 748 wrote to memory of 2092 748 85cc2fe2f271f615bb4fe4b9107461c4.exe 30 PID 748 wrote to memory of 2092 748 85cc2fe2f271f615bb4fe4b9107461c4.exe 30 PID 748 wrote to memory of 2092 748 85cc2fe2f271f615bb4fe4b9107461c4.exe 30 PID 748 wrote to memory of 2092 748 85cc2fe2f271f615bb4fe4b9107461c4.exe 30 PID 748 wrote to memory of 2092 748 85cc2fe2f271f615bb4fe4b9107461c4.exe 30 PID 748 wrote to memory of 2092 748 85cc2fe2f271f615bb4fe4b9107461c4.exe 30 PID 748 wrote to memory of 2092 748 85cc2fe2f271f615bb4fe4b9107461c4.exe 30 PID 748 wrote to memory of 2092 748 85cc2fe2f271f615bb4fe4b9107461c4.exe 30 PID 748 wrote to memory of 2092 748 85cc2fe2f271f615bb4fe4b9107461c4.exe 30 PID 748 wrote to memory of 2092 748 85cc2fe2f271f615bb4fe4b9107461c4.exe 30 PID 2092 wrote to memory of 4652 2092 85cc2fe2f271f615bb4fe4b9107461c4.exe 24 PID 2092 wrote to memory of 4652 2092 85cc2fe2f271f615bb4fe4b9107461c4.exe 24 PID 2092 wrote to memory of 4652 2092 85cc2fe2f271f615bb4fe4b9107461c4.exe 24 PID 2092 wrote to memory of 4652 2092 85cc2fe2f271f615bb4fe4b9107461c4.exe 24
Processes
-
C:\Users\Admin\AppData\Local\Temp\85cc2fe2f271f615bb4fe4b9107461c4.exe"C:\Users\Admin\AppData\Local\Temp\85cc2fe2f271f615bb4fe4b9107461c4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\85cc2fe2f271f615bb4fe4b9107461c4.exe2⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe1⤵PID:4652
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 4762⤵
- Program crash
PID:4584
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 5002⤵
- Program crash
PID:740
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4652 -ip 46521⤵PID:5100
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4652 -ip 46521⤵PID:4892