Analysis

  • max time kernel
    159s
  • max time network
    173s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2023, 21:23

General

  • Target

    8fbaf88258e1acee8e1c85cb1cd92386.exe

  • Size

    183KB

  • MD5

    8fbaf88258e1acee8e1c85cb1cd92386

  • SHA1

    07375744c64ac222cb863088bb3897533ced6770

  • SHA256

    4aa74c09b33e85f7de851c4caf58f9cbec4f1ac6fdd1ed231e66e0a3335dd840

  • SHA512

    665a1e8cb3e9b2101aa6112ce46227aa0313978ddea5bad696d001bdcd70e9b0dc2c26c5a1894ca67b7e0ec16f6404ecc530cb84bc554194c3442940697efbe3

  • SSDEEP

    3072:hBPe+2TmObY97TkP7r7QYz0vaRUU4I82pdwVP8KmDnYZUpyl+9R2uhYJ5jP:veTmOb0fC/WypdwVkK8nxxhe

Malware Config

Extracted

Family

xtremerat

C2

headnoip.zapto.org

Signatures

  • Detect XtremeRAT payload 5 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8fbaf88258e1acee8e1c85cb1cd92386.exe
    "C:\Users\Admin\AppData\Local\Temp\8fbaf88258e1acee8e1c85cb1cd92386.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1840
    • C:\Users\Admin\AppData\Local\Temp\8fbaf88258e1acee8e1c85cb1cd92386.exe
      "C:\Users\Admin\AppData\Local\Temp\8fbaf88258e1acee8e1c85cb1cd92386.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:940
      • C:\Windows\SysWOW64\svchost.exe
        svchost.exe
        3⤵
          PID:4844
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 488
            4⤵
            • Program crash
            PID:4796
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 480
            4⤵
            • Program crash
            PID:3312
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
          3⤵
            PID:1284
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4844 -ip 4844
        1⤵
          PID:4716
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4844 -ip 4844
          1⤵
            PID:2944

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • memory/940-11-0x0000000010000000-0x000000001004D000-memory.dmp

                  Filesize

                  308KB

                • memory/940-12-0x0000000010000000-0x000000001004D000-memory.dmp

                  Filesize

                  308KB

                • memory/940-9-0x0000000010000000-0x000000001004D000-memory.dmp

                  Filesize

                  308KB

                • memory/940-6-0x0000000010000000-0x000000001004D000-memory.dmp

                  Filesize

                  308KB

                • memory/940-14-0x0000000010000000-0x000000001004D000-memory.dmp

                  Filesize

                  308KB

                • memory/1840-5-0x0000000000CF0000-0x0000000000D00000-memory.dmp

                  Filesize

                  64KB

                • memory/1840-10-0x0000000074CF0000-0x00000000752A1000-memory.dmp

                  Filesize

                  5.7MB

                • memory/1840-4-0x0000000074CF0000-0x00000000752A1000-memory.dmp

                  Filesize

                  5.7MB

                • memory/1840-1-0x0000000074CF0000-0x00000000752A1000-memory.dmp

                  Filesize

                  5.7MB

                • memory/1840-0-0x0000000074CF0000-0x00000000752A1000-memory.dmp

                  Filesize

                  5.7MB

                • memory/1840-3-0x0000000074CF0000-0x00000000752A1000-memory.dmp

                  Filesize

                  5.7MB

                • memory/1840-2-0x0000000000CF0000-0x0000000000D00000-memory.dmp

                  Filesize

                  64KB

                • memory/4844-13-0x0000000010000000-0x000000001004D000-memory.dmp

                  Filesize

                  308KB

                • memory/4844-15-0x0000000010000000-0x000000001004D000-memory.dmp

                  Filesize

                  308KB