Analysis
-
max time kernel
146s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
07/01/2024, 05:21
Static task
static1
Behavioral task
behavioral1
Sample
48233c394fd136a8e8c50f72c479818d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
48233c394fd136a8e8c50f72c479818d.exe
Resource
win10v2004-20231222-en
General
-
Target
48233c394fd136a8e8c50f72c479818d.exe
-
Size
120KB
-
MD5
48233c394fd136a8e8c50f72c479818d
-
SHA1
a286371bf593d75e5932e75b0f7ccbd85e81b13b
-
SHA256
054ce23e77868d3b70a3884cc350b48c75e9fa63b774df6718ca6ae608b00fdf
-
SHA512
2fa9e8fe42cf7146a10963cb52a1e5d733e233147c5be2a3f0a6109695f1b2eb2b7ed0ebf5e56c96e7f61c5ca41d8ba55329d57d13d949382bdfbfc7aef422c3
-
SSDEEP
3072:JHLPsKAmOc6GxqG20y8g6vxnqV32cm5dtJWgW73HC+VPpwk87VP+vCGx:JHzsIv4G20yqvxnG32cm5dtJWgW73HCW
Malware Config
Signatures
-
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Executes dropped EXE 4 IoCs
pid Process 2144 crashes.exe 2792 crashes.exe 2824 crashes.exe 2804 crashes.exe -
Loads dropped DLL 2 IoCs
pid Process 3040 48233c394fd136a8e8c50f72c479818d.exe 3040 48233c394fd136a8e8c50f72c479818d.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\crashes.exe = "C:\\Users\\Admin\\AppData\\Roaming\\crashes\\crashes.exe" 48233c394fd136a8e8c50f72c479818d.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2144 set thread context of 2792 2144 crashes.exe 29 PID 2144 set thread context of 2792 2144 crashes.exe 29 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3040 48233c394fd136a8e8c50f72c479818d.exe 2144 crashes.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 3040 wrote to memory of 2144 3040 48233c394fd136a8e8c50f72c479818d.exe 28 PID 3040 wrote to memory of 2144 3040 48233c394fd136a8e8c50f72c479818d.exe 28 PID 3040 wrote to memory of 2144 3040 48233c394fd136a8e8c50f72c479818d.exe 28 PID 3040 wrote to memory of 2144 3040 48233c394fd136a8e8c50f72c479818d.exe 28 PID 2144 wrote to memory of 2792 2144 crashes.exe 29 PID 2144 wrote to memory of 2792 2144 crashes.exe 29 PID 2144 wrote to memory of 2792 2144 crashes.exe 29 PID 2144 wrote to memory of 2792 2144 crashes.exe 29 PID 2144 wrote to memory of 2792 2144 crashes.exe 29 PID 2144 wrote to memory of 2792 2144 crashes.exe 29 PID 2144 wrote to memory of 2792 2144 crashes.exe 29 PID 2144 wrote to memory of 2792 2144 crashes.exe 29 PID 2144 wrote to memory of 2792 2144 crashes.exe 29 PID 2144 wrote to memory of 2792 2144 crashes.exe 29 PID 2144 wrote to memory of 2792 2144 crashes.exe 29 PID 2144 wrote to memory of 2792 2144 crashes.exe 29 PID 2144 wrote to memory of 2792 2144 crashes.exe 29 PID 2144 wrote to memory of 2792 2144 crashes.exe 29 PID 2144 wrote to memory of 2792 2144 crashes.exe 29 PID 2144 wrote to memory of 2792 2144 crashes.exe 29 PID 2792 wrote to memory of 2824 2792 crashes.exe 30 PID 2792 wrote to memory of 2824 2792 crashes.exe 30 PID 2792 wrote to memory of 2824 2792 crashes.exe 30 PID 2792 wrote to memory of 2824 2792 crashes.exe 30 PID 2792 wrote to memory of 2804 2792 crashes.exe 31 PID 2792 wrote to memory of 2804 2792 crashes.exe 31 PID 2792 wrote to memory of 2804 2792 crashes.exe 31 PID 2792 wrote to memory of 2804 2792 crashes.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\48233c394fd136a8e8c50f72c479818d.exe"C:\Users\Admin\AppData\Local\Temp\48233c394fd136a8e8c50f72c479818d.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Roaming\crashes\crashes.exe"C:\Users\Admin\AppData\Roaming\crashes\crashes.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Roaming\crashes\crashes.exe"C:\Users\Admin\AppData\Roaming\crashes\crashes.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Roaming\crashes\crashes.exeC:\Users\Admin\AppData\Roaming\crashes\crashes.exe4⤵
- Executes dropped EXE
PID:2824
-
-
C:\Users\Admin\AppData\Roaming\crashes\crashes.exeC:\Users\Admin\AppData\Roaming\crashes\crashes.exe4⤵
- Executes dropped EXE
PID:2804
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120KB
MD548233c394fd136a8e8c50f72c479818d
SHA1a286371bf593d75e5932e75b0f7ccbd85e81b13b
SHA256054ce23e77868d3b70a3884cc350b48c75e9fa63b774df6718ca6ae608b00fdf
SHA5122fa9e8fe42cf7146a10963cb52a1e5d733e233147c5be2a3f0a6109695f1b2eb2b7ed0ebf5e56c96e7f61c5ca41d8ba55329d57d13d949382bdfbfc7aef422c3