Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
07/01/2024, 05:21
Static task
static1
Behavioral task
behavioral1
Sample
48233c394fd136a8e8c50f72c479818d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
48233c394fd136a8e8c50f72c479818d.exe
Resource
win10v2004-20231222-en
General
-
Target
48233c394fd136a8e8c50f72c479818d.exe
-
Size
120KB
-
MD5
48233c394fd136a8e8c50f72c479818d
-
SHA1
a286371bf593d75e5932e75b0f7ccbd85e81b13b
-
SHA256
054ce23e77868d3b70a3884cc350b48c75e9fa63b774df6718ca6ae608b00fdf
-
SHA512
2fa9e8fe42cf7146a10963cb52a1e5d733e233147c5be2a3f0a6109695f1b2eb2b7ed0ebf5e56c96e7f61c5ca41d8ba55329d57d13d949382bdfbfc7aef422c3
-
SSDEEP
3072:JHLPsKAmOc6GxqG20y8g6vxnqV32cm5dtJWgW73HC+VPpwk87VP+vCGx:JHzsIv4G20yqvxnG32cm5dtJWgW73HCW
Malware Config
Signatures
-
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation 48233c394fd136a8e8c50f72c479818d.exe -
Executes dropped EXE 4 IoCs
pid Process 2312 crashes.exe 528 crashes.exe 4988 crashes.exe 2180 crashes.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\crashes.exe = "C:\\Users\\Admin\\AppData\\Roaming\\crashes\\crashes.exe" 48233c394fd136a8e8c50f72c479818d.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2312 set thread context of 528 2312 crashes.exe 93 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1532 48233c394fd136a8e8c50f72c479818d.exe 2312 crashes.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1532 wrote to memory of 2312 1532 48233c394fd136a8e8c50f72c479818d.exe 92 PID 1532 wrote to memory of 2312 1532 48233c394fd136a8e8c50f72c479818d.exe 92 PID 1532 wrote to memory of 2312 1532 48233c394fd136a8e8c50f72c479818d.exe 92 PID 2312 wrote to memory of 528 2312 crashes.exe 93 PID 2312 wrote to memory of 528 2312 crashes.exe 93 PID 2312 wrote to memory of 528 2312 crashes.exe 93 PID 2312 wrote to memory of 528 2312 crashes.exe 93 PID 2312 wrote to memory of 528 2312 crashes.exe 93 PID 2312 wrote to memory of 528 2312 crashes.exe 93 PID 2312 wrote to memory of 528 2312 crashes.exe 93 PID 2312 wrote to memory of 528 2312 crashes.exe 93 PID 2312 wrote to memory of 528 2312 crashes.exe 93 PID 2312 wrote to memory of 528 2312 crashes.exe 93 PID 2312 wrote to memory of 528 2312 crashes.exe 93 PID 2312 wrote to memory of 528 2312 crashes.exe 93 PID 2312 wrote to memory of 528 2312 crashes.exe 93 PID 2312 wrote to memory of 528 2312 crashes.exe 93 PID 2312 wrote to memory of 528 2312 crashes.exe 93 PID 528 wrote to memory of 4988 528 crashes.exe 94 PID 528 wrote to memory of 4988 528 crashes.exe 94 PID 528 wrote to memory of 4988 528 crashes.exe 94 PID 528 wrote to memory of 2180 528 crashes.exe 95 PID 528 wrote to memory of 2180 528 crashes.exe 95 PID 528 wrote to memory of 2180 528 crashes.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\48233c394fd136a8e8c50f72c479818d.exe"C:\Users\Admin\AppData\Local\Temp\48233c394fd136a8e8c50f72c479818d.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Roaming\crashes\crashes.exe"C:\Users\Admin\AppData\Roaming\crashes\crashes.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Roaming\crashes\crashes.exe"C:\Users\Admin\AppData\Roaming\crashes\crashes.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Users\Admin\AppData\Roaming\crashes\crashes.exeC:\Users\Admin\AppData\Roaming\crashes\crashes.exe4⤵
- Executes dropped EXE
PID:4988
-
-
C:\Users\Admin\AppData\Roaming\crashes\crashes.exeC:\Users\Admin\AppData\Roaming\crashes\crashes.exe4⤵
- Executes dropped EXE
PID:2180
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120KB
MD548233c394fd136a8e8c50f72c479818d
SHA1a286371bf593d75e5932e75b0f7ccbd85e81b13b
SHA256054ce23e77868d3b70a3884cc350b48c75e9fa63b774df6718ca6ae608b00fdf
SHA5122fa9e8fe42cf7146a10963cb52a1e5d733e233147c5be2a3f0a6109695f1b2eb2b7ed0ebf5e56c96e7f61c5ca41d8ba55329d57d13d949382bdfbfc7aef422c3