Analysis

  • max time kernel
    91s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-01-2024 05:46

General

  • Target

    7c4c26de0c71c222a1f3c8af803833e3.exe

  • Size

    74KB

  • MD5

    7c4c26de0c71c222a1f3c8af803833e3

  • SHA1

    8a1a6ed21788f6f9006cebadb3a571399aa10c8e

  • SHA256

    2c057760da580b4b1050fe2ddfda3d002d90b65d201a1ff5b7f766ac59f024a5

  • SHA512

    a744819ffc920ec7d8ffa05b41c62ebd8b014965265145e5759a026dd43ff722dee99ac89af1acbcbcfd16b5764fc34076040b2ea3e650d5438816cd37c7badc

  • SSDEEP

    768:xuMAzLqSQ6kwATx94o9IWhWAKphMltZqgpKeC50euAYfN0bgJ5u/5uKzo7:ktLqSQ3w0+eIcKsw4K30Mzb85u/5umo7

Malware Config

Signatures

  • Detect XtremeRAT payload 1 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7c4c26de0c71c222a1f3c8af803833e3.exe
    "C:\Users\Admin\AppData\Local\Temp\7c4c26de0c71c222a1f3c8af803833e3.exe"
    1⤵
      PID:2348
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 500
        2⤵
        • Program crash
        PID:4704
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2348 -ip 2348
      1⤵
        PID:3184

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2348-0-0x0000000013140000-0x0000000013161000-memory.dmp

        Filesize

        132KB