Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    29-01-2024 04:11

General

  • Target

    7eda290269beec29eb863c465a3f9d34.exe

  • Size

    413KB

  • MD5

    7eda290269beec29eb863c465a3f9d34

  • SHA1

    4c6a84e58e98d23786bdcfc5221aea61ab3251d1

  • SHA256

    5d9b07552fa5431a4bd098e72af1cc6fec9abd28ac5e20f824a94cb3fdf1fef7

  • SHA512

    ca57e521168c8e70d8d6e1511ab38fe9beab778036c69e05e9cf954cb21ef9dbca79a84a46d227ed493daaf7484cec02c43b6a0efaf70b4dbcef353f697eac44

  • SSDEEP

    12288:Oe3WpyaaityO1FPoAAQ+XORg7dpi4yXgC+w18tYj:tGZpPcQ1g7yQJw+Yj

Malware Config

Signatures

  • Detect XtremeRAT payload 2 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7eda290269beec29eb863c465a3f9d34.exe
    "C:\Users\Admin\AppData\Local\Temp\7eda290269beec29eb863c465a3f9d34.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2068

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2068-1-0x0000000000C80000-0x0000000000CF1000-memory.dmp

    Filesize

    452KB

  • memory/2068-0-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2068-2-0x0000000000260000-0x00000000002AE000-memory.dmp

    Filesize

    312KB

  • memory/2068-3-0x0000000077AC0000-0x0000000077AC1000-memory.dmp

    Filesize

    4KB

  • memory/2068-4-0x0000000076740000-0x0000000076850000-memory.dmp

    Filesize

    1.1MB

  • memory/2068-9-0x0000000000910000-0x0000000000920000-memory.dmp

    Filesize

    64KB

  • memory/2068-8-0x0000000000910000-0x0000000000920000-memory.dmp

    Filesize

    64KB

  • memory/2068-7-0x0000000000320000-0x0000000000330000-memory.dmp

    Filesize

    64KB

  • memory/2068-6-0x0000000000320000-0x0000000000330000-memory.dmp

    Filesize

    64KB

  • memory/2068-10-0x0000000000AA0000-0x0000000000BA0000-memory.dmp

    Filesize

    1024KB

  • memory/2068-5-0x0000000000A90000-0x0000000000AA0000-memory.dmp

    Filesize

    64KB

  • memory/2068-11-0x0000000000C80000-0x0000000000CF1000-memory.dmp

    Filesize

    452KB

  • memory/2068-15-0x0000000000C80000-0x0000000000CF1000-memory.dmp

    Filesize

    452KB

  • memory/2068-16-0x0000000000260000-0x00000000002AE000-memory.dmp

    Filesize

    312KB

  • memory/2068-18-0x0000000000320000-0x0000000000330000-memory.dmp

    Filesize

    64KB

  • memory/2068-17-0x0000000000A90000-0x0000000000AA0000-memory.dmp

    Filesize

    64KB

  • memory/2068-19-0x0000000000320000-0x0000000000330000-memory.dmp

    Filesize

    64KB

  • memory/2068-20-0x0000000000910000-0x0000000000920000-memory.dmp

    Filesize

    64KB

  • memory/2068-22-0x0000000000910000-0x0000000000920000-memory.dmp

    Filesize

    64KB