Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-01-2024 04:11

General

  • Target

    7eda290269beec29eb863c465a3f9d34.exe

  • Size

    413KB

  • MD5

    7eda290269beec29eb863c465a3f9d34

  • SHA1

    4c6a84e58e98d23786bdcfc5221aea61ab3251d1

  • SHA256

    5d9b07552fa5431a4bd098e72af1cc6fec9abd28ac5e20f824a94cb3fdf1fef7

  • SHA512

    ca57e521168c8e70d8d6e1511ab38fe9beab778036c69e05e9cf954cb21ef9dbca79a84a46d227ed493daaf7484cec02c43b6a0efaf70b4dbcef353f697eac44

  • SSDEEP

    12288:Oe3WpyaaityO1FPoAAQ+XORg7dpi4yXgC+w18tYj:tGZpPcQ1g7yQJw+Yj

Malware Config

Signatures

  • Detect XtremeRAT payload 2 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7eda290269beec29eb863c465a3f9d34.exe
    "C:\Users\Admin\AppData\Local\Temp\7eda290269beec29eb863c465a3f9d34.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2488

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2488-1-0x00000000005E0000-0x000000000062E000-memory.dmp

    Filesize

    312KB

  • memory/2488-0-0x00000000005B0000-0x00000000005B1000-memory.dmp

    Filesize

    4KB

  • memory/2488-2-0x0000000000C80000-0x0000000000CF1000-memory.dmp

    Filesize

    452KB

  • memory/2488-4-0x00000000024B0000-0x00000000024C0000-memory.dmp

    Filesize

    64KB

  • memory/2488-3-0x00000000024F0000-0x0000000002500000-memory.dmp

    Filesize

    64KB

  • memory/2488-5-0x00000000770D2000-0x00000000770D3000-memory.dmp

    Filesize

    4KB

  • memory/2488-6-0x0000000000BF0000-0x0000000000C00000-memory.dmp

    Filesize

    64KB

  • memory/2488-9-0x00000000024B0000-0x00000000024C0000-memory.dmp

    Filesize

    64KB

  • memory/2488-11-0x00000000024F0000-0x0000000002500000-memory.dmp

    Filesize

    64KB

  • memory/2488-10-0x0000000000C80000-0x0000000000CF1000-memory.dmp

    Filesize

    452KB

  • memory/2488-8-0x0000000000BF0000-0x0000000000C00000-memory.dmp

    Filesize

    64KB

  • memory/2488-7-0x0000000076050000-0x0000000076140000-memory.dmp

    Filesize

    960KB

  • memory/2488-15-0x0000000000C80000-0x0000000000CF1000-memory.dmp

    Filesize

    452KB

  • memory/2488-16-0x00000000005E0000-0x000000000062E000-memory.dmp

    Filesize

    312KB

  • memory/2488-18-0x00000000024F0000-0x0000000002500000-memory.dmp

    Filesize

    64KB

  • memory/2488-19-0x00000000024B0000-0x00000000024C0000-memory.dmp

    Filesize

    64KB

  • memory/2488-20-0x0000000000BF0000-0x0000000000C00000-memory.dmp

    Filesize

    64KB

  • memory/2488-21-0x0000000076050000-0x0000000076140000-memory.dmp

    Filesize

    960KB

  • memory/2488-23-0x00000000024B0000-0x00000000024C0000-memory.dmp

    Filesize

    64KB

  • memory/2488-22-0x0000000000BF0000-0x0000000000C00000-memory.dmp

    Filesize

    64KB

  • memory/2488-24-0x00000000024F0000-0x0000000002500000-memory.dmp

    Filesize

    64KB