Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    29-01-2024 07:03

General

  • Target

    7f3288ccbcf8a013ab271528d5592fd2.exe

  • Size

    538KB

  • MD5

    7f3288ccbcf8a013ab271528d5592fd2

  • SHA1

    ae67dc40bfa75756af5d6b63168bdba9f9fc3d63

  • SHA256

    52b4760df29374cf59babed736100e689a10ecf9a8ab651d28010f6489fb4e46

  • SHA512

    7a31e4d5ad204ef70803ad6e9aa2ab80eb2d4bcf04f11a24033c171b9820742edc8fa79b2e4dacc4f5103369067baa303b77722613509319c2e35e54da57731a

  • SSDEEP

    12288:7E6SXHwL6D6N7fn5nPKK/lGRgOUqmq9kR6lhKX0d2eaG7OElJlW:Y6SXtD6Rn5PKK/cRgOnmq9g6Ser7OElO

Malware Config

Signatures

  • Detect XtremeRAT payload 6 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7f3288ccbcf8a013ab271528d5592fd2.exe
    "C:\Users\Admin\AppData\Local\Temp\7f3288ccbcf8a013ab271528d5592fd2.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2444
    • C:\Users\Admin\AppData\Local\Temp\7f3288ccbcf8a013ab271528d5592fd2.exe
      "C:\Users\Admin\AppData\Local\Temp\7f3288ccbcf8a013ab271528d5592fd2.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2744
      • C:\Users\Admin\AppData\Local\Temp\7f3288ccbcf8a013ab271528d5592fd2.exe
        3⤵
        • Modifies Installed Components in the registry
        • Adds Run key to start application
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:2784
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          4⤵
          • Modifies Installed Components in the registry
          • Adds Run key to start application
          PID:2660
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          4⤵
          • Suspicious use of SetWindowsHookEx
          PID:2772

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\InstallDir\Server.exe

    Filesize

    32KB

    MD5

    6bd1be293735a234ab9c691598353422

    SHA1

    9824ef8f18a6a2c35aad8f598cdb4aaf887a54a4

    SHA256

    42f6aeea5f4771233f06d1d3f05fd51ea5221c494b1828dd2fa3e53ba635ae00

    SHA512

    5395587c3597db73424a667e0c5d8580c422f3feb1c7eb9b7987c28d8354621668bfdd57786f980ace21e2b1cc7274000a35521cd56e01c3169225db87ca761a

  • memory/2444-26-0x00000000002A0000-0x00000000002A1000-memory.dmp

    Filesize

    4KB

  • memory/2444-14-0x0000000002580000-0x0000000002581000-memory.dmp

    Filesize

    4KB

  • memory/2444-3-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2444-5-0x0000000000300000-0x0000000000301000-memory.dmp

    Filesize

    4KB

  • memory/2444-17-0x0000000000510000-0x0000000000511000-memory.dmp

    Filesize

    4KB

  • memory/2444-15-0x0000000000550000-0x0000000000551000-memory.dmp

    Filesize

    4KB

  • memory/2444-28-0x0000000003620000-0x0000000003621000-memory.dmp

    Filesize

    4KB

  • memory/2444-18-0x0000000002590000-0x0000000002591000-memory.dmp

    Filesize

    4KB

  • memory/2444-13-0x0000000000520000-0x0000000000521000-memory.dmp

    Filesize

    4KB

  • memory/2444-19-0x0000000002740000-0x0000000002741000-memory.dmp

    Filesize

    4KB

  • memory/2444-12-0x0000000000530000-0x0000000000531000-memory.dmp

    Filesize

    4KB

  • memory/2444-29-0x0000000003610000-0x0000000003611000-memory.dmp

    Filesize

    4KB

  • memory/2444-11-0x00000000035E0000-0x00000000035E3000-memory.dmp

    Filesize

    12KB

  • memory/2444-21-0x0000000002790000-0x0000000002791000-memory.dmp

    Filesize

    4KB

  • memory/2444-10-0x00000000003D0000-0x00000000003D1000-memory.dmp

    Filesize

    4KB

  • memory/2444-22-0x00000000026E0000-0x00000000026E1000-memory.dmp

    Filesize

    4KB

  • memory/2444-9-0x00000000035F0000-0x00000000035F1000-memory.dmp

    Filesize

    4KB

  • memory/2444-23-0x0000000002760000-0x0000000002761000-memory.dmp

    Filesize

    4KB

  • memory/2444-8-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

  • memory/2444-24-0x0000000002780000-0x0000000002781000-memory.dmp

    Filesize

    4KB

  • memory/2444-27-0x00000000002F0000-0x00000000002F1000-memory.dmp

    Filesize

    4KB

  • memory/2444-25-0x0000000000540000-0x0000000000541000-memory.dmp

    Filesize

    4KB

  • memory/2444-6-0x00000000004F0000-0x00000000004F1000-memory.dmp

    Filesize

    4KB

  • memory/2444-0-0x0000000000400000-0x00000000004E7000-memory.dmp

    Filesize

    924KB

  • memory/2444-7-0x0000000000340000-0x0000000000341000-memory.dmp

    Filesize

    4KB

  • memory/2444-2-0x0000000000310000-0x0000000000311000-memory.dmp

    Filesize

    4KB

  • memory/2444-20-0x00000000026F0000-0x00000000026F1000-memory.dmp

    Filesize

    4KB

  • memory/2444-30-0x0000000003600000-0x0000000003601000-memory.dmp

    Filesize

    4KB

  • memory/2444-31-0x0000000000320000-0x0000000000321000-memory.dmp

    Filesize

    4KB

  • memory/2444-33-0x0000000000400000-0x00000000004E7000-memory.dmp

    Filesize

    924KB

  • memory/2444-36-0x0000000000350000-0x00000000003B0000-memory.dmp

    Filesize

    384KB

  • memory/2444-35-0x00000000036A0000-0x00000000036A1000-memory.dmp

    Filesize

    4KB

  • memory/2444-1-0x0000000000350000-0x00000000003B0000-memory.dmp

    Filesize

    384KB

  • memory/2660-59-0x0000000000C80000-0x0000000000C96000-memory.dmp

    Filesize

    88KB

  • memory/2744-47-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/2744-44-0x00000000028D0000-0x00000000029B7000-memory.dmp

    Filesize

    924KB

  • memory/2744-32-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/2772-66-0x0000000000C80000-0x0000000000C96000-memory.dmp

    Filesize

    88KB

  • memory/2772-63-0x0000000000C80000-0x0000000000C96000-memory.dmp

    Filesize

    88KB

  • memory/2784-42-0x0000000000C80000-0x0000000000C96000-memory.dmp

    Filesize

    88KB

  • memory/2784-41-0x0000000000C80000-0x0000000000C96000-memory.dmp

    Filesize

    88KB

  • memory/2784-43-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2784-49-0x0000000000400000-0x00000000004E7000-memory.dmp

    Filesize

    924KB

  • memory/2784-53-0x0000000000C80000-0x0000000000C96000-memory.dmp

    Filesize

    88KB

  • memory/2784-46-0x0000000000C80000-0x0000000000C96000-memory.dmp

    Filesize

    88KB

  • memory/2784-40-0x0000000000C80000-0x0000000000C96000-memory.dmp

    Filesize

    88KB

  • memory/2784-52-0x0000000000C80000-0x0000000000C96000-memory.dmp

    Filesize

    88KB

  • memory/2784-64-0x0000000000C80000-0x0000000000C96000-memory.dmp

    Filesize

    88KB

  • memory/2784-50-0x0000000000C80000-0x0000000000C96000-memory.dmp

    Filesize

    88KB