Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29-01-2024 08:59
Static task
static1
Behavioral task
behavioral1
Sample
7f6dae0449f364e47f21cf524f9985ee.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7f6dae0449f364e47f21cf524f9985ee.exe
Resource
win10v2004-20231222-en
General
-
Target
7f6dae0449f364e47f21cf524f9985ee.exe
-
Size
82KB
-
MD5
7f6dae0449f364e47f21cf524f9985ee
-
SHA1
cee01d166d50848b2088756d35a9847fed104ea1
-
SHA256
74630037f8a6960147743e760d1053657a18030e946e44349266e067dabd09e8
-
SHA512
b9c886d28902ff6e6711279064a314781f344837790775e0914eb14d1fe60d0002c61cd6761929e2f67bbb7df4de1cefd15bd62478373c01e0183d9392752905
-
SSDEEP
1536:sppcwA9YOJyggo5h457+etQiyZBpeZM4N9iTlJMMc6srMli4e4Ws+:sbcwIKoQ5aiCZ54NkPW8i4e4Wx
Malware Config
Extracted
xtremerat
esam2at.no-ip.biz
Signatures
-
Detect XtremeRAT payload 11 IoCs
resource yara_rule behavioral1/memory/1828-6-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral1/memory/1828-7-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral1/memory/1828-8-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral1/memory/1828-10-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral1/memory/1828-9-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral1/memory/1828-13-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral1/memory/1828-18-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral1/memory/1828-17-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral1/memory/1828-14-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral1/memory/1828-22-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral1/memory/2680-23-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2500 set thread context of 1828 2500 7f6dae0449f364e47f21cf524f9985ee.exe 28 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2500 7f6dae0449f364e47f21cf524f9985ee.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2500 wrote to memory of 1828 2500 7f6dae0449f364e47f21cf524f9985ee.exe 28 PID 2500 wrote to memory of 1828 2500 7f6dae0449f364e47f21cf524f9985ee.exe 28 PID 2500 wrote to memory of 1828 2500 7f6dae0449f364e47f21cf524f9985ee.exe 28 PID 2500 wrote to memory of 1828 2500 7f6dae0449f364e47f21cf524f9985ee.exe 28 PID 2500 wrote to memory of 1828 2500 7f6dae0449f364e47f21cf524f9985ee.exe 28 PID 2500 wrote to memory of 1828 2500 7f6dae0449f364e47f21cf524f9985ee.exe 28 PID 2500 wrote to memory of 1828 2500 7f6dae0449f364e47f21cf524f9985ee.exe 28 PID 2500 wrote to memory of 1828 2500 7f6dae0449f364e47f21cf524f9985ee.exe 28 PID 2500 wrote to memory of 1828 2500 7f6dae0449f364e47f21cf524f9985ee.exe 28 PID 2500 wrote to memory of 1828 2500 7f6dae0449f364e47f21cf524f9985ee.exe 28 PID 2500 wrote to memory of 1828 2500 7f6dae0449f364e47f21cf524f9985ee.exe 28 PID 2500 wrote to memory of 1828 2500 7f6dae0449f364e47f21cf524f9985ee.exe 28 PID 1828 wrote to memory of 2680 1828 7f6dae0449f364e47f21cf524f9985ee.exe 29 PID 1828 wrote to memory of 2680 1828 7f6dae0449f364e47f21cf524f9985ee.exe 29 PID 1828 wrote to memory of 2680 1828 7f6dae0449f364e47f21cf524f9985ee.exe 29 PID 1828 wrote to memory of 2680 1828 7f6dae0449f364e47f21cf524f9985ee.exe 29 PID 1828 wrote to memory of 2680 1828 7f6dae0449f364e47f21cf524f9985ee.exe 29 PID 1828 wrote to memory of 2696 1828 7f6dae0449f364e47f21cf524f9985ee.exe 30 PID 1828 wrote to memory of 2696 1828 7f6dae0449f364e47f21cf524f9985ee.exe 30 PID 1828 wrote to memory of 2696 1828 7f6dae0449f364e47f21cf524f9985ee.exe 30 PID 1828 wrote to memory of 2696 1828 7f6dae0449f364e47f21cf524f9985ee.exe 30 PID 1828 wrote to memory of 2696 1828 7f6dae0449f364e47f21cf524f9985ee.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f6dae0449f364e47f21cf524f9985ee.exe"C:\Users\Admin\AppData\Local\Temp\7f6dae0449f364e47f21cf524f9985ee.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\7f6dae0449f364e47f21cf524f9985ee.exeC:\Users\Admin\AppData\Local\Temp\7f6dae0449f364e47f21cf524f9985ee.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵PID:2680
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:2696
-
-