Analysis
-
max time kernel
92s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2024 08:59
Static task
static1
Behavioral task
behavioral1
Sample
7f6dae0449f364e47f21cf524f9985ee.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7f6dae0449f364e47f21cf524f9985ee.exe
Resource
win10v2004-20231222-en
General
-
Target
7f6dae0449f364e47f21cf524f9985ee.exe
-
Size
82KB
-
MD5
7f6dae0449f364e47f21cf524f9985ee
-
SHA1
cee01d166d50848b2088756d35a9847fed104ea1
-
SHA256
74630037f8a6960147743e760d1053657a18030e946e44349266e067dabd09e8
-
SHA512
b9c886d28902ff6e6711279064a314781f344837790775e0914eb14d1fe60d0002c61cd6761929e2f67bbb7df4de1cefd15bd62478373c01e0183d9392752905
-
SSDEEP
1536:sppcwA9YOJyggo5h457+etQiyZBpeZM4N9iTlJMMc6srMli4e4Ws+:sbcwIKoQ5aiCZ54NkPW8i4e4Wx
Malware Config
Extracted
xtremerat
esam2at.no-ip.biz
Signatures
-
Detect XtremeRAT payload 7 IoCs
resource yara_rule behavioral2/memory/4092-3-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral2/memory/4092-4-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral2/memory/4092-5-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral2/memory/4092-7-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral2/memory/1584-8-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral2/memory/4092-9-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral2/memory/1584-10-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2648 set thread context of 4092 2648 7f6dae0449f364e47f21cf524f9985ee.exe 85 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 3464 1584 WerFault.exe 87 3640 1584 WerFault.exe 87 -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2648 7f6dae0449f364e47f21cf524f9985ee.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2648 wrote to memory of 4092 2648 7f6dae0449f364e47f21cf524f9985ee.exe 85 PID 2648 wrote to memory of 4092 2648 7f6dae0449f364e47f21cf524f9985ee.exe 85 PID 2648 wrote to memory of 4092 2648 7f6dae0449f364e47f21cf524f9985ee.exe 85 PID 2648 wrote to memory of 4092 2648 7f6dae0449f364e47f21cf524f9985ee.exe 85 PID 2648 wrote to memory of 4092 2648 7f6dae0449f364e47f21cf524f9985ee.exe 85 PID 2648 wrote to memory of 4092 2648 7f6dae0449f364e47f21cf524f9985ee.exe 85 PID 2648 wrote to memory of 4092 2648 7f6dae0449f364e47f21cf524f9985ee.exe 85 PID 2648 wrote to memory of 4092 2648 7f6dae0449f364e47f21cf524f9985ee.exe 85 PID 2648 wrote to memory of 4092 2648 7f6dae0449f364e47f21cf524f9985ee.exe 85 PID 2648 wrote to memory of 4092 2648 7f6dae0449f364e47f21cf524f9985ee.exe 85 PID 2648 wrote to memory of 4092 2648 7f6dae0449f364e47f21cf524f9985ee.exe 85 PID 2648 wrote to memory of 4092 2648 7f6dae0449f364e47f21cf524f9985ee.exe 85 PID 2648 wrote to memory of 4092 2648 7f6dae0449f364e47f21cf524f9985ee.exe 85 PID 4092 wrote to memory of 1584 4092 7f6dae0449f364e47f21cf524f9985ee.exe 87 PID 4092 wrote to memory of 1584 4092 7f6dae0449f364e47f21cf524f9985ee.exe 87 PID 4092 wrote to memory of 1584 4092 7f6dae0449f364e47f21cf524f9985ee.exe 87 PID 4092 wrote to memory of 1584 4092 7f6dae0449f364e47f21cf524f9985ee.exe 87 PID 4092 wrote to memory of 3212 4092 7f6dae0449f364e47f21cf524f9985ee.exe 89 PID 4092 wrote to memory of 3212 4092 7f6dae0449f364e47f21cf524f9985ee.exe 89 PID 4092 wrote to memory of 3212 4092 7f6dae0449f364e47f21cf524f9985ee.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f6dae0449f364e47f21cf524f9985ee.exe"C:\Users\Admin\AppData\Local\Temp\7f6dae0449f364e47f21cf524f9985ee.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\7f6dae0449f364e47f21cf524f9985ee.exeC:\Users\Admin\AppData\Local\Temp\7f6dae0449f364e47f21cf524f9985ee.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵PID:1584
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 4884⤵
- Program crash
PID:3464
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 4964⤵
- Program crash
PID:3640
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵PID:3212
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1584 -ip 15841⤵PID:1784
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1584 -ip 15841⤵PID:2016