Analysis
- max time kernel
135s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
31/01/2024, 09:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
840d4c2cd9b991ea7898459003848c84.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
840d4c2cd9b991ea7898459003848c84.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 840d4c2cd9b991ea7898459003848c84.exe
- Size 134KB
- Sample240131-ldrjhsaghp
- SHA256 910e82aa76f384acecc91792b27684ae5b58e597302577b9c3ba3accb376c73f
- MD5 840d4c2cd9b991ea7898459003848c84
- SHA1 46fa02b7a696b66a0d903f1d4643c8c05bd2dc73
- SHA512 42faaf52d6e54d98c772d9abb1d5c0dae04618357586a300fc7e7123dd8898ac85227e6692fff2bce97bed5381772948e0ad674e00e210c2bf936a96a37aaa4e
- SSDEEP 3072:50gWxxNVc+F4Uu804+wk0kVrrJtdlTNsnBB:50ZBFHu87+30kNdfsBB
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
xtremerat
C2
-
sanfou25.no-ip.biz
Signatures
- Detect XtremeRAT payload 7 IoCs
resource yara_rule behavioral2/memory/968-7-0x0000000010000000-0x0000000010047000-memory.dmp family_xtremerat behavioral2/memory/968-8-0x0000000010000000-0x0000000010047000-memory.dmp family_xtremerat behavioral2/memory/968-9-0x0000000010000000-0x0000000010047000-memory.dmp family_xtremerat behavioral2/memory/968-10-0x0000000010000000-0x0000000010047000-memory.dmp family_xtremerat behavioral2/memory/2244-12-0x0000000010000000-0x0000000010047000-memory.dmp family_xtremerat behavioral2/memory/968-13-0x0000000010000000-0x0000000010047000-memory.dmp family_xtremerat behavioral2/memory/2244-14-0x0000000010000000-0x0000000010047000-memory.dmp family_xtremerat - XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
- Loads dropped DLL 1 IoCs
pid Process 2004 840d4c2cd9b991ea7898459003848c84.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\VB6FR.DLL 840d4c2cd9b991ea7898459003848c84.exe File opened for modification C:\Windows\SysWOW64\VB6FR.DLL 840d4c2cd9b991ea7898459003848c84.exe - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2004 set thread context of 968 2004 840d4c2cd9b991ea7898459003848c84.exe 20 PID 2004 set thread context of 0 2004 840d4c2cd9b991ea7898459003848c84.exe PID 2004 set thread context of 0 2004 840d4c2cd9b991ea7898459003848c84.exe PID 2004 set thread context of 0 2004 840d4c2cd9b991ea7898459003848c84.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
pid pid_target Process procid_target 2040 2244 WerFault.exe 23 4968 2244 WerFault.exe 23 - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2004 840d4c2cd9b991ea7898459003848c84.exe - Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 2004 wrote to memory of 968 2004 840d4c2cd9b991ea7898459003848c84.exe 20 PID 2004 wrote to memory of 968 2004 840d4c2cd9b991ea7898459003848c84.exe 20 PID 2004 wrote to memory of 968 2004 840d4c2cd9b991ea7898459003848c84.exe 20 PID 2004 wrote to memory of 968 2004 840d4c2cd9b991ea7898459003848c84.exe 20 PID 2004 wrote to memory of 968 2004 840d4c2cd9b991ea7898459003848c84.exe 20 PID 2004 wrote to memory of 968 2004 840d4c2cd9b991ea7898459003848c84.exe 20 PID 2004 wrote to memory of 968 2004 840d4c2cd9b991ea7898459003848c84.exe 20 PID 2004 wrote to memory of 968 2004 840d4c2cd9b991ea7898459003848c84.exe 20 PID 2004 wrote to memory of 968 2004 840d4c2cd9b991ea7898459003848c84.exe 20 PID 2004 wrote to memory of 968 2004 840d4c2cd9b991ea7898459003848c84.exe 20 PID 2004 wrote to memory of 968 2004 840d4c2cd9b991ea7898459003848c84.exe 20 PID 2004 wrote to memory of 968 2004 840d4c2cd9b991ea7898459003848c84.exe 20 PID 2004 wrote to memory of 968 2004 840d4c2cd9b991ea7898459003848c84.exe 20 PID 2004 wrote to memory of 0 2004 840d4c2cd9b991ea7898459003848c84.exe PID 2004 wrote to memory of 0 2004 840d4c2cd9b991ea7898459003848c84.exe PID 2004 wrote to memory of 0 2004 840d4c2cd9b991ea7898459003848c84.exe PID 2004 wrote to memory of 0 2004 840d4c2cd9b991ea7898459003848c84.exe PID 2004 wrote to memory of 0 2004 840d4c2cd9b991ea7898459003848c84.exe PID 2004 wrote to memory of 0 2004 840d4c2cd9b991ea7898459003848c84.exe PID 2004 wrote to memory of 0 2004 840d4c2cd9b991ea7898459003848c84.exe PID 2004 wrote to memory of 0 2004 840d4c2cd9b991ea7898459003848c84.exe PID 2004 wrote to memory of 0 2004 840d4c2cd9b991ea7898459003848c84.exe PID 2004 wrote to memory of 0 2004 840d4c2cd9b991ea7898459003848c84.exe PID 2004 wrote to memory of 0 2004 840d4c2cd9b991ea7898459003848c84.exe PID 2004 wrote to memory of 0 2004 840d4c2cd9b991ea7898459003848c84.exe PID 2004 wrote to memory of 0 2004 840d4c2cd9b991ea7898459003848c84.exe PID 2004 wrote to memory of 0 2004 840d4c2cd9b991ea7898459003848c84.exe PID 2004 wrote to memory of 0 2004 840d4c2cd9b991ea7898459003848c84.exe PID 2004 wrote to memory of 0 2004 840d4c2cd9b991ea7898459003848c84.exe PID 2004 wrote to memory of 0 2004 840d4c2cd9b991ea7898459003848c84.exe PID 2004 wrote to memory of 0 2004 840d4c2cd9b991ea7898459003848c84.exe PID 2004 wrote to memory of 0 2004 840d4c2cd9b991ea7898459003848c84.exe PID 2004 wrote to memory of 0 2004 840d4c2cd9b991ea7898459003848c84.exe PID 2004 wrote to memory of 0 2004 840d4c2cd9b991ea7898459003848c84.exe PID 2004 wrote to memory of 0 2004 840d4c2cd9b991ea7898459003848c84.exe PID 2004 wrote to memory of 0 2004 840d4c2cd9b991ea7898459003848c84.exe PID 2004 wrote to memory of 0 2004 840d4c2cd9b991ea7898459003848c84.exe PID 2004 wrote to memory of 0 2004 840d4c2cd9b991ea7898459003848c84.exe PID 2004 wrote to memory of 0 2004 840d4c2cd9b991ea7898459003848c84.exe PID 2004 wrote to memory of 0 2004 840d4c2cd9b991ea7898459003848c84.exe PID 2004 wrote to memory of 0 2004 840d4c2cd9b991ea7898459003848c84.exe PID 2004 wrote to memory of 0 2004 840d4c2cd9b991ea7898459003848c84.exe PID 2004 wrote to memory of 0 2004 840d4c2cd9b991ea7898459003848c84.exe PID 968 wrote to memory of 2244 968 840d4c2cd9b991ea7898459003848c84.exe 23 PID 968 wrote to memory of 2244 968 840d4c2cd9b991ea7898459003848c84.exe 23 PID 968 wrote to memory of 2244 968 840d4c2cd9b991ea7898459003848c84.exe 23 PID 968 wrote to memory of 2244 968 840d4c2cd9b991ea7898459003848c84.exe 23 PID 968 wrote to memory of 2736 968 840d4c2cd9b991ea7898459003848c84.exe 26 PID 968 wrote to memory of 2736 968 840d4c2cd9b991ea7898459003848c84.exe 26 PID 968 wrote to memory of 2736 968 840d4c2cd9b991ea7898459003848c84.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\840d4c2cd9b991ea7898459003848c84.exe"C:\Users\Admin\AppData\Local\Temp\840d4c2cd9b991ea7898459003848c84.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\840d4c2cd9b991ea7898459003848c84.exe"C:\Users\Admin\AppData\Local\Temp\840d4c2cd9b991ea7898459003848c84.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵PID:2244
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 4924⤵
- Program crash
PID:2040
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 4844⤵
- Program crash
PID:4968
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵PID:2736
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2244 -ip 22441⤵PID:1544
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2244 -ip 22441⤵PID:3208
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\VB6FR.DLL
- Size 116KB
- SHA256 a8254b40b68e425ad269b56940ccce0deae1432ed6e86318984cffc13dd08cf6
- MD5 c845380c64f8db0538eb4af4689ec2f7
- SHA1 0e9626ab09a8a263bd00484d705be3c2ca647612
- SHA512 8e693e21d2f1fd26112c209cda622c2604036cf36af39818a5cb4d976e6cd273802468fb55abc1a5721f22ba418da491ec63694de5485b19f9f1028447817124
- SSDEEP 1536:/IGk9erO38XXQ/FtLHJkumy59JXOLtWdmsFFvKSL:/0eo80ms
- MD5 SHA1 SHA512 SSDEEP