Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01-02-2024 03:25
Static task
static1
Behavioral task
behavioral1
Sample
85cc2fe2f271f615bb4fe4b9107461c4.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
85cc2fe2f271f615bb4fe4b9107461c4.exe
Resource
win10v2004-20231215-en
General
-
Target
85cc2fe2f271f615bb4fe4b9107461c4.exe
-
Size
109KB
-
MD5
85cc2fe2f271f615bb4fe4b9107461c4
-
SHA1
f30cfec3c082a42a1623b4b024f31605e960c9ef
-
SHA256
000b4632c1849889a989210d6794eaa9338379a416456755c2e00f1a1e939447
-
SHA512
645cb2cbdff113f4eb49cbec63866770374f7fa85b6d22517f8760d33a748623adb640caead2279bbbd33f871b07a85f5740930640f3a1bc62d54821d903440c
-
SSDEEP
3072:YmBS5BuIPHxD8Un3lrn70YdyD2hSjZdxm:BYZpDrn15hkZdxm
Malware Config
Extracted
xtremerat
vvnv12.no-ip.biz
Signatures
-
Detect XtremeRAT payload 13 IoCs
Processes:
resource yara_rule behavioral1/memory/2408-16-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/2408-14-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/2408-13-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/2408-17-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/2408-10-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/2408-9-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/2408-8-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/2408-7-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/2776-20-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/2408-23-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/2408-6-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/2408-25-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/2776-26-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
85cc2fe2f271f615bb4fe4b9107461c4.exesvchost.exedescription ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} 85cc2fe2f271f615bb4fe4b9107461c4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\Windows Genuine Update\\Advantage.exe restart" 85cc2fe2f271f615bb4fe4b9107461c4.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\Windows Genuine Update\\Advantage.exe" svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
svchost.exe85cc2fe2f271f615bb4fe4b9107461c4.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Genuine Update = "C:\\Windows\\Windows Genuine Update\\Advantage.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Genuine Update = "C:\\Windows\\Windows Genuine Update\\Advantage.exe" 85cc2fe2f271f615bb4fe4b9107461c4.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Genuine Update = "C:\\Windows\\Windows Genuine Update\\Advantage.exe" 85cc2fe2f271f615bb4fe4b9107461c4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Genuine Update = "C:\\Windows\\Windows Genuine Update\\Advantage.exe" svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
85cc2fe2f271f615bb4fe4b9107461c4.exedescription pid Process procid_target PID 2180 set thread context of 2408 2180 85cc2fe2f271f615bb4fe4b9107461c4.exe 28 -
Drops file in Windows directory 3 IoCs
Processes:
85cc2fe2f271f615bb4fe4b9107461c4.exedescription ioc Process File opened for modification C:\Windows\Windows Genuine Update\Advantage.exe 85cc2fe2f271f615bb4fe4b9107461c4.exe File created C:\Windows\Windows Genuine Update\Advantage.exe 85cc2fe2f271f615bb4fe4b9107461c4.exe File opened for modification C:\Windows\Windows Genuine Update\ 85cc2fe2f271f615bb4fe4b9107461c4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
85cc2fe2f271f615bb4fe4b9107461c4.exe85cc2fe2f271f615bb4fe4b9107461c4.exepid Process 2180 85cc2fe2f271f615bb4fe4b9107461c4.exe 2408 85cc2fe2f271f615bb4fe4b9107461c4.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
85cc2fe2f271f615bb4fe4b9107461c4.exe85cc2fe2f271f615bb4fe4b9107461c4.exedescription pid Process procid_target PID 2180 wrote to memory of 2408 2180 85cc2fe2f271f615bb4fe4b9107461c4.exe 28 PID 2180 wrote to memory of 2408 2180 85cc2fe2f271f615bb4fe4b9107461c4.exe 28 PID 2180 wrote to memory of 2408 2180 85cc2fe2f271f615bb4fe4b9107461c4.exe 28 PID 2180 wrote to memory of 2408 2180 85cc2fe2f271f615bb4fe4b9107461c4.exe 28 PID 2180 wrote to memory of 2408 2180 85cc2fe2f271f615bb4fe4b9107461c4.exe 28 PID 2180 wrote to memory of 2408 2180 85cc2fe2f271f615bb4fe4b9107461c4.exe 28 PID 2180 wrote to memory of 2408 2180 85cc2fe2f271f615bb4fe4b9107461c4.exe 28 PID 2180 wrote to memory of 2408 2180 85cc2fe2f271f615bb4fe4b9107461c4.exe 28 PID 2180 wrote to memory of 2408 2180 85cc2fe2f271f615bb4fe4b9107461c4.exe 28 PID 2180 wrote to memory of 2408 2180 85cc2fe2f271f615bb4fe4b9107461c4.exe 28 PID 2180 wrote to memory of 2408 2180 85cc2fe2f271f615bb4fe4b9107461c4.exe 28 PID 2180 wrote to memory of 2408 2180 85cc2fe2f271f615bb4fe4b9107461c4.exe 28 PID 2408 wrote to memory of 2776 2408 85cc2fe2f271f615bb4fe4b9107461c4.exe 29 PID 2408 wrote to memory of 2776 2408 85cc2fe2f271f615bb4fe4b9107461c4.exe 29 PID 2408 wrote to memory of 2776 2408 85cc2fe2f271f615bb4fe4b9107461c4.exe 29 PID 2408 wrote to memory of 2776 2408 85cc2fe2f271f615bb4fe4b9107461c4.exe 29 PID 2408 wrote to memory of 2776 2408 85cc2fe2f271f615bb4fe4b9107461c4.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\85cc2fe2f271f615bb4fe4b9107461c4.exe"C:\Users\Admin\AppData\Local\Temp\85cc2fe2f271f615bb4fe4b9107461c4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\85cc2fe2f271f615bb4fe4b9107461c4.exe2⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:2776
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
109KB
MD585cc2fe2f271f615bb4fe4b9107461c4
SHA1f30cfec3c082a42a1623b4b024f31605e960c9ef
SHA256000b4632c1849889a989210d6794eaa9338379a416456755c2e00f1a1e939447
SHA512645cb2cbdff113f4eb49cbec63866770374f7fa85b6d22517f8760d33a748623adb640caead2279bbbd33f871b07a85f5740930640f3a1bc62d54821d903440c