Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01-02-2024 03:25
Static task
static1
Behavioral task
behavioral1
Sample
85cc2fe2f271f615bb4fe4b9107461c4.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
85cc2fe2f271f615bb4fe4b9107461c4.exe
Resource
win10v2004-20231215-en
General
-
Target
85cc2fe2f271f615bb4fe4b9107461c4.exe
-
Size
109KB
-
MD5
85cc2fe2f271f615bb4fe4b9107461c4
-
SHA1
f30cfec3c082a42a1623b4b024f31605e960c9ef
-
SHA256
000b4632c1849889a989210d6794eaa9338379a416456755c2e00f1a1e939447
-
SHA512
645cb2cbdff113f4eb49cbec63866770374f7fa85b6d22517f8760d33a748623adb640caead2279bbbd33f871b07a85f5740930640f3a1bc62d54821d903440c
-
SSDEEP
3072:YmBS5BuIPHxD8Un3lrn70YdyD2hSjZdxm:BYZpDrn15hkZdxm
Malware Config
Extracted
xtremerat
vvnv12.no-ip.biz
Signatures
-
Detect XtremeRAT payload 8 IoCs
Processes:
resource yara_rule behavioral2/memory/1880-3-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral2/memory/1880-4-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral2/memory/1880-5-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral2/memory/1880-7-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral2/memory/1784-8-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral2/memory/1880-11-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral2/memory/1784-12-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral2/memory/1880-13-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
85cc2fe2f271f615bb4fe4b9107461c4.exedescription ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} 85cc2fe2f271f615bb4fe4b9107461c4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\Windows Genuine Update\\Advantage.exe restart" 85cc2fe2f271f615bb4fe4b9107461c4.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
85cc2fe2f271f615bb4fe4b9107461c4.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Genuine Update = "C:\\Windows\\Windows Genuine Update\\Advantage.exe" 85cc2fe2f271f615bb4fe4b9107461c4.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Genuine Update = "C:\\Windows\\Windows Genuine Update\\Advantage.exe" 85cc2fe2f271f615bb4fe4b9107461c4.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
85cc2fe2f271f615bb4fe4b9107461c4.exedescription pid Process procid_target PID 3256 set thread context of 1880 3256 85cc2fe2f271f615bb4fe4b9107461c4.exe 84 -
Drops file in Windows directory 3 IoCs
Processes:
85cc2fe2f271f615bb4fe4b9107461c4.exedescription ioc Process File opened for modification C:\Windows\Windows Genuine Update\Advantage.exe 85cc2fe2f271f615bb4fe4b9107461c4.exe File created C:\Windows\Windows Genuine Update\Advantage.exe 85cc2fe2f271f615bb4fe4b9107461c4.exe File opened for modification C:\Windows\Windows Genuine Update\ 85cc2fe2f271f615bb4fe4b9107461c4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target Process procid_target 4988 1784 WerFault.exe 85 5068 1784 WerFault.exe 85 -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
85cc2fe2f271f615bb4fe4b9107461c4.exe85cc2fe2f271f615bb4fe4b9107461c4.exepid Process 3256 85cc2fe2f271f615bb4fe4b9107461c4.exe 1880 85cc2fe2f271f615bb4fe4b9107461c4.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
85cc2fe2f271f615bb4fe4b9107461c4.exe85cc2fe2f271f615bb4fe4b9107461c4.exedescription pid Process procid_target PID 3256 wrote to memory of 1880 3256 85cc2fe2f271f615bb4fe4b9107461c4.exe 84 PID 3256 wrote to memory of 1880 3256 85cc2fe2f271f615bb4fe4b9107461c4.exe 84 PID 3256 wrote to memory of 1880 3256 85cc2fe2f271f615bb4fe4b9107461c4.exe 84 PID 3256 wrote to memory of 1880 3256 85cc2fe2f271f615bb4fe4b9107461c4.exe 84 PID 3256 wrote to memory of 1880 3256 85cc2fe2f271f615bb4fe4b9107461c4.exe 84 PID 3256 wrote to memory of 1880 3256 85cc2fe2f271f615bb4fe4b9107461c4.exe 84 PID 3256 wrote to memory of 1880 3256 85cc2fe2f271f615bb4fe4b9107461c4.exe 84 PID 3256 wrote to memory of 1880 3256 85cc2fe2f271f615bb4fe4b9107461c4.exe 84 PID 3256 wrote to memory of 1880 3256 85cc2fe2f271f615bb4fe4b9107461c4.exe 84 PID 3256 wrote to memory of 1880 3256 85cc2fe2f271f615bb4fe4b9107461c4.exe 84 PID 3256 wrote to memory of 1880 3256 85cc2fe2f271f615bb4fe4b9107461c4.exe 84 PID 3256 wrote to memory of 1880 3256 85cc2fe2f271f615bb4fe4b9107461c4.exe 84 PID 3256 wrote to memory of 1880 3256 85cc2fe2f271f615bb4fe4b9107461c4.exe 84 PID 1880 wrote to memory of 1784 1880 85cc2fe2f271f615bb4fe4b9107461c4.exe 85 PID 1880 wrote to memory of 1784 1880 85cc2fe2f271f615bb4fe4b9107461c4.exe 85 PID 1880 wrote to memory of 1784 1880 85cc2fe2f271f615bb4fe4b9107461c4.exe 85 PID 1880 wrote to memory of 1784 1880 85cc2fe2f271f615bb4fe4b9107461c4.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\85cc2fe2f271f615bb4fe4b9107461c4.exe"C:\Users\Admin\AppData\Local\Temp\85cc2fe2f271f615bb4fe4b9107461c4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\85cc2fe2f271f615bb4fe4b9107461c4.exe2⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵PID:1784
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 4844⤵
- Program crash
PID:4988
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 4924⤵
- Program crash
PID:5068
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1784 -ip 17841⤵PID:4048
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1784 -ip 17841⤵PID:1396