Analysis

  • max time kernel
    93s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-02-2024 15:04

General

  • Target

    89d2a51b87f8f8d0df3cb6af9b022a9a.exe

  • Size

    65KB

  • MD5

    89d2a51b87f8f8d0df3cb6af9b022a9a

  • SHA1

    39f9f3b34f61b80c9e8e6d967397b6acc9ce9b61

  • SHA256

    a5ab3c391548b6ee57853dcee8c01fbbb7a19755a83bf3ec95f94cea85ee60b5

  • SHA512

    52583a2c3e689ad3eaf6f2cd07a1ba14d35ddde79cd2dc114665b191adfe7022cc326e28075147f55338b3f431f766e3bbb4c2d335953f8188ddb27535e5ca71

  • SSDEEP

    768:T8m1Sq4NQErBNH1tzoisBKQI6dObAG/dq8uW29Ifnch/yyR+P2ujfpihKPAB7Xod:rsq+Qi4rObAdXWpfgyBjoKNwiVo6aO

Malware Config

Signatures

  • Detect XtremeRAT payload 1 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Program crash 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\89d2a51b87f8f8d0df3cb6af9b022a9a.exe
    "C:\Users\Admin\AppData\Local\Temp\89d2a51b87f8f8d0df3cb6af9b022a9a.exe"
    1⤵
      PID:1028
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 496
        2⤵
        • Program crash
        PID:4844
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 492
        2⤵
        • Program crash
        PID:452
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1028 -ip 1028
      1⤵
        PID:3936
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1028 -ip 1028
        1⤵
          PID:4576

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1028-0-0x0000000010000000-0x000000001004A000-memory.dmp

          Filesize

          296KB