Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    03-02-2024 00:14

General

  • Target

    8ae60ffd054b91d05a999b81c842dff6.exe

  • Size

    272KB

  • MD5

    8ae60ffd054b91d05a999b81c842dff6

  • SHA1

    c4d53e74655ecef838f43679f86ac97fa03b693b

  • SHA256

    3855d14233d9b0d2264b18749baef259989099aa3471fde387885743d1809299

  • SHA512

    847aa1f2290b877070eab91ab53186465916a1caa4c9a41943a8ae36807400930f402e0d91d28363a116ae2fe97ec771e07e63c7e86c121a0b0376ad93046448

  • SSDEEP

    6144:z5MiHH39hzMBo7Ljd/Q1RgOw7I43qRKoC4pFsMmKAae0d7:VT3Lzqo7Li1RgdI0wbC4pFpmKAae0d7

Malware Config

Extracted

Family

xtremerat

C2

firefox-dmm.sytes.net

google-pro.dyndns.info

Signatures

  • Detect XtremeRAT payload 8 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 5 IoCs
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8ae60ffd054b91d05a999b81c842dff6.exe
    "C:\Users\Admin\AppData\Local\Temp\8ae60ffd054b91d05a999b81c842dff6.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:880
    • C:\Users\Admin\AppData\Local\Temp\8ae60ffd054b91d05a999b81c842dff6.exe
      C:\Users\Admin\AppData\Local\Temp\8ae60ffd054b91d05a999b81c842dff6.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3028
      • C:\Windows\SysWOW64\notepad.exe
        notepad.exe
        3⤵
        • Modifies Installed Components in the registry
        • Adds Run key to start application
        • Drops file in System32 directory
        • Suspicious use of SetWindowsHookEx
        PID:2560
  • C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    1⤵
    • Modifies Installed Components in the registry
    • Adds Run key to start application
    PID:2192

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\InstallDir\ver.exe

    Filesize

    272KB

    MD5

    8ae60ffd054b91d05a999b81c842dff6

    SHA1

    c4d53e74655ecef838f43679f86ac97fa03b693b

    SHA256

    3855d14233d9b0d2264b18749baef259989099aa3471fde387885743d1809299

    SHA512

    847aa1f2290b877070eab91ab53186465916a1caa4c9a41943a8ae36807400930f402e0d91d28363a116ae2fe97ec771e07e63c7e86c121a0b0376ad93046448

  • memory/880-2-0x0000000000400000-0x00000000004C6000-memory.dmp

    Filesize

    792KB

  • memory/880-6-0x0000000000400000-0x00000000004C6000-memory.dmp

    Filesize

    792KB

  • memory/880-0-0x0000000000400000-0x00000000004C6000-memory.dmp

    Filesize

    792KB

  • memory/2192-13-0x0000000010000000-0x0000000010048000-memory.dmp

    Filesize

    288KB

  • memory/2192-22-0x0000000010000000-0x0000000010048000-memory.dmp

    Filesize

    288KB

  • memory/2192-11-0x0000000010000000-0x0000000010048000-memory.dmp

    Filesize

    288KB

  • memory/2560-16-0x0000000010000000-0x0000000010048000-memory.dmp

    Filesize

    288KB

  • memory/2560-20-0x0000000010000000-0x0000000010048000-memory.dmp

    Filesize

    288KB

  • memory/2560-23-0x0000000010000000-0x0000000010048000-memory.dmp

    Filesize

    288KB

  • memory/3028-7-0x0000000010000000-0x0000000010048000-memory.dmp

    Filesize

    288KB

  • memory/3028-8-0x0000000000400000-0x00000000004C6000-memory.dmp

    Filesize

    792KB

  • memory/3028-17-0x0000000010000000-0x0000000010048000-memory.dmp

    Filesize

    288KB

  • memory/3028-9-0x0000000010000000-0x0000000010048000-memory.dmp

    Filesize

    288KB

  • memory/3028-10-0x0000000010000000-0x0000000010048000-memory.dmp

    Filesize

    288KB

  • memory/3028-4-0x0000000010000000-0x0000000010048000-memory.dmp

    Filesize

    288KB