Analysis

  • max time kernel
    138s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-02-2024 00:14

General

  • Target

    8ae60ffd054b91d05a999b81c842dff6.exe

  • Size

    272KB

  • MD5

    8ae60ffd054b91d05a999b81c842dff6

  • SHA1

    c4d53e74655ecef838f43679f86ac97fa03b693b

  • SHA256

    3855d14233d9b0d2264b18749baef259989099aa3471fde387885743d1809299

  • SHA512

    847aa1f2290b877070eab91ab53186465916a1caa4c9a41943a8ae36807400930f402e0d91d28363a116ae2fe97ec771e07e63c7e86c121a0b0376ad93046448

  • SSDEEP

    6144:z5MiHH39hzMBo7Ljd/Q1RgOw7I43qRKoC4pFsMmKAae0d7:VT3Lzqo7Li1RgdI0wbC4pFpmKAae0d7

Malware Config

Extracted

Family

xtremerat

C2

firefox-dmm.sytes.net

google-pro.dyndns.info

Signatures

  • Detect XtremeRAT payload 6 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8ae60ffd054b91d05a999b81c842dff6.exe
    "C:\Users\Admin\AppData\Local\Temp\8ae60ffd054b91d05a999b81c842dff6.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2244
    • C:\Users\Admin\AppData\Local\Temp\8ae60ffd054b91d05a999b81c842dff6.exe
      C:\Users\Admin\AppData\Local\Temp\8ae60ffd054b91d05a999b81c842dff6.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2568
      • C:\Windows\SysWOW64\svchost.exe
        svchost.exe
        3⤵
          PID:3076
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3076 -s 488
            4⤵
            • Program crash
            PID:4540
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3076 -s 496
            4⤵
            • Program crash
            PID:4956
        • C:\Windows\SysWOW64\notepad.exe
          notepad.exe
          3⤵
            PID:3924
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 448
              4⤵
              • Program crash
              PID:2184
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 488
              4⤵
              • Program crash
              PID:260
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 3076 -ip 3076
        1⤵
          PID:4520
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 3924 -ip 3924
          1⤵
            PID:4832
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3924 -ip 3924
            1⤵
              PID:2272
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3076 -ip 3076
              1⤵
                PID:2748

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/2244-0-0x0000000000400000-0x00000000004C6000-memory.dmp

                Filesize

                792KB

              • memory/2244-1-0x0000000000400000-0x00000000004C6000-memory.dmp

                Filesize

                792KB

              • memory/2244-6-0x0000000000400000-0x00000000004C6000-memory.dmp

                Filesize

                792KB

              • memory/2568-4-0x0000000010000000-0x0000000010048000-memory.dmp

                Filesize

                288KB

              • memory/2568-7-0x0000000010000000-0x0000000010048000-memory.dmp

                Filesize

                288KB

              • memory/2568-8-0x0000000010000000-0x0000000010048000-memory.dmp

                Filesize

                288KB

              • memory/2568-9-0x0000000010000000-0x0000000010048000-memory.dmp

                Filesize

                288KB

              • memory/2568-12-0x0000000010000000-0x0000000010048000-memory.dmp

                Filesize

                288KB

              • memory/3076-10-0x0000000010000000-0x0000000010048000-memory.dmp

                Filesize

                288KB

              • memory/3076-14-0x0000000010000000-0x0000000010048000-memory.dmp

                Filesize

                288KB

              • memory/3924-11-0x0000000010000000-0x0000000010048000-memory.dmp

                Filesize

                288KB