Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
12/02/2024, 03:42
General
- Target 962810a77cba5a26d4e899b7ceede6ad.exe
- Size 504KB
- Sample240212-d9f4naea9w
- SHA256 19917050d834b4b860325f88cca672c5c32605c70b286c491d8b87ee010d70e9
Malware Config
Signatures
- Detect XtremeRAT payload 1 IoCs
- XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
- Modifies Installed Components in the registry 2 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Drops file in System32 directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\962810a77cba5a26d4e899b7ceede6ad.exe"C:\Users\Admin\AppData\Local\Temp\962810a77cba5a26d4e899b7ceede6ad.exe"1⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1632-0-0x0000000010000000-0x00000000100BE000-memory.dmp
memory/1632-1-0x0000000002200000-0x0000000002260000-memory.dmp
memory/1632-3-0x00000000023E0000-0x00000000023E1000-memory.dmp
memory/1632-2-0x00000000023F0000-0x00000000023F1000-memory.dmp
memory/1632-4-0x0000000002440000-0x0000000002441000-memory.dmp
memory/1632-5-0x0000000002410000-0x0000000002411000-memory.dmp
memory/1632-6-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/1632-7-0x0000000002450000-0x0000000002451000-memory.dmp
memory/1632-8-0x0000000003320000-0x0000000003321000-memory.dmp
memory/1632-9-0x0000000003310000-0x0000000003312000-memory.dmp
memory/1632-10-0x0000000003300000-0x0000000003307000-memory.dmp
memory/1632-13-0x0000000010000000-0x00000000100BE000-memory.dmp
memory/1632-14-0x0000000002200000-0x0000000002260000-memory.dmp