Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-02-2024 22:56
Static task
static1
Behavioral task
behavioral1
Sample
a78f5b9da6c323a9b325511f6318d265.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a78f5b9da6c323a9b325511f6318d265.exe
Resource
win10v2004-20240226-en
General
-
Target
a78f5b9da6c323a9b325511f6318d265.exe
-
Size
296KB
-
MD5
a78f5b9da6c323a9b325511f6318d265
-
SHA1
c5574fde465517b9092be055aae25f2f243dd8c7
-
SHA256
6f401be102cc2060edd4c301f9bfff71ecf37f29e5cff3a42129c6e46c2e47d5
-
SHA512
2fa71e0c974538648f7510f7d4595991e340dfba54060954a64860106491fc9d94dc9191f5d0332aaa79bce6681ba7d921d591f5ddb1b91cf328818b1fc06f2a
-
SSDEEP
6144:f1C/mbSSGmG9StTknv48s8ssskeLCVfDa+PSq6fY:deaSr9SNknv48sUeLCV5PSHA
Malware Config
Signatures
-
Detect XtremeRAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2596-5-0x0000000000C80000-0x0000000000CA8000-memory.dmp family_xtremerat behavioral1/memory/2596-6-0x0000000000C80000-0x0000000000CA8000-memory.dmp family_xtremerat behavioral1/memory/2552-14-0x0000000000C80000-0x0000000000CA8000-memory.dmp family_xtremerat behavioral1/memory/2684-18-0x0000000000C80000-0x0000000000CA8000-memory.dmp family_xtremerat behavioral1/memory/2596-19-0x0000000000C80000-0x0000000000CA8000-memory.dmp family_xtremerat behavioral1/memory/2684-21-0x0000000000C80000-0x0000000000CA8000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
a78f5b9da6c323a9b325511f6318d265.exesvchost.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} a78f5b9da6c323a9b325511f6318d265.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Program Files (x86)\\windows\\window.exe restart" a78f5b9da6c323a9b325511f6318d265.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Program Files (x86)\\windows\\window.exe" svchost.exe -
Processes:
resource yara_rule behavioral1/memory/2596-2-0x0000000000C80000-0x0000000000CA8000-memory.dmp upx behavioral1/memory/2596-4-0x0000000000C80000-0x0000000000CA8000-memory.dmp upx behavioral1/memory/2596-5-0x0000000000C80000-0x0000000000CA8000-memory.dmp upx behavioral1/memory/2596-6-0x0000000000C80000-0x0000000000CA8000-memory.dmp upx behavioral1/memory/2552-14-0x0000000000C80000-0x0000000000CA8000-memory.dmp upx behavioral1/memory/2684-18-0x0000000000C80000-0x0000000000CA8000-memory.dmp upx behavioral1/memory/2596-19-0x0000000000C80000-0x0000000000CA8000-memory.dmp upx behavioral1/memory/2684-21-0x0000000000C80000-0x0000000000CA8000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
svchost.exea78f5b9da6c323a9b325511f6318d265.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Program Files (x86)\\windows\\window.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Program Files (x86)\\windows\\window.exe" a78f5b9da6c323a9b325511f6318d265.exe Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Program Files (x86)\\windows\\window.exe" a78f5b9da6c323a9b325511f6318d265.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Program Files (x86)\\windows\\window.exe" svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a78f5b9da6c323a9b325511f6318d265.exedescription pid process target process PID 2936 set thread context of 2596 2936 a78f5b9da6c323a9b325511f6318d265.exe a78f5b9da6c323a9b325511f6318d265.exe -
Drops file in Program Files directory 2 IoCs
Processes:
a78f5b9da6c323a9b325511f6318d265.exedescription ioc process File opened for modification C:\Program Files (x86)\windows\window.exe a78f5b9da6c323a9b325511f6318d265.exe File created C:\Program Files (x86)\windows\window.exe a78f5b9da6c323a9b325511f6318d265.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
a78f5b9da6c323a9b325511f6318d265.exesvchost.exepid process 2936 a78f5b9da6c323a9b325511f6318d265.exe 2684 svchost.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
a78f5b9da6c323a9b325511f6318d265.exea78f5b9da6c323a9b325511f6318d265.exedescription pid process target process PID 2936 wrote to memory of 2596 2936 a78f5b9da6c323a9b325511f6318d265.exe a78f5b9da6c323a9b325511f6318d265.exe PID 2936 wrote to memory of 2596 2936 a78f5b9da6c323a9b325511f6318d265.exe a78f5b9da6c323a9b325511f6318d265.exe PID 2936 wrote to memory of 2596 2936 a78f5b9da6c323a9b325511f6318d265.exe a78f5b9da6c323a9b325511f6318d265.exe PID 2936 wrote to memory of 2596 2936 a78f5b9da6c323a9b325511f6318d265.exe a78f5b9da6c323a9b325511f6318d265.exe PID 2936 wrote to memory of 2596 2936 a78f5b9da6c323a9b325511f6318d265.exe a78f5b9da6c323a9b325511f6318d265.exe PID 2936 wrote to memory of 2596 2936 a78f5b9da6c323a9b325511f6318d265.exe a78f5b9da6c323a9b325511f6318d265.exe PID 2936 wrote to memory of 2596 2936 a78f5b9da6c323a9b325511f6318d265.exe a78f5b9da6c323a9b325511f6318d265.exe PID 2936 wrote to memory of 2596 2936 a78f5b9da6c323a9b325511f6318d265.exe a78f5b9da6c323a9b325511f6318d265.exe PID 2936 wrote to memory of 2596 2936 a78f5b9da6c323a9b325511f6318d265.exe a78f5b9da6c323a9b325511f6318d265.exe PID 2596 wrote to memory of 2552 2596 a78f5b9da6c323a9b325511f6318d265.exe svchost.exe PID 2596 wrote to memory of 2552 2596 a78f5b9da6c323a9b325511f6318d265.exe svchost.exe PID 2596 wrote to memory of 2552 2596 a78f5b9da6c323a9b325511f6318d265.exe svchost.exe PID 2596 wrote to memory of 2552 2596 a78f5b9da6c323a9b325511f6318d265.exe svchost.exe PID 2596 wrote to memory of 2552 2596 a78f5b9da6c323a9b325511f6318d265.exe svchost.exe PID 2596 wrote to memory of 2684 2596 a78f5b9da6c323a9b325511f6318d265.exe svchost.exe PID 2596 wrote to memory of 2684 2596 a78f5b9da6c323a9b325511f6318d265.exe svchost.exe PID 2596 wrote to memory of 2684 2596 a78f5b9da6c323a9b325511f6318d265.exe svchost.exe PID 2596 wrote to memory of 2684 2596 a78f5b9da6c323a9b325511f6318d265.exe svchost.exe PID 2596 wrote to memory of 2684 2596 a78f5b9da6c323a9b325511f6318d265.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a78f5b9da6c323a9b325511f6318d265.exe"C:\Users\Admin\AppData\Local\Temp\a78f5b9da6c323a9b325511f6318d265.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\a78f5b9da6c323a9b325511f6318d265.exeC:\Users\Admin\AppData\Local\Temp\a78f5b9da6c323a9b325511f6318d265.exe2⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:2552 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
- Suspicious use of SetWindowsHookEx
PID:2684
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
296KB
MD5a78f5b9da6c323a9b325511f6318d265
SHA1c5574fde465517b9092be055aae25f2f243dd8c7
SHA2566f401be102cc2060edd4c301f9bfff71ecf37f29e5cff3a42129c6e46c2e47d5
SHA5122fa71e0c974538648f7510f7d4595991e340dfba54060954a64860106491fc9d94dc9191f5d0332aaa79bce6681ba7d921d591f5ddb1b91cf328818b1fc06f2a