Analysis
-
max time kernel
162s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-02-2024 17:32
Static task
static1
Behavioral task
behavioral1
Sample
a9bfb5f9fb5f0f3198961ed500f9a7bc.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a9bfb5f9fb5f0f3198961ed500f9a7bc.exe
Resource
win10v2004-20240226-en
General
-
Target
a9bfb5f9fb5f0f3198961ed500f9a7bc.exe
-
Size
83KB
-
MD5
a9bfb5f9fb5f0f3198961ed500f9a7bc
-
SHA1
289f4676842c23ebf0653c500b27ff9c9ef0dd89
-
SHA256
c44a61a1925649996e0e2ed2cef31e688d74d191a99fd5a827fab6714d4c1b80
-
SHA512
d49ff23a8aa1aa4d7a8d2403bbd2296767a12d0ca13bc036521ee89cf698bb4215b8c053500e7c66ead8d8171e66ab73a84465a156dd33a7165b234153b0ba8e
-
SSDEEP
1536:bWSnGaHslqr471zU9XsN4ZYiLh13CaGFwWREmGaYq5JhOr1LA5IU:bTnvHslqrOBAtcRPGkJhOrGaU
Malware Config
Extracted
xtremerat
gfhgfhjfj.no-ip.info
Signatures
-
Detect XtremeRAT payload 11 IoCs
Processes:
resource yara_rule behavioral1/memory/1712-4-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/1712-5-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/1712-6-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/1712-7-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/1712-8-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/1712-11-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/1712-12-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/1712-13-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/1712-15-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/1712-19-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/2528-20-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
a9bfb5f9fb5f0f3198961ed500f9a7bc.exedescription pid process target process PID 2164 set thread context of 1712 2164 a9bfb5f9fb5f0f3198961ed500f9a7bc.exe a9bfb5f9fb5f0f3198961ed500f9a7bc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
a9bfb5f9fb5f0f3198961ed500f9a7bc.exepid process 2164 a9bfb5f9fb5f0f3198961ed500f9a7bc.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
a9bfb5f9fb5f0f3198961ed500f9a7bc.exea9bfb5f9fb5f0f3198961ed500f9a7bc.exedescription pid process target process PID 2164 wrote to memory of 1712 2164 a9bfb5f9fb5f0f3198961ed500f9a7bc.exe a9bfb5f9fb5f0f3198961ed500f9a7bc.exe PID 2164 wrote to memory of 1712 2164 a9bfb5f9fb5f0f3198961ed500f9a7bc.exe a9bfb5f9fb5f0f3198961ed500f9a7bc.exe PID 2164 wrote to memory of 1712 2164 a9bfb5f9fb5f0f3198961ed500f9a7bc.exe a9bfb5f9fb5f0f3198961ed500f9a7bc.exe PID 2164 wrote to memory of 1712 2164 a9bfb5f9fb5f0f3198961ed500f9a7bc.exe a9bfb5f9fb5f0f3198961ed500f9a7bc.exe PID 2164 wrote to memory of 1712 2164 a9bfb5f9fb5f0f3198961ed500f9a7bc.exe a9bfb5f9fb5f0f3198961ed500f9a7bc.exe PID 2164 wrote to memory of 1712 2164 a9bfb5f9fb5f0f3198961ed500f9a7bc.exe a9bfb5f9fb5f0f3198961ed500f9a7bc.exe PID 2164 wrote to memory of 1712 2164 a9bfb5f9fb5f0f3198961ed500f9a7bc.exe a9bfb5f9fb5f0f3198961ed500f9a7bc.exe PID 2164 wrote to memory of 1712 2164 a9bfb5f9fb5f0f3198961ed500f9a7bc.exe a9bfb5f9fb5f0f3198961ed500f9a7bc.exe PID 2164 wrote to memory of 1712 2164 a9bfb5f9fb5f0f3198961ed500f9a7bc.exe a9bfb5f9fb5f0f3198961ed500f9a7bc.exe PID 2164 wrote to memory of 1712 2164 a9bfb5f9fb5f0f3198961ed500f9a7bc.exe a9bfb5f9fb5f0f3198961ed500f9a7bc.exe PID 2164 wrote to memory of 1712 2164 a9bfb5f9fb5f0f3198961ed500f9a7bc.exe a9bfb5f9fb5f0f3198961ed500f9a7bc.exe PID 2164 wrote to memory of 1712 2164 a9bfb5f9fb5f0f3198961ed500f9a7bc.exe a9bfb5f9fb5f0f3198961ed500f9a7bc.exe PID 1712 wrote to memory of 2528 1712 a9bfb5f9fb5f0f3198961ed500f9a7bc.exe svchost.exe PID 1712 wrote to memory of 2528 1712 a9bfb5f9fb5f0f3198961ed500f9a7bc.exe svchost.exe PID 1712 wrote to memory of 2528 1712 a9bfb5f9fb5f0f3198961ed500f9a7bc.exe svchost.exe PID 1712 wrote to memory of 2528 1712 a9bfb5f9fb5f0f3198961ed500f9a7bc.exe svchost.exe PID 1712 wrote to memory of 2528 1712 a9bfb5f9fb5f0f3198961ed500f9a7bc.exe svchost.exe PID 1712 wrote to memory of 2736 1712 a9bfb5f9fb5f0f3198961ed500f9a7bc.exe iexplore.exe PID 1712 wrote to memory of 2736 1712 a9bfb5f9fb5f0f3198961ed500f9a7bc.exe iexplore.exe PID 1712 wrote to memory of 2736 1712 a9bfb5f9fb5f0f3198961ed500f9a7bc.exe iexplore.exe PID 1712 wrote to memory of 2736 1712 a9bfb5f9fb5f0f3198961ed500f9a7bc.exe iexplore.exe PID 1712 wrote to memory of 2736 1712 a9bfb5f9fb5f0f3198961ed500f9a7bc.exe iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9bfb5f9fb5f0f3198961ed500f9a7bc.exe"C:\Users\Admin\AppData\Local\Temp\a9bfb5f9fb5f0f3198961ed500f9a7bc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\a9bfb5f9fb5f0f3198961ed500f9a7bc.exe"C:\Users\Admin\AppData\Local\Temp\a9bfb5f9fb5f0f3198961ed500f9a7bc.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵PID:2528
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:2736