Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-02-2024 21:16
Static task
static1
Behavioral task
behavioral1
Sample
aa2cb15a973424af10b43d595fc3784a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
aa2cb15a973424af10b43d595fc3784a.exe
Resource
win10v2004-20240226-en
General
-
Target
aa2cb15a973424af10b43d595fc3784a.exe
-
Size
170KB
-
MD5
aa2cb15a973424af10b43d595fc3784a
-
SHA1
9ffc9fac0be1a0d4609de1a3c31f35e66fa849cc
-
SHA256
fdab584b663b098e50b365092b53ad81d8503340c42346cdf2b5b35203001e48
-
SHA512
381d899cfad764eb12a1edca2bfc89449e0434035904035cb4a0aae3b215868fdc9b0a49a7ccc78da6ccfe41cd772f4cfdc0631fc47492d78582e84c9c91979c
-
SSDEEP
3072:vrDBQZKHe8fAIwgw4lAA1Bh9BhmhllVobtGiNlI/VJLEwmbqNn4diI82hJNILHEB:hQAHe8fAIwgw4lAAx9BhmroAiHI/VZE9
Malware Config
Extracted
xtremerat
tubass.no-ip.org
Signatures
-
Detect XtremeRAT payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/3476-7-0x0000000010000000-0x000000001004B000-memory.dmp family_xtremerat behavioral2/memory/3476-8-0x0000000010000000-0x000000001004B000-memory.dmp family_xtremerat behavioral2/memory/4460-9-0x0000000010000000-0x000000001004B000-memory.dmp family_xtremerat behavioral2/memory/3476-10-0x0000000010000000-0x000000001004B000-memory.dmp family_xtremerat behavioral2/memory/4460-11-0x0000000010000000-0x000000001004B000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Processes:
resource yara_rule behavioral2/memory/3476-3-0x0000000010000000-0x000000001004B000-memory.dmp upx behavioral2/memory/3476-6-0x0000000010000000-0x000000001004B000-memory.dmp upx behavioral2/memory/3476-7-0x0000000010000000-0x000000001004B000-memory.dmp upx behavioral2/memory/3476-8-0x0000000010000000-0x000000001004B000-memory.dmp upx behavioral2/memory/4460-9-0x0000000010000000-0x000000001004B000-memory.dmp upx behavioral2/memory/3476-10-0x0000000010000000-0x000000001004B000-memory.dmp upx behavioral2/memory/4460-11-0x0000000010000000-0x000000001004B000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
aa2cb15a973424af10b43d595fc3784a.exedescription pid process target process PID 4540 set thread context of 3476 4540 aa2cb15a973424af10b43d595fc3784a.exe aa2cb15a973424af10b43d595fc3784a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4136 4460 WerFault.exe svchost.exe 4936 4460 WerFault.exe svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
aa2cb15a973424af10b43d595fc3784a.exepid process 4540 aa2cb15a973424af10b43d595fc3784a.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
aa2cb15a973424af10b43d595fc3784a.exeaa2cb15a973424af10b43d595fc3784a.exedescription pid process target process PID 4540 wrote to memory of 3476 4540 aa2cb15a973424af10b43d595fc3784a.exe aa2cb15a973424af10b43d595fc3784a.exe PID 4540 wrote to memory of 3476 4540 aa2cb15a973424af10b43d595fc3784a.exe aa2cb15a973424af10b43d595fc3784a.exe PID 4540 wrote to memory of 3476 4540 aa2cb15a973424af10b43d595fc3784a.exe aa2cb15a973424af10b43d595fc3784a.exe PID 4540 wrote to memory of 3476 4540 aa2cb15a973424af10b43d595fc3784a.exe aa2cb15a973424af10b43d595fc3784a.exe PID 4540 wrote to memory of 3476 4540 aa2cb15a973424af10b43d595fc3784a.exe aa2cb15a973424af10b43d595fc3784a.exe PID 4540 wrote to memory of 3476 4540 aa2cb15a973424af10b43d595fc3784a.exe aa2cb15a973424af10b43d595fc3784a.exe PID 4540 wrote to memory of 3476 4540 aa2cb15a973424af10b43d595fc3784a.exe aa2cb15a973424af10b43d595fc3784a.exe PID 4540 wrote to memory of 3476 4540 aa2cb15a973424af10b43d595fc3784a.exe aa2cb15a973424af10b43d595fc3784a.exe PID 3476 wrote to memory of 4460 3476 aa2cb15a973424af10b43d595fc3784a.exe svchost.exe PID 3476 wrote to memory of 4460 3476 aa2cb15a973424af10b43d595fc3784a.exe svchost.exe PID 3476 wrote to memory of 4460 3476 aa2cb15a973424af10b43d595fc3784a.exe svchost.exe PID 3476 wrote to memory of 4460 3476 aa2cb15a973424af10b43d595fc3784a.exe svchost.exe PID 3476 wrote to memory of 3744 3476 aa2cb15a973424af10b43d595fc3784a.exe msedge.exe PID 3476 wrote to memory of 3744 3476 aa2cb15a973424af10b43d595fc3784a.exe msedge.exe PID 3476 wrote to memory of 3744 3476 aa2cb15a973424af10b43d595fc3784a.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa2cb15a973424af10b43d595fc3784a.exe"C:\Users\Admin\AppData\Local\Temp\aa2cb15a973424af10b43d595fc3784a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\aa2cb15a973424af10b43d595fc3784a.exeC:\Users\Admin\AppData\Local\Temp\aa2cb15a973424af10b43d595fc3784a.exe2⤵
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵PID:4460
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 4844⤵
- Program crash
PID:4136 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 4924⤵
- Program crash
PID:4936 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵PID:3744
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4460 -ip 44601⤵PID:5116
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4460 -ip 44601⤵PID:4356