Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
26-03-2024 18:44
Static task
static1
Behavioral task
behavioral1
Sample
dfd809f1edaf4727e7431eca0d74865c.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
dfd809f1edaf4727e7431eca0d74865c.exe
Resource
win10v2004-20231215-en
General
-
Target
dfd809f1edaf4727e7431eca0d74865c.exe
-
Size
272KB
-
MD5
dfd809f1edaf4727e7431eca0d74865c
-
SHA1
1ff57127ac9144345fd792629e636ad325f4b416
-
SHA256
00171632f54e64b5d0ff8b78867e7a53b50def7cb06639d5f6e5e8bdae39eeaa
-
SHA512
ea91ba63670ffa76471814d553232ae1e88983a94b51766c26ab185f868cd98c5ec47e3114ad255829a4eb7add426764d3fd03b2e02430b1afb8e32ef436ab92
-
SSDEEP
6144:gMauJeqN2l9oCTzZzx2D49gPa9/iP5XBJrLfsLt:q3qNEBlcQoLxLELt
Malware Config
Extracted
xtremerat
alssm.no-ip.biz
Signatures
-
Detect XtremeRAT payload 10 IoCs
Processes:
resource yara_rule behavioral1/memory/2808-6-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral1/memory/2808-8-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral1/memory/2808-4-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral1/memory/2808-9-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral1/memory/2524-15-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral1/memory/2808-16-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral1/memory/2524-20-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral1/memory/2524-21-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral1/memory/2508-23-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral1/memory/2524-24-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{S3875TV7-54F1-5XNB-M1L2-RS4IE8H56D40} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{S3875TV7-54F1-5XNB-M1L2-RS4IE8H56D40}\StubPath = "C:\\Windows\\system32\\windiwsubdata\\windows updata.exe restart" explorer.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{S3875TV7-54F1-5XNB-M1L2-RS4IE8H56D40} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{S3875TV7-54F1-5XNB-M1L2-RS4IE8H56D40}\StubPath = "C:\\Windows\\system32\\windiwsubdata\\windows updata.exe" svchost.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\updata = "C:\\Windows\\system32\\windiwsubdata\\windows updata.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\update = "C:\\Windows\\system32\\windiwsubdata\\windows updata.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "%updata%" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\updata = "C:\\Windows\\system32\\windiwsubdata\\windows updata.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\update = "C:\\Windows\\system32\\windiwsubdata\\windows updata.exe" svchost.exe -
Drops file in System32 directory 3 IoCs
Processes:
explorer.exedescription ioc process File opened for modification C:\Windows\SysWOW64\windiwsubdata\windows updata.exe explorer.exe File created C:\Windows\SysWOW64\windiwsubdata\windows updata.exe explorer.exe File opened for modification C:\Windows\SysWOW64\windiwsubdata\ explorer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
dfd809f1edaf4727e7431eca0d74865c.exedescription pid process target process PID 2888 set thread context of 2808 2888 dfd809f1edaf4727e7431eca0d74865c.exe dfd809f1edaf4727e7431eca0d74865c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
dfd809f1edaf4727e7431eca0d74865c.exeexplorer.exepid process 2888 dfd809f1edaf4727e7431eca0d74865c.exe 2524 explorer.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
dfd809f1edaf4727e7431eca0d74865c.exedfd809f1edaf4727e7431eca0d74865c.exedescription pid process target process PID 2888 wrote to memory of 2808 2888 dfd809f1edaf4727e7431eca0d74865c.exe dfd809f1edaf4727e7431eca0d74865c.exe PID 2888 wrote to memory of 2808 2888 dfd809f1edaf4727e7431eca0d74865c.exe dfd809f1edaf4727e7431eca0d74865c.exe PID 2888 wrote to memory of 2808 2888 dfd809f1edaf4727e7431eca0d74865c.exe dfd809f1edaf4727e7431eca0d74865c.exe PID 2888 wrote to memory of 2808 2888 dfd809f1edaf4727e7431eca0d74865c.exe dfd809f1edaf4727e7431eca0d74865c.exe PID 2888 wrote to memory of 2808 2888 dfd809f1edaf4727e7431eca0d74865c.exe dfd809f1edaf4727e7431eca0d74865c.exe PID 2888 wrote to memory of 2808 2888 dfd809f1edaf4727e7431eca0d74865c.exe dfd809f1edaf4727e7431eca0d74865c.exe PID 2888 wrote to memory of 2808 2888 dfd809f1edaf4727e7431eca0d74865c.exe dfd809f1edaf4727e7431eca0d74865c.exe PID 2888 wrote to memory of 2808 2888 dfd809f1edaf4727e7431eca0d74865c.exe dfd809f1edaf4727e7431eca0d74865c.exe PID 2888 wrote to memory of 2808 2888 dfd809f1edaf4727e7431eca0d74865c.exe dfd809f1edaf4727e7431eca0d74865c.exe PID 2888 wrote to memory of 2808 2888 dfd809f1edaf4727e7431eca0d74865c.exe dfd809f1edaf4727e7431eca0d74865c.exe PID 2888 wrote to memory of 2808 2888 dfd809f1edaf4727e7431eca0d74865c.exe dfd809f1edaf4727e7431eca0d74865c.exe PID 2888 wrote to memory of 2808 2888 dfd809f1edaf4727e7431eca0d74865c.exe dfd809f1edaf4727e7431eca0d74865c.exe PID 2888 wrote to memory of 2808 2888 dfd809f1edaf4727e7431eca0d74865c.exe dfd809f1edaf4727e7431eca0d74865c.exe PID 2888 wrote to memory of 2808 2888 dfd809f1edaf4727e7431eca0d74865c.exe dfd809f1edaf4727e7431eca0d74865c.exe PID 2808 wrote to memory of 2508 2808 dfd809f1edaf4727e7431eca0d74865c.exe svchost.exe PID 2808 wrote to memory of 2508 2808 dfd809f1edaf4727e7431eca0d74865c.exe svchost.exe PID 2808 wrote to memory of 2508 2808 dfd809f1edaf4727e7431eca0d74865c.exe svchost.exe PID 2808 wrote to memory of 2508 2808 dfd809f1edaf4727e7431eca0d74865c.exe svchost.exe PID 2808 wrote to memory of 2508 2808 dfd809f1edaf4727e7431eca0d74865c.exe svchost.exe PID 2808 wrote to memory of 2524 2808 dfd809f1edaf4727e7431eca0d74865c.exe explorer.exe PID 2808 wrote to memory of 2524 2808 dfd809f1edaf4727e7431eca0d74865c.exe explorer.exe PID 2808 wrote to memory of 2524 2808 dfd809f1edaf4727e7431eca0d74865c.exe explorer.exe PID 2808 wrote to memory of 2524 2808 dfd809f1edaf4727e7431eca0d74865c.exe explorer.exe PID 2808 wrote to memory of 2524 2808 dfd809f1edaf4727e7431eca0d74865c.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfd809f1edaf4727e7431eca0d74865c.exe"C:\Users\Admin\AppData\Local\Temp\dfd809f1edaf4727e7431eca0d74865c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dfd809f1edaf4727e7431eca0d74865c.exe"C:\Users\Admin\AppData\Local\Temp\dfd809f1edaf4727e7431eca0d74865c.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\windiwsubdata\windows updata.exeFilesize
272KB
MD5dfd809f1edaf4727e7431eca0d74865c
SHA11ff57127ac9144345fd792629e636ad325f4b416
SHA25600171632f54e64b5d0ff8b78867e7a53b50def7cb06639d5f6e5e8bdae39eeaa
SHA512ea91ba63670ffa76471814d553232ae1e88983a94b51766c26ab185f868cd98c5ec47e3114ad255829a4eb7add426764d3fd03b2e02430b1afb8e32ef436ab92
-
memory/2508-10-0x0000000010000000-0x0000000010048000-memory.dmpFilesize
288KB
-
memory/2508-23-0x0000000010000000-0x0000000010048000-memory.dmpFilesize
288KB
-
memory/2524-20-0x0000000010000000-0x0000000010048000-memory.dmpFilesize
288KB
-
memory/2524-15-0x0000000010000000-0x0000000010048000-memory.dmpFilesize
288KB
-
memory/2524-24-0x0000000010000000-0x0000000010048000-memory.dmpFilesize
288KB
-
memory/2524-21-0x0000000010000000-0x0000000010048000-memory.dmpFilesize
288KB
-
memory/2808-9-0x0000000010000000-0x0000000010048000-memory.dmpFilesize
288KB
-
memory/2808-6-0x0000000010000000-0x0000000010048000-memory.dmpFilesize
288KB
-
memory/2808-7-0x0000000000400000-0x0000000000534AA0-memory.dmpFilesize
1.2MB
-
memory/2808-16-0x0000000010000000-0x0000000010048000-memory.dmpFilesize
288KB
-
memory/2808-4-0x0000000010000000-0x0000000010048000-memory.dmpFilesize
288KB
-
memory/2808-8-0x0000000010000000-0x0000000010048000-memory.dmpFilesize
288KB
-
memory/2888-5-0x0000000002A50000-0x0000000002B85000-memory.dmpFilesize
1.2MB
-
memory/2888-0-0x0000000000400000-0x0000000000534AA0-memory.dmpFilesize
1.2MB
-
memory/2888-22-0x0000000000400000-0x0000000000534AA0-memory.dmpFilesize
1.2MB
-
memory/2888-1-0x0000000000400000-0x0000000000534AA0-memory.dmpFilesize
1.2MB