Analysis
-
max time kernel
116s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26-03-2024 18:44
Static task
static1
Behavioral task
behavioral1
Sample
dfd809f1edaf4727e7431eca0d74865c.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
dfd809f1edaf4727e7431eca0d74865c.exe
Resource
win10v2004-20231215-en
General
-
Target
dfd809f1edaf4727e7431eca0d74865c.exe
-
Size
272KB
-
MD5
dfd809f1edaf4727e7431eca0d74865c
-
SHA1
1ff57127ac9144345fd792629e636ad325f4b416
-
SHA256
00171632f54e64b5d0ff8b78867e7a53b50def7cb06639d5f6e5e8bdae39eeaa
-
SHA512
ea91ba63670ffa76471814d553232ae1e88983a94b51766c26ab185f868cd98c5ec47e3114ad255829a4eb7add426764d3fd03b2e02430b1afb8e32ef436ab92
-
SSDEEP
6144:gMauJeqN2l9oCTzZzx2D49gPa9/iP5XBJrLfsLt:q3qNEBlcQoLxLELt
Malware Config
Extracted
xtremerat
alssm.no-ip.biz
Signatures
-
Detect XtremeRAT payload 11 IoCs
Processes:
resource yara_rule behavioral2/memory/1616-4-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral2/memory/1616-5-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral2/memory/1616-6-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral2/memory/1616-7-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral2/memory/4256-8-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral2/memory/4304-9-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral2/memory/1616-10-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral2/memory/4256-13-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral2/memory/4304-14-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral2/memory/4304-15-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral2/memory/4304-17-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{S3875TV7-54F1-5XNB-M1L2-RS4IE8H56D40}\StubPath = "C:\\Windows\\system32\\windiwsubdata\\windows updata.exe restart" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{S3875TV7-54F1-5XNB-M1L2-RS4IE8H56D40} explorer.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "%updata%" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\updata = "C:\\Windows\\system32\\windiwsubdata\\windows updata.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\update = "C:\\Windows\\system32\\windiwsubdata\\windows updata.exe" explorer.exe -
Drops file in System32 directory 3 IoCs
Processes:
explorer.exedescription ioc process File opened for modification C:\Windows\SysWOW64\windiwsubdata\windows updata.exe explorer.exe File created C:\Windows\SysWOW64\windiwsubdata\windows updata.exe explorer.exe File opened for modification C:\Windows\SysWOW64\windiwsubdata\ explorer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
dfd809f1edaf4727e7431eca0d74865c.exedescription pid process target process PID 3248 set thread context of 1616 3248 dfd809f1edaf4727e7431eca0d74865c.exe dfd809f1edaf4727e7431eca0d74865c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3580 4256 WerFault.exe svchost.exe 4724 4256 WerFault.exe svchost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
dfd809f1edaf4727e7431eca0d74865c.exeexplorer.exepid process 3248 dfd809f1edaf4727e7431eca0d74865c.exe 4304 explorer.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
dfd809f1edaf4727e7431eca0d74865c.exedfd809f1edaf4727e7431eca0d74865c.exedescription pid process target process PID 3248 wrote to memory of 1616 3248 dfd809f1edaf4727e7431eca0d74865c.exe dfd809f1edaf4727e7431eca0d74865c.exe PID 3248 wrote to memory of 1616 3248 dfd809f1edaf4727e7431eca0d74865c.exe dfd809f1edaf4727e7431eca0d74865c.exe PID 3248 wrote to memory of 1616 3248 dfd809f1edaf4727e7431eca0d74865c.exe dfd809f1edaf4727e7431eca0d74865c.exe PID 3248 wrote to memory of 1616 3248 dfd809f1edaf4727e7431eca0d74865c.exe dfd809f1edaf4727e7431eca0d74865c.exe PID 3248 wrote to memory of 1616 3248 dfd809f1edaf4727e7431eca0d74865c.exe dfd809f1edaf4727e7431eca0d74865c.exe PID 3248 wrote to memory of 1616 3248 dfd809f1edaf4727e7431eca0d74865c.exe dfd809f1edaf4727e7431eca0d74865c.exe PID 3248 wrote to memory of 1616 3248 dfd809f1edaf4727e7431eca0d74865c.exe dfd809f1edaf4727e7431eca0d74865c.exe PID 3248 wrote to memory of 1616 3248 dfd809f1edaf4727e7431eca0d74865c.exe dfd809f1edaf4727e7431eca0d74865c.exe PID 3248 wrote to memory of 1616 3248 dfd809f1edaf4727e7431eca0d74865c.exe dfd809f1edaf4727e7431eca0d74865c.exe PID 3248 wrote to memory of 1616 3248 dfd809f1edaf4727e7431eca0d74865c.exe dfd809f1edaf4727e7431eca0d74865c.exe PID 3248 wrote to memory of 1616 3248 dfd809f1edaf4727e7431eca0d74865c.exe dfd809f1edaf4727e7431eca0d74865c.exe PID 3248 wrote to memory of 1616 3248 dfd809f1edaf4727e7431eca0d74865c.exe dfd809f1edaf4727e7431eca0d74865c.exe PID 3248 wrote to memory of 1616 3248 dfd809f1edaf4727e7431eca0d74865c.exe dfd809f1edaf4727e7431eca0d74865c.exe PID 1616 wrote to memory of 4256 1616 dfd809f1edaf4727e7431eca0d74865c.exe svchost.exe PID 1616 wrote to memory of 4256 1616 dfd809f1edaf4727e7431eca0d74865c.exe svchost.exe PID 1616 wrote to memory of 4256 1616 dfd809f1edaf4727e7431eca0d74865c.exe svchost.exe PID 1616 wrote to memory of 4256 1616 dfd809f1edaf4727e7431eca0d74865c.exe svchost.exe PID 1616 wrote to memory of 4304 1616 dfd809f1edaf4727e7431eca0d74865c.exe explorer.exe PID 1616 wrote to memory of 4304 1616 dfd809f1edaf4727e7431eca0d74865c.exe explorer.exe PID 1616 wrote to memory of 4304 1616 dfd809f1edaf4727e7431eca0d74865c.exe explorer.exe PID 1616 wrote to memory of 4304 1616 dfd809f1edaf4727e7431eca0d74865c.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfd809f1edaf4727e7431eca0d74865c.exe"C:\Users\Admin\AppData\Local\Temp\dfd809f1edaf4727e7431eca0d74865c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dfd809f1edaf4727e7431eca0d74865c.exe"C:\Users\Admin\AppData\Local\Temp\dfd809f1edaf4727e7431eca0d74865c.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 4804⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 4884⤵
- Program crash
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4256 -ip 42561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4256 -ip 42561⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1616-10-0x0000000010000000-0x0000000010048000-memory.dmpFilesize
288KB
-
memory/1616-4-0x0000000010000000-0x0000000010048000-memory.dmpFilesize
288KB
-
memory/1616-5-0x0000000010000000-0x0000000010048000-memory.dmpFilesize
288KB
-
memory/1616-6-0x0000000010000000-0x0000000010048000-memory.dmpFilesize
288KB
-
memory/1616-7-0x0000000010000000-0x0000000010048000-memory.dmpFilesize
288KB
-
memory/3248-2-0x0000000000400000-0x0000000000534AA0-memory.dmpFilesize
1.2MB
-
memory/3248-0-0x0000000000400000-0x0000000000534AA0-memory.dmpFilesize
1.2MB
-
memory/3248-16-0x0000000000400000-0x0000000000534AA0-memory.dmpFilesize
1.2MB
-
memory/4256-8-0x0000000010000000-0x0000000010048000-memory.dmpFilesize
288KB
-
memory/4256-13-0x0000000010000000-0x0000000010048000-memory.dmpFilesize
288KB
-
memory/4304-14-0x0000000010000000-0x0000000010048000-memory.dmpFilesize
288KB
-
memory/4304-15-0x0000000010000000-0x0000000010048000-memory.dmpFilesize
288KB
-
memory/4304-9-0x0000000010000000-0x0000000010048000-memory.dmpFilesize
288KB
-
memory/4304-17-0x0000000010000000-0x0000000010048000-memory.dmpFilesize
288KB