Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2024 04:18
Static task
static1
Behavioral task
behavioral1
Sample
e0bff9dee51b34004b7f60c45c72275a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e0bff9dee51b34004b7f60c45c72275a.exe
Resource
win10v2004-20240226-en
General
-
Target
e0bff9dee51b34004b7f60c45c72275a.exe
-
Size
49KB
-
MD5
e0bff9dee51b34004b7f60c45c72275a
-
SHA1
d51da51a598b247be0c568a0bd3e1ce7cc903c1c
-
SHA256
735b71185875369df7ce0a10b5ec5406b387bb15aea870e54074be35330e4782
-
SHA512
2ba9e4b445518d0031ca95e76c6390accdcb04dcb5b11d4f57d1e1613e68844760b1c94a2da508794586ed4cad0f5dddf4e465349bfe5159a58d9e0ab898035b
-
SSDEEP
768:bZOHoR5H/z3eKQSWFzxG6pEAihXCHMsF8ltMxuvsMgbVxFsfWTaCO25ij:leo//Q9LRv39uvt8VYfuaCij
Malware Config
Signatures
-
Detect XtremeRAT payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/1672-10-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/1672-11-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/2144-18-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/2304-20-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/1672-21-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/2304-23-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
e0bff9dee51b34004b7f60c45c72275a.exesvchost.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} e0bff9dee51b34004b7f60c45c72275a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\InstallDir\\lsass.exe restart" e0bff9dee51b34004b7f60c45c72275a.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\InstallDir\\lsass.exe" svchost.exe -
Processes:
resource yara_rule behavioral2/memory/1672-6-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/1672-9-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/1672-10-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/1672-11-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/2144-18-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/2304-20-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/1672-21-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/2304-23-0x0000000000C80000-0x0000000000C95000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
e0bff9dee51b34004b7f60c45c72275a.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Local\\Temp\\InstallDir\\lsass.exe" e0bff9dee51b34004b7f60c45c72275a.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Local\\Temp\\InstallDir\\lsass.exe" e0bff9dee51b34004b7f60c45c72275a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Local\\Temp\\InstallDir\\lsass.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Local\\Temp\\InstallDir\\lsass.exe" svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e0bff9dee51b34004b7f60c45c72275a.exedescription pid process target process PID 2828 set thread context of 1672 2828 e0bff9dee51b34004b7f60c45c72275a.exe e0bff9dee51b34004b7f60c45c72275a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NTFS ADS 1 IoCs
Processes:
e0bff9dee51b34004b7f60c45c72275a.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Temp\OLE1EmbedStrm.wav:Zone.Identifier e0bff9dee51b34004b7f60c45c72275a.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
e0bff9dee51b34004b7f60c45c72275a.exeexplorer.exepid process 2828 e0bff9dee51b34004b7f60c45c72275a.exe 2304 explorer.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
e0bff9dee51b34004b7f60c45c72275a.exee0bff9dee51b34004b7f60c45c72275a.exedescription pid process target process PID 2828 wrote to memory of 1672 2828 e0bff9dee51b34004b7f60c45c72275a.exe e0bff9dee51b34004b7f60c45c72275a.exe PID 2828 wrote to memory of 1672 2828 e0bff9dee51b34004b7f60c45c72275a.exe e0bff9dee51b34004b7f60c45c72275a.exe PID 2828 wrote to memory of 1672 2828 e0bff9dee51b34004b7f60c45c72275a.exe e0bff9dee51b34004b7f60c45c72275a.exe PID 2828 wrote to memory of 1672 2828 e0bff9dee51b34004b7f60c45c72275a.exe e0bff9dee51b34004b7f60c45c72275a.exe PID 2828 wrote to memory of 1672 2828 e0bff9dee51b34004b7f60c45c72275a.exe e0bff9dee51b34004b7f60c45c72275a.exe PID 2828 wrote to memory of 1672 2828 e0bff9dee51b34004b7f60c45c72275a.exe e0bff9dee51b34004b7f60c45c72275a.exe PID 2828 wrote to memory of 1672 2828 e0bff9dee51b34004b7f60c45c72275a.exe e0bff9dee51b34004b7f60c45c72275a.exe PID 2828 wrote to memory of 1672 2828 e0bff9dee51b34004b7f60c45c72275a.exe e0bff9dee51b34004b7f60c45c72275a.exe PID 1672 wrote to memory of 2144 1672 e0bff9dee51b34004b7f60c45c72275a.exe svchost.exe PID 1672 wrote to memory of 2144 1672 e0bff9dee51b34004b7f60c45c72275a.exe svchost.exe PID 1672 wrote to memory of 2144 1672 e0bff9dee51b34004b7f60c45c72275a.exe svchost.exe PID 1672 wrote to memory of 2144 1672 e0bff9dee51b34004b7f60c45c72275a.exe svchost.exe PID 1672 wrote to memory of 2304 1672 e0bff9dee51b34004b7f60c45c72275a.exe explorer.exe PID 1672 wrote to memory of 2304 1672 e0bff9dee51b34004b7f60c45c72275a.exe explorer.exe PID 1672 wrote to memory of 2304 1672 e0bff9dee51b34004b7f60c45c72275a.exe explorer.exe PID 1672 wrote to memory of 2304 1672 e0bff9dee51b34004b7f60c45c72275a.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0bff9dee51b34004b7f60c45c72275a.exe"C:\Users\Admin\AppData\Local\Temp\e0bff9dee51b34004b7f60c45c72275a.exe"1⤵
- Suspicious use of SetThreadContext
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e0bff9dee51b34004b7f60c45c72275a.exe"C:\Users\Admin\AppData\Local\Temp\e0bff9dee51b34004b7f60c45c72275a.exe"2⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\InstallDir\lsass.exeFilesize
49KB
MD5e0bff9dee51b34004b7f60c45c72275a
SHA1d51da51a598b247be0c568a0bd3e1ce7cc903c1c
SHA256735b71185875369df7ce0a10b5ec5406b387bb15aea870e54074be35330e4782
SHA5122ba9e4b445518d0031ca95e76c6390accdcb04dcb5b11d4f57d1e1613e68844760b1c94a2da508794586ed4cad0f5dddf4e465349bfe5159a58d9e0ab898035b
-
memory/1672-6-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/1672-9-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/1672-10-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/1672-11-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/1672-21-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/2144-18-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/2304-20-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/2304-23-0x0000000000C80000-0x0000000000C95000-memory.dmpFilesize
84KB
-
memory/2828-0-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2828-1-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2828-12-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB