Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2024 11:58
Static task
static1
Behavioral task
behavioral1
Sample
e19d71889327306d67795d3a09028b2e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e19d71889327306d67795d3a09028b2e.exe
Resource
win10v2004-20240226-en
General
-
Target
e19d71889327306d67795d3a09028b2e.exe
-
Size
188KB
-
MD5
e19d71889327306d67795d3a09028b2e
-
SHA1
d8082f4ee84afae2d377474448ed000a399268df
-
SHA256
9226d54108c1d3e1539d0ab34a9785d498b1f35a03d957214d1f0b4873d997ba
-
SHA512
427f4d02ce54de7a98003089a1a14d701c771129587e4ec5d2975b41abf7f63dcaa3d1c985f85b00f2c850a0abe5c69897ece72e11858fb834e29f7d6a90d850
-
SSDEEP
3072:tHRjk+BeS0lG19lET8Vr8CQwu0hxb7s96HM0XUGXU2Fo21364EoiJeeI+StSqYLW:Hk+BJ0lGwk4CQwJx/AnVW5GJZ2tNYLjy
Malware Config
Extracted
xtremerat
godfatherbebers.no-ip.biz
Signatures
-
Detect XtremeRAT payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/2400-34-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral2/memory/2400-35-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral2/memory/1760-36-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral2/memory/2400-37-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral2/memory/1760-38-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Processes:
resource yara_rule behavioral2/memory/2400-24-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral2/memory/2400-33-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral2/memory/2400-34-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral2/memory/2400-35-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral2/memory/1760-36-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral2/memory/2400-37-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral2/memory/1760-38-0x0000000010000000-0x000000001004D000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e19d71889327306d67795d3a09028b2e.exedescription pid process target process PID 1840 set thread context of 2400 1840 e19d71889327306d67795d3a09028b2e.exe e19d71889327306d67795d3a09028b2e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 536 1760 WerFault.exe svchost.exe 3028 1760 WerFault.exe svchost.exe -
Modifies registry class 3 IoCs
Processes:
e19d71889327306d67795d3a09028b2e.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" e19d71889327306d67795d3a09028b2e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key e19d71889327306d67795d3a09028b2e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ e19d71889327306d67795d3a09028b2e.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
e19d71889327306d67795d3a09028b2e.exepid process 1840 e19d71889327306d67795d3a09028b2e.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
e19d71889327306d67795d3a09028b2e.exee19d71889327306d67795d3a09028b2e.exedescription pid process target process PID 1840 wrote to memory of 2400 1840 e19d71889327306d67795d3a09028b2e.exe e19d71889327306d67795d3a09028b2e.exe PID 1840 wrote to memory of 2400 1840 e19d71889327306d67795d3a09028b2e.exe e19d71889327306d67795d3a09028b2e.exe PID 1840 wrote to memory of 2400 1840 e19d71889327306d67795d3a09028b2e.exe e19d71889327306d67795d3a09028b2e.exe PID 1840 wrote to memory of 2400 1840 e19d71889327306d67795d3a09028b2e.exe e19d71889327306d67795d3a09028b2e.exe PID 1840 wrote to memory of 2400 1840 e19d71889327306d67795d3a09028b2e.exe e19d71889327306d67795d3a09028b2e.exe PID 1840 wrote to memory of 2400 1840 e19d71889327306d67795d3a09028b2e.exe e19d71889327306d67795d3a09028b2e.exe PID 1840 wrote to memory of 2400 1840 e19d71889327306d67795d3a09028b2e.exe e19d71889327306d67795d3a09028b2e.exe PID 1840 wrote to memory of 2400 1840 e19d71889327306d67795d3a09028b2e.exe e19d71889327306d67795d3a09028b2e.exe PID 2400 wrote to memory of 1760 2400 e19d71889327306d67795d3a09028b2e.exe svchost.exe PID 2400 wrote to memory of 1760 2400 e19d71889327306d67795d3a09028b2e.exe svchost.exe PID 2400 wrote to memory of 1760 2400 e19d71889327306d67795d3a09028b2e.exe svchost.exe PID 2400 wrote to memory of 1760 2400 e19d71889327306d67795d3a09028b2e.exe svchost.exe PID 2400 wrote to memory of 1492 2400 e19d71889327306d67795d3a09028b2e.exe msedge.exe PID 2400 wrote to memory of 1492 2400 e19d71889327306d67795d3a09028b2e.exe msedge.exe PID 2400 wrote to memory of 1492 2400 e19d71889327306d67795d3a09028b2e.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e19d71889327306d67795d3a09028b2e.exe"C:\Users\Admin\AppData\Local\Temp\e19d71889327306d67795d3a09028b2e.exe"1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\e19d71889327306d67795d3a09028b2e.exeC:\Users\Admin\AppData\Local\Temp\e19d71889327306d67795d3a09028b2e.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵PID:1760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 4724⤵
- Program crash
PID:536 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 4884⤵
- Program crash
PID:3028 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵PID:1492
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1760 -ip 17601⤵PID:4828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1760 -ip 17601⤵PID:1404
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3856 --field-trial-handle=3084,i,11997299123381683778,5904351605020331957,262144 --variations-seed-version /prefetch:81⤵PID:3660
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1760-36-0x0000000010000000-0x000000001004D000-memory.dmpFilesize
308KB
-
memory/1760-38-0x0000000010000000-0x000000001004D000-memory.dmpFilesize
308KB
-
memory/1840-20-0x0000000002BD0000-0x0000000002BD1000-memory.dmpFilesize
4KB
-
memory/1840-10-0x0000000002BE0000-0x0000000002BE1000-memory.dmpFilesize
4KB
-
memory/1840-3-0x0000000002BD0000-0x0000000002BD1000-memory.dmpFilesize
4KB
-
memory/1840-6-0x0000000002BE0000-0x0000000002BE1000-memory.dmpFilesize
4KB
-
memory/1840-0-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/1840-8-0x0000000002BE0000-0x0000000002BE1000-memory.dmpFilesize
4KB
-
memory/1840-9-0x0000000002BE0000-0x0000000002BE1000-memory.dmpFilesize
4KB
-
memory/1840-21-0x0000000000760000-0x0000000000770000-memory.dmpFilesize
64KB
-
memory/1840-11-0x0000000002BD0000-0x0000000002BD1000-memory.dmpFilesize
4KB
-
memory/1840-22-0x0000000002320000-0x0000000002321000-memory.dmpFilesize
4KB
-
memory/1840-13-0x0000000002BD0000-0x0000000002BD1000-memory.dmpFilesize
4KB
-
memory/1840-14-0x0000000002BD0000-0x0000000002BD1000-memory.dmpFilesize
4KB
-
memory/1840-16-0x0000000002BD0000-0x0000000002BD1000-memory.dmpFilesize
4KB
-
memory/1840-17-0x0000000002BD0000-0x0000000002BD1000-memory.dmpFilesize
4KB
-
memory/1840-18-0x0000000002BD0000-0x0000000002BD1000-memory.dmpFilesize
4KB
-
memory/1840-19-0x0000000002BD0000-0x0000000002BD1000-memory.dmpFilesize
4KB
-
memory/1840-7-0x0000000002BE0000-0x0000000002BE1000-memory.dmpFilesize
4KB
-
memory/1840-5-0x0000000002BE0000-0x0000000002BE1000-memory.dmpFilesize
4KB
-
memory/1840-12-0x0000000002BD0000-0x0000000002BD1000-memory.dmpFilesize
4KB
-
memory/1840-1-0x0000000002330000-0x0000000002331000-memory.dmpFilesize
4KB
-
memory/1840-23-0x00000000005F0000-0x00000000005F1000-memory.dmpFilesize
4KB
-
memory/1840-26-0x0000000002BC0000-0x0000000002BC1000-memory.dmpFilesize
4KB
-
memory/1840-25-0x0000000000750000-0x0000000000751000-memory.dmpFilesize
4KB
-
memory/1840-28-0x0000000002350000-0x0000000002351000-memory.dmpFilesize
4KB
-
memory/1840-29-0x0000000002BE0000-0x0000000002BE1000-memory.dmpFilesize
4KB
-
memory/1840-30-0x0000000002BD0000-0x0000000002BD1000-memory.dmpFilesize
4KB
-
memory/1840-31-0x0000000002360000-0x0000000002361000-memory.dmpFilesize
4KB
-
memory/1840-32-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/1840-2-0x0000000002340000-0x0000000002341000-memory.dmpFilesize
4KB
-
memory/2400-34-0x0000000010000000-0x000000001004D000-memory.dmpFilesize
308KB
-
memory/2400-35-0x0000000010000000-0x000000001004D000-memory.dmpFilesize
308KB
-
memory/2400-33-0x0000000010000000-0x000000001004D000-memory.dmpFilesize
308KB
-
memory/2400-37-0x0000000010000000-0x000000001004D000-memory.dmpFilesize
308KB
-
memory/2400-24-0x0000000010000000-0x000000001004D000-memory.dmpFilesize
308KB