Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
18-07-2024 02:06
Static task
static1
Behavioral task
behavioral1
Sample
502ae462005b7647f8c1a2a683eb5034.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
502ae462005b7647f8c1a2a683eb5034.exe
Resource
win10v2004-20240709-en
General
-
Target
502ae462005b7647f8c1a2a683eb5034.exe
-
Size
44KB
-
MD5
502ae462005b7647f8c1a2a683eb5034
-
SHA1
7522c6a9e67ced3bff963fc36bd21960229fdd8d
-
SHA256
143ae408ab18bc067f24a5f3dcef29438cd220c63cf80333c339583c5bbbd32a
-
SHA512
0a7608e8a7b7e1ade535d13b00b267bd2c0b5dd5485c4ea80f354a6503e6e2f6485b0e39b43be96af4a12c4150851c9699b5b5315eb364b52b0768972f5aa55f
-
SSDEEP
768:YB4IELmCfJj11ty2GRxvDxLSAHDMl4eSWc+sDCbzX/ZeZnAo:ijgbgxvDkaDM7TXBW
Malware Config
Signatures
-
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
502ae462005b7647f8c1a2a683eb5034.exedescription pid Process procid_target PID 2648 set thread context of 15756 2648 502ae462005b7647f8c1a2a683eb5034.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
502ae462005b7647f8c1a2a683eb5034.exe502ae462005b7647f8c1a2a683eb5034.exedescription pid Process procid_target PID 2648 wrote to memory of 15756 2648 502ae462005b7647f8c1a2a683eb5034.exe 30 PID 2648 wrote to memory of 15756 2648 502ae462005b7647f8c1a2a683eb5034.exe 30 PID 2648 wrote to memory of 15756 2648 502ae462005b7647f8c1a2a683eb5034.exe 30 PID 2648 wrote to memory of 15756 2648 502ae462005b7647f8c1a2a683eb5034.exe 30 PID 2648 wrote to memory of 15756 2648 502ae462005b7647f8c1a2a683eb5034.exe 30 PID 2648 wrote to memory of 15756 2648 502ae462005b7647f8c1a2a683eb5034.exe 30 PID 2648 wrote to memory of 15756 2648 502ae462005b7647f8c1a2a683eb5034.exe 30 PID 2648 wrote to memory of 15756 2648 502ae462005b7647f8c1a2a683eb5034.exe 30 PID 15756 wrote to memory of 15812 15756 502ae462005b7647f8c1a2a683eb5034.exe 31 PID 15756 wrote to memory of 15812 15756 502ae462005b7647f8c1a2a683eb5034.exe 31 PID 15756 wrote to memory of 15812 15756 502ae462005b7647f8c1a2a683eb5034.exe 31 PID 15756 wrote to memory of 15812 15756 502ae462005b7647f8c1a2a683eb5034.exe 31 PID 15756 wrote to memory of 15812 15756 502ae462005b7647f8c1a2a683eb5034.exe 31 PID 15756 wrote to memory of 15840 15756 502ae462005b7647f8c1a2a683eb5034.exe 32 PID 15756 wrote to memory of 15840 15756 502ae462005b7647f8c1a2a683eb5034.exe 32 PID 15756 wrote to memory of 15840 15756 502ae462005b7647f8c1a2a683eb5034.exe 32 PID 15756 wrote to memory of 15840 15756 502ae462005b7647f8c1a2a683eb5034.exe 32 PID 15756 wrote to memory of 15840 15756 502ae462005b7647f8c1a2a683eb5034.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\502ae462005b7647f8c1a2a683eb5034.exe"C:\Users\Admin\AppData\Local\Temp\502ae462005b7647f8c1a2a683eb5034.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\502ae462005b7647f8c1a2a683eb5034.exe"C:\Users\Admin\AppData\Local\Temp\502ae462005b7647f8c1a2a683eb5034.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:15756 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵PID:15812
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:15840
-
-