Analysis
-
max time kernel
135s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09-10-2024 01:14
Behavioral task
behavioral1
Sample
962b8cb4bef3d875da5e5e3afdf845a293947162dc4c40466b7bed09c7982305.exe
Resource
win7-20240903-en
General
-
Target
962b8cb4bef3d875da5e5e3afdf845a293947162dc4c40466b7bed09c7982305.exe
-
Size
20KB
-
MD5
1cb71351313f803483081c2502c1f5ef
-
SHA1
0191cec46fe163f580a128525660243c0557154b
-
SHA256
962b8cb4bef3d875da5e5e3afdf845a293947162dc4c40466b7bed09c7982305
-
SHA512
dda100e5d859fdd80603f1fc48088dcfd897a0ea4e845116e8d2ef0e094e0a7254a657264688c84f52ee9cd738267d13661e41953232ca0cf3fa6e3d49d2b75d
-
SSDEEP
384:OIdmF+Ti213fEF9QZd/cBr5lholKKNW9j8MKy6Kli+9+b9eeOmZU+YG3l9PLR:OIsF81fG9QveThAxN+l3wb05mZQm
Malware Config
Extracted
xtremerat
kyfen200.no-ip.biz
kyfen.dyndns.biz
Signatures
-
Detect XtremeRAT payload 3 IoCs
resource yara_rule behavioral1/memory/2904-9-0x0000000000C80000-0x0000000000C96000-memory.dmp family_xtremerat behavioral1/memory/1552-10-0x0000000000C80000-0x0000000000C96000-memory.dmp family_xtremerat behavioral1/memory/2904-12-0x0000000000C80000-0x0000000000C96000-memory.dmp family_xtremerat -
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Users\\Admin\\AppData\\Roaming\\sys\\java.exe" 962b8cb4bef3d875da5e5e3afdf845a293947162dc4c40466b7bed09c7982305.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Users\\Admin\\AppData\\Roaming\\sys\\java.exe" 962b8cb4bef3d875da5e5e3afdf845a293947162dc4c40466b7bed09c7982305.exe -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\sys\\java.exe" 962b8cb4bef3d875da5e5e3afdf845a293947162dc4c40466b7bed09c7982305.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 962b8cb4bef3d875da5e5e3afdf845a293947162dc4c40466b7bed09c7982305.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\sys\\java.exe" 962b8cb4bef3d875da5e5e3afdf845a293947162dc4c40466b7bed09c7982305.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 962b8cb4bef3d875da5e5e3afdf845a293947162dc4c40466b7bed09c7982305.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{HYWGL685-V52A-6Q51-5231-62064138Y31T} 962b8cb4bef3d875da5e5e3afdf845a293947162dc4c40466b7bed09c7982305.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{HYWGL685-V52A-6Q51-5231-62064138Y31T}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\sys\\java.exe restart" 962b8cb4bef3d875da5e5e3afdf845a293947162dc4c40466b7bed09c7982305.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Server = "C:\\Users\\Admin\\AppData\\Roaming\\sys\\java.exe" 962b8cb4bef3d875da5e5e3afdf845a293947162dc4c40466b7bed09c7982305.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Server = "C:\\Users\\Admin\\AppData\\Roaming\\sys\\java.exe" 962b8cb4bef3d875da5e5e3afdf845a293947162dc4c40466b7bed09c7982305.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\sys\\java.exe" 962b8cb4bef3d875da5e5e3afdf845a293947162dc4c40466b7bed09c7982305.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\sys\\java.exe" 962b8cb4bef3d875da5e5e3afdf845a293947162dc4c40466b7bed09c7982305.exe -
resource yara_rule behavioral1/memory/1552-0-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral1/memory/2904-9-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral1/memory/1552-10-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral1/memory/2904-12-0x0000000000C80000-0x0000000000C96000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 962b8cb4bef3d875da5e5e3afdf845a293947162dc4c40466b7bed09c7982305.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2904 explorer.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1552 wrote to memory of 2904 1552 962b8cb4bef3d875da5e5e3afdf845a293947162dc4c40466b7bed09c7982305.exe 31 PID 1552 wrote to memory of 2904 1552 962b8cb4bef3d875da5e5e3afdf845a293947162dc4c40466b7bed09c7982305.exe 31 PID 1552 wrote to memory of 2904 1552 962b8cb4bef3d875da5e5e3afdf845a293947162dc4c40466b7bed09c7982305.exe 31 PID 1552 wrote to memory of 2904 1552 962b8cb4bef3d875da5e5e3afdf845a293947162dc4c40466b7bed09c7982305.exe 31 PID 1552 wrote to memory of 2904 1552 962b8cb4bef3d875da5e5e3afdf845a293947162dc4c40466b7bed09c7982305.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\962b8cb4bef3d875da5e5e3afdf845a293947162dc4c40466b7bed09c7982305.exe"C:\Users\Admin\AppData\Local\Temp\962b8cb4bef3d875da5e5e3afdf845a293947162dc4c40466b7bed09c7982305.exe"1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2904
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1