Behavioral task
behavioral1
Sample
309047c3b6edcf4488e17663e61f11c7a399dbd462e1315c0f1891ff80b2514dN.exe
Resource
win7-20240903-en
General
-
Target
309047c3b6edcf4488e17663e61f11c7a399dbd462e1315c0f1891ff80b2514dN
-
Size
376KB
-
MD5
3d84e7f15f1562ecca7d53ad3434b7b0
-
SHA1
4b80e73a0913dfb5834d0c8c5a3dec13c83402ea
-
SHA256
309047c3b6edcf4488e17663e61f11c7a399dbd462e1315c0f1891ff80b2514d
-
SHA512
45391d8fd3e1d4374118832371191928fd3d704512df7c0fb88fca5d471329f1f5b33c3205369c0c81f3f58ffbefffbb93d2b18aa6eb56f307973513b4ff5f24
-
SSDEEP
768:NMuijtHfPN8m1Sq4NQErBsH1tzoisBKQI6dObAG/dq8uW29Ifnca/yyR+P2ujfGS:mNPpsq+QV4rObAdXWpf/y+4oJuMc
Malware Config
Signatures
-
Detect XtremeRAT payload 1 IoCs
resource yara_rule sample family_xtremerat -
Xtremerat family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 309047c3b6edcf4488e17663e61f11c7a399dbd462e1315c0f1891ff80b2514dN
Files
-
309047c3b6edcf4488e17663e61f11c7a399dbd462e1315c0f1891ff80b2514dN.exe windows:4 windows x86 arch:x86
54d337e45f6015e5ce82372bfb9e9750
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
lstrlenW
WriteProcessMemory
WriteFile
WaitForSingleObject
VirtualProtectEx
VirtualFreeEx
VirtualFree
VirtualAllocEx
VirtualAlloc
TerminateThread
TerminateProcess
Sleep
SizeofResource
SetThreadPriority
SetThreadContext
SetFilePointer
SetFileAttributesW
SetEvent
SetErrorMode
SetEndOfFile
ResumeThread
ReadProcessMemory
ReadFile
LockResource
LoadResource
LoadLibraryA
InitializeCriticalSection
GlobalUnlock
GlobalSize
GlobalLock
GetWindowsDirectoryW
GetThreadContext
GetTempPathW
GetSystemDirectoryW
GetModuleHandleA
GetModuleFileNameW
GetLocalTime
GetLastError
GetFileSize
GetFileAttributesW
GetCommandLineW
FreeResource
InterlockedIncrement
InterlockedDecrement
FindResourceW
FindFirstFileW
FindClose
ExitProcess
DeleteFileW
DeleteCriticalSection
CreateThread
CreateRemoteThread
CreateProcessW
CreateMutexW
CreateFileW
CreateEventA
CreateDirectoryW
CopyFileW
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
GetThreadLocale
GetStartupInfoA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
ExitProcess
ExitThread
CreateThread
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
advapi32
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyW
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
ntdll
NtUnmapViewOfSection
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
shell32
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetMalloc
FindExecutableW
ShellExecuteW
shlwapi
SHDeleteKeyW
SHDeleteValueW
SHDeleteKeyW
urlmon
URLDownloadToCacheFileW
user32
CreateWindowExW
CreateWindowExA
UnregisterClassW
UnregisterClassA
UnhookWindowsHookEx
TranslateMessage
ShowWindow
SetWindowsHookExW
SetWindowLongA
SetClipboardViewer
SendMessageA
RegisterWindowMessageW
RegisterClassW
RegisterClassA
PostMessageA
PeekMessageA
OpenClipboard
MapVirtualKeyW
GetWindowThreadProcessId
GetWindowTextW
GetWindowRect
GetWindowLongA
GetMessageA
GetKeyboardLayout
GetKeyState
GetForegroundWindow
GetDesktopWindow
GetClipboardData
GetClassInfoA
DispatchMessageA
DestroyWindow
DefWindowProcA
CloseClipboard
CharUpperW
CharNextW
CharLowerW
CallNextHookEx
GetKeyboardType
MessageBoxA
GetKeyboardState
ToUnicodeEx
wininet
InternetCloseHandle
FtpPutFileW
FtpSetCurrentDirectoryW
InternetOpenW
InternetConnectW
Sections
UPX0 Size: 268KB - Virtual size: 268KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE