Analysis
-
max time kernel
98s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02-11-2024 11:54
Behavioral task
behavioral1
Sample
805e2e5812ae75d314a2dffa9cfee1bf294b6da97683567af10ee461e99310bfN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
805e2e5812ae75d314a2dffa9cfee1bf294b6da97683567af10ee461e99310bfN.exe
Resource
win10v2004-20241007-en
General
-
Target
805e2e5812ae75d314a2dffa9cfee1bf294b6da97683567af10ee461e99310bfN.exe
-
Size
81KB
-
MD5
7d6e7347cf449c0d2344ee79c6e3f1d0
-
SHA1
d0765fe7b18a52e47f4c38a9a705dcfbcdb2dbda
-
SHA256
805e2e5812ae75d314a2dffa9cfee1bf294b6da97683567af10ee461e99310bf
-
SHA512
331e043a108f1eeaca03981510f28d04d5d2a0abd6cfc74773d98cb8c94f8e8ffd8c40672846f99df3da5ff52573c725041db9c691b9ef57926c881cdbddf292
-
SSDEEP
1536:3T8qDqQ8K9MK3tGjbNwPZ6oIeXHWTlNNX3RfEfE:DqMyKdcPeXHW5Jcs
Malware Config
Signatures
-
Detect XtremeRAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3888-0-0x0000000010000000-0x000000001004C000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Xtremerat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
805e2e5812ae75d314a2dffa9cfee1bf294b6da97683567af10ee461e99310bfN.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 805e2e5812ae75d314a2dffa9cfee1bf294b6da97683567af10ee461e99310bfN.exe