xtremerat | f8362987559c18f86c3140f587c9afe2fb672bf8e7c9cef72a40b023340ba1d6

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17-12-2024 16:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CyberGate Excel v2.5.5.1 - Trial/CyberGate Excel v2.5.5.1 - Trial/server.exe
Size

405KB
MD5

2bafc6be6147f7c66138becbde526cc0
SHA1

b756233a6e0b20278fedf1caa030f504e54a8384
SHA256

b693b56c3ed54d8e250c8a7347f421df3bbe097bdd581696624257c5c656b8a3
SHA512

59e1d61c735949045a41410904337603a9b93f0a6b7d64b5f288920442cb01f6015341dd570a8169e0bef4d631d3fd5a2b7990b8c5f47c1d2a51403e67c59eb2
SSDEEP

12288:VkqfGzfVnl6VCB+lHOWbtOBEtV1H8UTAti5:VkqfGhoAyx2Vc5

Score

10^/10

xtremerat discovery persistence rat spyware upx

Malware Config

Signatures

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Xtremerat family
xtremerat

Executes dropped EXE 1 IoCs

pid	Process
656	Server.exe

Loads dropped DLL 2 IoCs

pid	Process
2708	server.exe
2708	server.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 656 set thread context of 2172	656	Server.exe	67

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/memory/2172-24-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral3/memory/2172-23-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral3/memory/2172-20-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral3/memory/2172-27-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral3/memory/2172-28-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral3/memory/2172-29-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral3/memory/2172-31-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral3/memory/2172-33-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral3/memory/2172-30-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral3/memory/2172-37-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral3/memory/2172-36-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral3/memory/2172-40-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral3/memory/2172-41-0x0000000001610000-0x0000000001720000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InstallDir\Server.exe	server.exe
File created	C:\Windows\InstallDir\Server.exe	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2172	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2708	server.exe
2172	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2888	2708	server.exe	31
PID 2708 wrote to memory of 2888	2708	server.exe	31
PID 2708 wrote to memory of 2888	2708	server.exe	31
PID 2708 wrote to memory of 2888	2708	server.exe	31
PID 2708 wrote to memory of 2164	2708	server.exe	32
PID 2708 wrote to memory of 2164	2708	server.exe	32
PID 2708 wrote to memory of 2164	2708	server.exe	32
PID 2708 wrote to memory of 2164	2708	server.exe	32
PID 2708 wrote to memory of 2752	2708	server.exe	33
PID 2708 wrote to memory of 2752	2708	server.exe	33
PID 2708 wrote to memory of 2752	2708	server.exe	33
PID 2708 wrote to memory of 2752	2708	server.exe	33
PID 2708 wrote to memory of 2728	2708	server.exe	34
PID 2708 wrote to memory of 2728	2708	server.exe	34
PID 2708 wrote to memory of 2728	2708	server.exe	34
PID 2708 wrote to memory of 2728	2708	server.exe	34
PID 2708 wrote to memory of 2904	2708	server.exe	35
PID 2708 wrote to memory of 2904	2708	server.exe	35
PID 2708 wrote to memory of 2904	2708	server.exe	35
PID 2708 wrote to memory of 2904	2708	server.exe	35
PID 2708 wrote to memory of 2736	2708	server.exe	36
PID 2708 wrote to memory of 2736	2708	server.exe	36
PID 2708 wrote to memory of 2736	2708	server.exe	36
PID 2708 wrote to memory of 2736	2708	server.exe	36
PID 2708 wrote to memory of 2900	2708	server.exe	37
PID 2708 wrote to memory of 2900	2708	server.exe	37
PID 2708 wrote to memory of 2900	2708	server.exe	37
PID 2708 wrote to memory of 2900	2708	server.exe	37
PID 2708 wrote to memory of 2764	2708	server.exe	38
PID 2708 wrote to memory of 2764	2708	server.exe	38
PID 2708 wrote to memory of 2764	2708	server.exe	38
PID 2708 wrote to memory of 2764	2708	server.exe	38
PID 2708 wrote to memory of 2636	2708	server.exe	39
PID 2708 wrote to memory of 2636	2708	server.exe	39
PID 2708 wrote to memory of 2636	2708	server.exe	39
PID 2708 wrote to memory of 2636	2708	server.exe	39
PID 2708 wrote to memory of 2836	2708	server.exe	40
PID 2708 wrote to memory of 2836	2708	server.exe	40
PID 2708 wrote to memory of 2836	2708	server.exe	40
PID 2708 wrote to memory of 2836	2708	server.exe	40
PID 2708 wrote to memory of 2960	2708	server.exe	41
PID 2708 wrote to memory of 2960	2708	server.exe	41
PID 2708 wrote to memory of 2960	2708	server.exe	41
PID 2708 wrote to memory of 2960	2708	server.exe	41
PID 2708 wrote to memory of 2624	2708	server.exe	42
PID 2708 wrote to memory of 2624	2708	server.exe	42
PID 2708 wrote to memory of 2624	2708	server.exe	42
PID 2708 wrote to memory of 2624	2708	server.exe	42
PID 2708 wrote to memory of 2628	2708	server.exe	43
PID 2708 wrote to memory of 2628	2708	server.exe	43
PID 2708 wrote to memory of 2628	2708	server.exe	43
PID 2708 wrote to memory of 2628	2708	server.exe	43
PID 2708 wrote to memory of 1296	2708	server.exe	44
PID 2708 wrote to memory of 1296	2708	server.exe	44
PID 2708 wrote to memory of 1296	2708	server.exe	44
PID 2708 wrote to memory of 1296	2708	server.exe	44
PID 2708 wrote to memory of 2768	2708	server.exe	45
PID 2708 wrote to memory of 2768	2708	server.exe	45
PID 2708 wrote to memory of 2768	2708	server.exe	45
PID 2708 wrote to memory of 2768	2708	server.exe	45
PID 2708 wrote to memory of 2772	2708	server.exe	46
PID 2708 wrote to memory of 2772	2708	server.exe	46
PID 2708 wrote to memory of 2772	2708	server.exe	46
PID 2708 wrote to memory of 2772	2708	server.exe	46

C:\Users\Admin\AppData\Local\Temp\CyberGate Excel v2.5.5.1 - Trial\CyberGate Excel v2.5.5.1 - Trial\server.exe
"C:\Users\Admin\AppData\Local\Temp\CyberGate Excel v2.5.5.1 - Trial\CyberGate Excel v2.5.5.1 - Trial\server.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:2888
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:2164
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:2752
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:2728
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:2904
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:2736
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:2900
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:2764
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:2636
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:2836
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:2960
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:2624
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:2628
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:1296
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:2768
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:2772
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:2656
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:2716
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:2600
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:2596
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:2616
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:2632
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:2668
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:2680
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:2020
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:2044
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:2408
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:2652
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:2332
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:2448
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:1644
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:832
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:748
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:1484
- C:\Windows\InstallDir\Server.exe
  "C:\Windows\InstallDir\Server.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:656
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2640
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex))\((Mutex)).dat

Filesize
2B

MD5
93e00066d099c0485cfffa1359246d26

SHA1
bc69a773f37b2f2071e25f755a66d47b871e5d98

SHA256
3b271649a94ad5be4ef46ecbb6a4e7363e8498b7e69b751737bf30df2e0d1dde

SHA512
d3dfe508cacae7d36f13908134b5b438b87429fcf93ccb060bcfa346c04633a99e9ca497297418c969537be1da2405171982794055dd0f52e59a82720d3b3d02

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex))\((Mutex)).nfo

Filesize
3KB

MD5
257520aab7515e748d6f7893bc87e7be

SHA1
49b066be656987fc7e33cddabc81a3f12c526a86

SHA256
fbe2e0cd983429ef80df2fe355c16afec5368abe65fe0a0fa5be87f7a5972b83

SHA512
fb7123df69510176523e35bdf8c29d7a4f0bf8e6e02970b365377791c7e9a77fdf8adc187d6480fadaf61dca9324b4b1f2b64f2a0e7b58a6c348292f4b9be9c0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex))\((Mutex)).svr

Filesize
358KB

MD5
00671f81b85f89f4d846ec178eeff6cb

SHA1
c1809712719f84aa6e0ad8cc5ec20cd62aca615a

SHA256
f4498728dc99d4e0f67d9c0c3a0272b75f5c9b5e2680e0d7e2a4d8bef9da1b4c

SHA512
b31813a82e61d645c32e4f24337803d4ef045439bacc3401d0f724a5ae58d1fa9c17495f7678b09fb3c312f4c012e39f783ee2924461f72b2a05edaea6a4f39c

Download Submit
\Windows\InstallDir\Server.exe

Filesize
405KB

MD5
2bafc6be6147f7c66138becbde526cc0

SHA1
b756233a6e0b20278fedf1caa030f504e54a8384

SHA256
b693b56c3ed54d8e250c8a7347f421df3bbe097bdd581696624257c5c656b8a3

SHA512
59e1d61c735949045a41410904337603a9b93f0a6b7d64b5f288920442cb01f6015341dd570a8169e0bef4d631d3fd5a2b7990b8c5f47c1d2a51403e67c59eb2

Download Submit
memory/656-39-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2172-23-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/2172-33-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/2172-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2172-27-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/2172-28-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/2172-29-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/2172-31-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/2172-20-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/2172-30-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/2172-41-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/2172-24-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/2172-37-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/2172-36-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/2172-19-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/2172-40-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/2708-34-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download