xtremerat | f8362987559c18f86c3140f587c9afe2fb672bf8e7c9cef72a40b023340ba1d6

Analysis

max time kernel
94s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-12-2024 16:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CyberGate Excel v2.5.5.1 - Trial/CyberGate Excel v2.5.5.1 - Trial/server.exe
Size

405KB
MD5

2bafc6be6147f7c66138becbde526cc0
SHA1

b756233a6e0b20278fedf1caa030f504e54a8384
SHA256

b693b56c3ed54d8e250c8a7347f421df3bbe097bdd581696624257c5c656b8a3
SHA512

59e1d61c735949045a41410904337603a9b93f0a6b7d64b5f288920442cb01f6015341dd570a8169e0bef4d631d3fd5a2b7990b8c5f47c1d2a51403e67c59eb2
SSDEEP

12288:VkqfGzfVnl6VCB+lHOWbtOBEtV1H8UTAti5:VkqfGhoAyx2Vc5

Score

10^/10

xtremerat discovery persistence rat spyware upx

Malware Config

Signatures

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Xtremerat family
xtremerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	server.exe

Executes dropped EXE 1 IoCs

pid	Process
4092	Server.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	server.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4092 set thread context of 2840	4092	Server.exe	119

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/memory/2840-18-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral4/memory/2840-20-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral4/memory/2840-19-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral4/memory/2840-22-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral4/memory/2840-24-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral4/memory/2840-23-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral4/memory/2840-26-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral4/memory/2840-27-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral4/memory/2840-28-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral4/memory/2840-25-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral4/memory/2840-31-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral4/memory/2840-30-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral4/memory/2840-35-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral4/memory/2840-36-0x0000000001610000-0x0000000001720000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\InstallDir\Server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2840	explorer.exe
2840	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3212	server.exe
2840	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 4436	3212	server.exe	81
PID 3212 wrote to memory of 4436	3212	server.exe	81
PID 3212 wrote to memory of 2300	3212	server.exe	82
PID 3212 wrote to memory of 2300	3212	server.exe	82
PID 3212 wrote to memory of 2300	3212	server.exe	82
PID 3212 wrote to memory of 524	3212	server.exe	83
PID 3212 wrote to memory of 524	3212	server.exe	83
PID 3212 wrote to memory of 4004	3212	server.exe	84
PID 3212 wrote to memory of 4004	3212	server.exe	84
PID 3212 wrote to memory of 4004	3212	server.exe	84
PID 3212 wrote to memory of 4576	3212	server.exe	85
PID 3212 wrote to memory of 4576	3212	server.exe	85
PID 3212 wrote to memory of 5060	3212	server.exe	86
PID 3212 wrote to memory of 5060	3212	server.exe	86
PID 3212 wrote to memory of 5060	3212	server.exe	86
PID 3212 wrote to memory of 4000	3212	server.exe	87
PID 3212 wrote to memory of 4000	3212	server.exe	87
PID 3212 wrote to memory of 4152	3212	server.exe	88
PID 3212 wrote to memory of 4152	3212	server.exe	88
PID 3212 wrote to memory of 4152	3212	server.exe	88
PID 3212 wrote to memory of 2428	3212	server.exe	91
PID 3212 wrote to memory of 2428	3212	server.exe	91
PID 3212 wrote to memory of 3580	3212	server.exe	92
PID 3212 wrote to memory of 3580	3212	server.exe	92
PID 3212 wrote to memory of 3580	3212	server.exe	92
PID 3212 wrote to memory of 4592	3212	server.exe	93
PID 3212 wrote to memory of 4592	3212	server.exe	93
PID 3212 wrote to memory of 4140	3212	server.exe	94
PID 3212 wrote to memory of 4140	3212	server.exe	94
PID 3212 wrote to memory of 4140	3212	server.exe	94
PID 3212 wrote to memory of 1000	3212	server.exe	95
PID 3212 wrote to memory of 1000	3212	server.exe	95
PID 3212 wrote to memory of 4640	3212	server.exe	96
PID 3212 wrote to memory of 4640	3212	server.exe	96
PID 3212 wrote to memory of 4640	3212	server.exe	96
PID 3212 wrote to memory of 8	3212	server.exe	97
PID 3212 wrote to memory of 8	3212	server.exe	97
PID 3212 wrote to memory of 112	3212	server.exe	98
PID 3212 wrote to memory of 112	3212	server.exe	98
PID 3212 wrote to memory of 112	3212	server.exe	98
PID 3212 wrote to memory of 3396	3212	server.exe	99
PID 3212 wrote to memory of 3396	3212	server.exe	99
PID 3212 wrote to memory of 4380	3212	server.exe	100
PID 3212 wrote to memory of 4380	3212	server.exe	100
PID 3212 wrote to memory of 4380	3212	server.exe	100
PID 3212 wrote to memory of 4464	3212	server.exe	101
PID 3212 wrote to memory of 4464	3212	server.exe	101
PID 3212 wrote to memory of 1372	3212	server.exe	102
PID 3212 wrote to memory of 1372	3212	server.exe	102
PID 3212 wrote to memory of 1372	3212	server.exe	102
PID 3212 wrote to memory of 3680	3212	server.exe	103
PID 3212 wrote to memory of 3680	3212	server.exe	103
PID 3212 wrote to memory of 2108	3212	server.exe	104
PID 3212 wrote to memory of 2108	3212	server.exe	104
PID 3212 wrote to memory of 2108	3212	server.exe	104
PID 3212 wrote to memory of 4204	3212	server.exe	105
PID 3212 wrote to memory of 4204	3212	server.exe	105
PID 3212 wrote to memory of 3716	3212	server.exe	106
PID 3212 wrote to memory of 3716	3212	server.exe	106
PID 3212 wrote to memory of 3716	3212	server.exe	106
PID 3212 wrote to memory of 4580	3212	server.exe	107
PID 3212 wrote to memory of 4580	3212	server.exe	107
PID 3212 wrote to memory of 4776	3212	server.exe	108
PID 3212 wrote to memory of 4776	3212	server.exe	108

C:\Users\Admin\AppData\Local\Temp\CyberGate Excel v2.5.5.1 - Trial\CyberGate Excel v2.5.5.1 - Trial\server.exe
"C:\Users\Admin\AppData\Local\Temp\CyberGate Excel v2.5.5.1 - Trial\CyberGate Excel v2.5.5.1 - Trial\server.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4436
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:524
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4576
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4000
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2428
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4592
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1000
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:8
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3396
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4464
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3680
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4204
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4580
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3588
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4624
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4308
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4212
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:1604
- C:\Windows\InstallDir\Server.exe
  "C:\Windows\InstallDir\Server.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:1776
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex))\((Mutex)).dat

Filesize
2B

MD5
93e00066d099c0485cfffa1359246d26

SHA1
bc69a773f37b2f2071e25f755a66d47b871e5d98

SHA256
3b271649a94ad5be4ef46ecbb6a4e7363e8498b7e69b751737bf30df2e0d1dde

SHA512
d3dfe508cacae7d36f13908134b5b438b87429fcf93ccb060bcfa346c04633a99e9ca497297418c969537be1da2405171982794055dd0f52e59a82720d3b3d02

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex))\((Mutex)).nfo

Filesize
3KB

MD5
257520aab7515e748d6f7893bc87e7be

SHA1
49b066be656987fc7e33cddabc81a3f12c526a86

SHA256
fbe2e0cd983429ef80df2fe355c16afec5368abe65fe0a0fa5be87f7a5972b83

SHA512
fb7123df69510176523e35bdf8c29d7a4f0bf8e6e02970b365377791c7e9a77fdf8adc187d6480fadaf61dca9324b4b1f2b64f2a0e7b58a6c348292f4b9be9c0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex))\((Mutex)).svr

Filesize
358KB

MD5
00671f81b85f89f4d846ec178eeff6cb

SHA1
c1809712719f84aa6e0ad8cc5ec20cd62aca615a

SHA256
f4498728dc99d4e0f67d9c0c3a0272b75f5c9b5e2680e0d7e2a4d8bef9da1b4c

SHA512
b31813a82e61d645c32e4f24337803d4ef045439bacc3401d0f724a5ae58d1fa9c17495f7678b09fb3c312f4c012e39f783ee2924461f72b2a05edaea6a4f39c

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
405KB

MD5
2bafc6be6147f7c66138becbde526cc0

SHA1
b756233a6e0b20278fedf1caa030f504e54a8384

SHA256
b693b56c3ed54d8e250c8a7347f421df3bbe097bdd581696624257c5c656b8a3

SHA512
59e1d61c735949045a41410904337603a9b93f0a6b7d64b5f288920442cb01f6015341dd570a8169e0bef4d631d3fd5a2b7990b8c5f47c1d2a51403e67c59eb2

Download Submit
memory/2840-27-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/2840-28-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/2840-22-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/2840-24-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/2840-23-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/2840-26-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/2840-20-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/2840-19-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/2840-25-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/2840-36-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/2840-31-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/2840-30-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/2840-18-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/2840-35-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/3212-32-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4092-34-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download