xpertrat | 28b2e9be250b41e1f4ec167dff3620f09597b7292ad23f0c48a8d6cdcc388959

General

Target

RFQ_#76242788162.exe
Size

179KB
MD5

441ef18a2da7b635c7861e9a502a938b
SHA1

63721215f57495860838e078f0bb73d00ce4817a
SHA256

28b2e9be250b41e1f4ec167dff3620f09597b7292ad23f0c48a8d6cdcc388959
SHA512

e59fe8c48c52405ca03bf2f8ae63eb24dd236411e2ef0210ab8a1cd26faf906d0b13dd4f76ca9816e98b4bbbf8a7e8ed57588c631d9667119e1396525e95dd94

Score

10^/10

xpertrat special x evasion persistence rat trojan

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

special X

C2

zytriew.duckdns.org:4141

Mutex

Y6K1I7G5-B5F3-V3F4-S5A6-T0V116U8H550

Signatures

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
XpertRAT
XpertRAT is a remote access trojan with various capabilities.
rat xpertrat

XpertRAT Core Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1968-12-0x0000000000400000-0x0000000000443000-memory.dmp	xpertrat
behavioral1/memory/1968-13-0x0000000000401364-mapping.dmp	xpertrat
behavioral1/memory/1968-14-0x0000000000400000-0x0000000000443000-memory.dmp	xpertrat

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Y6K1I7G5-B5F3-V3F4-S5A6-T0V116U8H550 = "C:\\Users\\Admin\\AppData\\Roaming\\Y6K1I7G5-B5F3-V3F4-S5A6-T0V116U8H550\\Y6K1I7G5-B5F3-V3F4-S5A6-T0V116U8H550.exe"	iexplore.exe

Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

RFQ_#76242788162.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" RFQ_#76242788162.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0"	RFQ_#76242788162.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Y6K1I7G5-B5F3-V3F4-S5A6-T0V116U8H550 = "C:\\Users\\Admin\\AppData\\Roaming\\Y6K1I7G5-B5F3-V3F4-S5A6-T0V116U8H550\\Y6K1I7G5-B5F3-V3F4-S5A6-T0V116U8H550.exe"	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Y6K1I7G5-B5F3-V3F4-S5A6-T0V116U8H550 = "C:\\Users\\Admin\\AppData\\Roaming\\Y6K1I7G5-B5F3-V3F4-S5A6-T0V116U8H550\\Y6K1I7G5-B5F3-V3F4-S5A6-T0V116U8H550.exe"	iexplore.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

RFQ_#76242788162.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RFQ_#76242788162.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RFQ_#76242788162.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs

Processes:

RFQ_#76242788162.exe

pid	process
1100	RFQ_#76242788162.exe
1100	RFQ_#76242788162.exe
1100	RFQ_#76242788162.exe
1100	RFQ_#76242788162.exe
1100	RFQ_#76242788162.exe
1100	RFQ_#76242788162.exe
1100	RFQ_#76242788162.exe
1100	RFQ_#76242788162.exe
1100	RFQ_#76242788162.exe
1100	RFQ_#76242788162.exe
1100	RFQ_#76242788162.exe
1100	RFQ_#76242788162.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

RFQ_#76242788162.exeRFQ_#76242788162.exe

description	pid	process	target process
PID 1100 set thread context of 1884	1100	RFQ_#76242788162.exe	RFQ_#76242788162.exe
PID 1884 set thread context of 1968	1884	RFQ_#76242788162.exe	iexplore.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1936 1100 WerFault.exe RFQ_#76242788162.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1044 timeout.exe

pid	pid_target	process	target process
1936	1100	WerFault.exe	RFQ_#76242788162.exe

pid	process
1044	timeout.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

RFQ_#76242788162.exeRFQ_#76242788162.exeWerFault.exe

pid	process
1100	RFQ_#76242788162.exe
1100	RFQ_#76242788162.exe
1100	RFQ_#76242788162.exe
1884	RFQ_#76242788162.exe
1884	RFQ_#76242788162.exe
1936	WerFault.exe
1936	WerFault.exe
1936	WerFault.exe
1936	WerFault.exe
1936	WerFault.exe
1884	RFQ_#76242788162.exe
1884	RFQ_#76242788162.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

RFQ_#76242788162.exeWerFault.exeiexplore.exe

description pid process

Token: SeDebugPrivilege 1100 RFQ_#76242788162.exe
Token: SeDebugPrivilege 1936 WerFault.exe
Token: SeDebugPrivilege 1968 iexplore.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

RFQ_#76242788162.exeiexplore.exe

pid process

1884 RFQ_#76242788162.exe
1968 iexplore.exe

description	pid	process
Token: SeDebugPrivilege	1100	RFQ_#76242788162.exe
Token: SeDebugPrivilege	1936	WerFault.exe
Token: SeDebugPrivilege	1968	iexplore.exe

pid	process
1884	RFQ_#76242788162.exe
1968	iexplore.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

RFQ_#76242788162.exeRFQ_#76242788162.exe

description	pid	process	target process
PID 1100 wrote to memory of 1044	1100	RFQ_#76242788162.exe	timeout.exe
PID 1100 wrote to memory of 1044	1100	RFQ_#76242788162.exe	timeout.exe
PID 1100 wrote to memory of 1044	1100	RFQ_#76242788162.exe	timeout.exe
PID 1100 wrote to memory of 1044	1100	RFQ_#76242788162.exe	timeout.exe
PID 1100 wrote to memory of 1884	1100	RFQ_#76242788162.exe	RFQ_#76242788162.exe
PID 1100 wrote to memory of 1884	1100	RFQ_#76242788162.exe	RFQ_#76242788162.exe
PID 1100 wrote to memory of 1884	1100	RFQ_#76242788162.exe	RFQ_#76242788162.exe
PID 1100 wrote to memory of 1884	1100	RFQ_#76242788162.exe	RFQ_#76242788162.exe
PID 1100 wrote to memory of 1884	1100	RFQ_#76242788162.exe	RFQ_#76242788162.exe
PID 1100 wrote to memory of 1884	1100	RFQ_#76242788162.exe	RFQ_#76242788162.exe
PID 1100 wrote to memory of 1884	1100	RFQ_#76242788162.exe	RFQ_#76242788162.exe
PID 1100 wrote to memory of 1884	1100	RFQ_#76242788162.exe	RFQ_#76242788162.exe
PID 1100 wrote to memory of 1936	1100	RFQ_#76242788162.exe	WerFault.exe
PID 1100 wrote to memory of 1936	1100	RFQ_#76242788162.exe	WerFault.exe
PID 1100 wrote to memory of 1936	1100	RFQ_#76242788162.exe	WerFault.exe
PID 1100 wrote to memory of 1936	1100	RFQ_#76242788162.exe	WerFault.exe
PID 1884 wrote to memory of 1968	1884	RFQ_#76242788162.exe	iexplore.exe
PID 1884 wrote to memory of 1968	1884	RFQ_#76242788162.exe	iexplore.exe
PID 1884 wrote to memory of 1968	1884	RFQ_#76242788162.exe	iexplore.exe
PID 1884 wrote to memory of 1968	1884	RFQ_#76242788162.exe	iexplore.exe
PID 1884 wrote to memory of 1968	1884	RFQ_#76242788162.exe	iexplore.exe
PID 1884 wrote to memory of 1968	1884	RFQ_#76242788162.exe	iexplore.exe
PID 1884 wrote to memory of 1968	1884	RFQ_#76242788162.exe	iexplore.exe
PID 1884 wrote to memory of 1968	1884	RFQ_#76242788162.exe	iexplore.exe
PID 1884 wrote to memory of 1968	1884	RFQ_#76242788162.exe	iexplore.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

RFQ_#76242788162.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RFQ_#76242788162.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RFQ_#76242788162.exe

C:\Users\Admin\AppData\Local\Temp\RFQ_#76242788162.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ_#76242788162.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1100

C:\Windows\SysWOW64\timeout.exe
timeout 4
2⤵
- Delays execution with timeout.exe
PID:1044

C:\Users\Admin\AppData\Local\Temp\RFQ_#76242788162.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ_#76242788162.exe"
2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1884

C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Admin\AppData\Local\Temp\RFQ_#76242788162.exe
3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 1544
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1936

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

3

T1089

Modify Registry

6

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1044-3-0x0000000000000000-mapping.dmp

Download
memory/1100-1-0x0000000001230000-0x0000000001231000-memory.dmp

Filesize
4KB

Download
memory/1100-4-0x0000000000380000-0x00000000003B8000-memory.dmp

Filesize
224KB

Download
memory/1100-0-0x00000000744E0000-0x0000000074BCE000-memory.dmp

Filesize
6.9MB

Download
memory/1884-18-0x0000000000990000-0x0000000000994000-memory.dmp

Filesize
16KB

Download
memory/1884-5-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1884-6-0x00000000004010B8-mapping.dmp

Download
memory/1884-19-0x0000000002B30000-0x0000000002B34000-memory.dmp

Filesize
16KB

Download
memory/1936-10-0x0000000000000000-mapping.dmp

Download
memory/1936-17-0x00000000026C0000-0x00000000026D1000-memory.dmp

Filesize
68KB

Download
memory/1936-11-0x0000000000940000-0x0000000000951000-memory.dmp

Filesize
68KB

Download
memory/1968-13-0x0000000000401364-mapping.dmp

Download
memory/1968-14-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1968-12-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads