Analysis
-
max time kernel
136s -
max time network
151s -
platform
windows10_x64 -
resource
win10 -
submitted
16-10-2020 10:39
Static task
static1
Behavioral task
behavioral1
Sample
RFQ_#76242788162.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
-
Target
RFQ_#76242788162.exe
-
Size
179KB
-
MD5
441ef18a2da7b635c7861e9a502a938b
-
SHA1
63721215f57495860838e078f0bb73d00ce4817a
-
SHA256
28b2e9be250b41e1f4ec167dff3620f09597b7292ad23f0c48a8d6cdcc388959
-
SHA512
e59fe8c48c52405ca03bf2f8ae63eb24dd236411e2ef0210ab8a1cd26faf906d0b13dd4f76ca9816e98b4bbbf8a7e8ed57588c631d9667119e1396525e95dd94
Malware Config
Extracted
Family
xpertrat
Version
3.0.10
Botnet
special X
C2
zytriew.duckdns.org:4141
Mutex
Y6K1I7G5-B5F3-V3F4-S5A6-T0V116U8H550
Signatures
-
XpertRAT Core Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2064-14-0x0000000000400000-0x0000000000443000-memory.dmp xpertrat behavioral2/memory/2064-15-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/2064-16-0x0000000000400000-0x0000000000443000-memory.dmp xpertrat -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Y6K1I7G5-B5F3-V3F4-S5A6-T0V116U8H550 = "C:\\Users\\Admin\\AppData\\Roaming\\Y6K1I7G5-B5F3-V3F4-S5A6-T0V116U8H550\\Y6K1I7G5-B5F3-V3F4-S5A6-T0V116U8H550.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe -
Processes:
RFQ_#76242788162.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" RFQ_#76242788162.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Y6K1I7G5-B5F3-V3F4-S5A6-T0V116U8H550 = "C:\\Users\\Admin\\AppData\\Roaming\\Y6K1I7G5-B5F3-V3F4-S5A6-T0V116U8H550\\Y6K1I7G5-B5F3-V3F4-S5A6-T0V116U8H550.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Y6K1I7G5-B5F3-V3F4-S5A6-T0V116U8H550 = "C:\\Users\\Admin\\AppData\\Roaming\\Y6K1I7G5-B5F3-V3F4-S5A6-T0V116U8H550\\Y6K1I7G5-B5F3-V3F4-S5A6-T0V116U8H550.exe" iexplore.exe -
Processes:
RFQ_#76242788162.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RFQ_#76242788162.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
Processes:
RFQ_#76242788162.exepid process 720 RFQ_#76242788162.exe 720 RFQ_#76242788162.exe 720 RFQ_#76242788162.exe 720 RFQ_#76242788162.exe 720 RFQ_#76242788162.exe 720 RFQ_#76242788162.exe 720 RFQ_#76242788162.exe 720 RFQ_#76242788162.exe 720 RFQ_#76242788162.exe 720 RFQ_#76242788162.exe 720 RFQ_#76242788162.exe 720 RFQ_#76242788162.exe 720 RFQ_#76242788162.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
RFQ_#76242788162.exeRFQ_#76242788162.exedescription pid process target process PID 720 set thread context of 1752 720 RFQ_#76242788162.exe RFQ_#76242788162.exe PID 1752 set thread context of 2064 1752 RFQ_#76242788162.exe iexplore.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2368 720 WerFault.exe RFQ_#76242788162.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2996 timeout.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
RFQ_#76242788162.exeRFQ_#76242788162.exeWerFault.exepid process 720 RFQ_#76242788162.exe 720 RFQ_#76242788162.exe 720 RFQ_#76242788162.exe 1752 RFQ_#76242788162.exe 1752 RFQ_#76242788162.exe 2368 WerFault.exe 2368 WerFault.exe 2368 WerFault.exe 2368 WerFault.exe 2368 WerFault.exe 2368 WerFault.exe 2368 WerFault.exe 2368 WerFault.exe 2368 WerFault.exe 2368 WerFault.exe 2368 WerFault.exe 2368 WerFault.exe 2368 WerFault.exe 2368 WerFault.exe 1752 RFQ_#76242788162.exe 1752 RFQ_#76242788162.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
RFQ_#76242788162.exeWerFault.exeiexplore.exedescription pid process Token: SeDebugPrivilege 720 RFQ_#76242788162.exe Token: SeRestorePrivilege 2368 WerFault.exe Token: SeBackupPrivilege 2368 WerFault.exe Token: SeDebugPrivilege 2064 iexplore.exe Token: SeDebugPrivilege 2368 WerFault.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
RFQ_#76242788162.exeiexplore.exepid process 1752 RFQ_#76242788162.exe 2064 iexplore.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
RFQ_#76242788162.exeRFQ_#76242788162.exedescription pid process target process PID 720 wrote to memory of 2996 720 RFQ_#76242788162.exe timeout.exe PID 720 wrote to memory of 2996 720 RFQ_#76242788162.exe timeout.exe PID 720 wrote to memory of 2996 720 RFQ_#76242788162.exe timeout.exe PID 720 wrote to memory of 1752 720 RFQ_#76242788162.exe RFQ_#76242788162.exe PID 720 wrote to memory of 1752 720 RFQ_#76242788162.exe RFQ_#76242788162.exe PID 720 wrote to memory of 1752 720 RFQ_#76242788162.exe RFQ_#76242788162.exe PID 720 wrote to memory of 1752 720 RFQ_#76242788162.exe RFQ_#76242788162.exe PID 720 wrote to memory of 1752 720 RFQ_#76242788162.exe RFQ_#76242788162.exe PID 720 wrote to memory of 1752 720 RFQ_#76242788162.exe RFQ_#76242788162.exe PID 720 wrote to memory of 1752 720 RFQ_#76242788162.exe RFQ_#76242788162.exe PID 1752 wrote to memory of 2064 1752 RFQ_#76242788162.exe iexplore.exe PID 1752 wrote to memory of 2064 1752 RFQ_#76242788162.exe iexplore.exe PID 1752 wrote to memory of 2064 1752 RFQ_#76242788162.exe iexplore.exe PID 1752 wrote to memory of 2064 1752 RFQ_#76242788162.exe iexplore.exe PID 1752 wrote to memory of 2064 1752 RFQ_#76242788162.exe iexplore.exe PID 1752 wrote to memory of 2064 1752 RFQ_#76242788162.exe iexplore.exe PID 1752 wrote to memory of 2064 1752 RFQ_#76242788162.exe iexplore.exe PID 1752 wrote to memory of 2064 1752 RFQ_#76242788162.exe iexplore.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
RFQ_#76242788162.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RFQ_#76242788162.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ_#76242788162.exe"C:\Users\Admin\AppData\Local\Temp\RFQ_#76242788162.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 42⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\RFQ_#76242788162.exe"C:\Users\Admin\AppData\Local\Temp\RFQ_#76242788162.exe"2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\RFQ_#76242788162.exe3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 720 -s 18162⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/720-8-0x00000000071F0000-0x0000000007228000-memory.dmpFilesize
224KB
-
memory/720-1-0x0000000000AE0000-0x0000000000AE1000-memory.dmpFilesize
4KB
-
memory/720-3-0x00000000054A0000-0x00000000054A1000-memory.dmpFilesize
4KB
-
memory/720-4-0x0000000005B80000-0x0000000005B81000-memory.dmpFilesize
4KB
-
memory/720-5-0x0000000005780000-0x0000000005781000-memory.dmpFilesize
4KB
-
memory/720-0-0x0000000073D30000-0x000000007441E000-memory.dmpFilesize
6.9MB
-
memory/720-7-0x00000000053C0000-0x00000000053C1000-memory.dmpFilesize
4KB
-
memory/1752-9-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1752-10-0x00000000004010B8-mapping.dmp
-
memory/1752-11-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2064-14-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/2064-15-0x0000000000401364-mapping.dmp
-
memory/2064-16-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/2368-17-0x0000000004950000-0x0000000004951000-memory.dmpFilesize
4KB
-
memory/2368-20-0x0000000005090000-0x0000000005091000-memory.dmpFilesize
4KB
-
memory/2996-6-0x0000000000000000-mapping.dmp