xpertrat | b642ee9e0c62dcbb71ca4e722dc7a45e090ac60bd35f34c3199ad98c568cde6b

General

Target

Castor.exe
Size

172KB
MD5

720f271211bc96a23df00598e1f15656
SHA1

2cb26257e261f7c0a2d82405b76963f4008fd531
SHA256

b642ee9e0c62dcbb71ca4e722dc7a45e090ac60bd35f34c3199ad98c568cde6b
SHA512

924fe625eff79a0a275f0389fbb42bffcc74b2263054b390f42a7e51121611617b362d23d8010a8102f67769d6a3935d117003352da1a7b286545450e53c3645

Score

10^/10

xpertrat micro evasion persistence rat trojan

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

micro

C2

127.0.0.1:666

185.165.153.219:2819

Mutex

V1B5T2E0-T6R4-O5P1-P7G0-X443Q1Y6T3M3

Signatures

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
XpertRAT
XpertRAT is a remote access trojan with various capabilities.
rat xpertrat

XpertRAT Core Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2092-8-0x0000000000400000-0x0000000000443000-memory.dmp	xpertrat
behavioral2/memory/2092-9-0x0000000000401364-mapping.dmp	xpertrat
behavioral2/memory/2092-10-0x0000000000400000-0x0000000000443000-memory.dmp	xpertrat

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\V1B5T2E0-T6R4-O5P1-P7G0-X443Q1Y6T3M3 = "C:\\Users\\Admin\\AppData\\Roaming\\V1B5T2E0-T6R4-O5P1-P7G0-X443Q1Y6T3M3\\V1B5T2E0-T6R4-O5P1-P7G0-X443Q1Y6T3M3.exe"	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	iexplore.exe

Deletes itself 1 IoCs

Processes:

notepad.exe

pid process

2476 notepad.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

Castor.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" Castor.exe

pid	process
2476	notepad.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	Castor.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\V1B5T2E0-T6R4-O5P1-P7G0-X443Q1Y6T3M3 = "C:\\Users\\Admin\\AppData\\Roaming\\V1B5T2E0-T6R4-O5P1-P7G0-X443Q1Y6T3M3\\V1B5T2E0-T6R4-O5P1-P7G0-X443Q1Y6T3M3.exe"	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\V1B5T2E0-T6R4-O5P1-P7G0-X443Q1Y6T3M3 = "C:\\Users\\Admin\\AppData\\Roaming\\V1B5T2E0-T6R4-O5P1-P7G0-X443Q1Y6T3M3\\V1B5T2E0-T6R4-O5P1-P7G0-X443Q1Y6T3M3.exe"	iexplore.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Castor.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Castor.exe
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

408 648 WerFault.exe iexplore.exe
1528 1844 WerFault.exe iexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Castor.exe

pid	pid_target	process	target process
408	648	WerFault.exe	iexplore.exe
1528	1844	WerFault.exe	iexplore.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Castor.exe

description	pid	process	target process
PID 976 set thread context of 648	976	Castor.exe	iexplore.exe
PID 976 set thread context of 1844	976	Castor.exe	iexplore.exe
PID 976 set thread context of 2092	976	Castor.exe	iexplore.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

Castor.exe

pid process

976 Castor.exe
976 Castor.exe
976 Castor.exe
976 Castor.exe
976 Castor.exe
976 Castor.exe
976 Castor.exe
976 Castor.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

iexplore.exe

description pid process

Token: SeDebugPrivilege 2092 iexplore.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Castor.exeiexplore.exe

pid process

976 Castor.exe
2092 iexplore.exe

pid	process
976	Castor.exe
976	Castor.exe
976	Castor.exe
976	Castor.exe
976	Castor.exe
976	Castor.exe
976	Castor.exe
976	Castor.exe

description	pid	process
Token: SeDebugPrivilege	2092	iexplore.exe

pid	process
976	Castor.exe
2092	iexplore.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

Castor.exeiexplore.exe

description	pid	process	target process
PID 976 wrote to memory of 648	976	Castor.exe	iexplore.exe
PID 976 wrote to memory of 648	976	Castor.exe	iexplore.exe
PID 976 wrote to memory of 648	976	Castor.exe	iexplore.exe
PID 976 wrote to memory of 648	976	Castor.exe	iexplore.exe
PID 976 wrote to memory of 648	976	Castor.exe	iexplore.exe
PID 976 wrote to memory of 648	976	Castor.exe	iexplore.exe
PID 976 wrote to memory of 648	976	Castor.exe	iexplore.exe
PID 976 wrote to memory of 648	976	Castor.exe	iexplore.exe
PID 976 wrote to memory of 1844	976	Castor.exe	iexplore.exe
PID 976 wrote to memory of 1844	976	Castor.exe	iexplore.exe
PID 976 wrote to memory of 1844	976	Castor.exe	iexplore.exe
PID 976 wrote to memory of 1844	976	Castor.exe	iexplore.exe
PID 976 wrote to memory of 1844	976	Castor.exe	iexplore.exe
PID 976 wrote to memory of 1844	976	Castor.exe	iexplore.exe
PID 976 wrote to memory of 1844	976	Castor.exe	iexplore.exe
PID 976 wrote to memory of 1844	976	Castor.exe	iexplore.exe
PID 976 wrote to memory of 2092	976	Castor.exe	iexplore.exe
PID 976 wrote to memory of 2092	976	Castor.exe	iexplore.exe
PID 976 wrote to memory of 2092	976	Castor.exe	iexplore.exe
PID 976 wrote to memory of 2092	976	Castor.exe	iexplore.exe
PID 976 wrote to memory of 2092	976	Castor.exe	iexplore.exe
PID 976 wrote to memory of 2092	976	Castor.exe	iexplore.exe
PID 976 wrote to memory of 2092	976	Castor.exe	iexplore.exe
PID 976 wrote to memory of 2092	976	Castor.exe	iexplore.exe
PID 2092 wrote to memory of 2476	2092	iexplore.exe	notepad.exe
PID 2092 wrote to memory of 2476	2092	iexplore.exe	notepad.exe
PID 2092 wrote to memory of 2476	2092	iexplore.exe	notepad.exe
PID 2092 wrote to memory of 2476	2092	iexplore.exe	notepad.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

Castor.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Castor.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Castor.exe

C:\Users\Admin\AppData\Local\Temp\Castor.exe
"C:\Users\Admin\AppData\Local\Temp\Castor.exe"
1⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:976

C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Admin\AppData\Local\Temp\Castor.exe
2⤵
PID:648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 92
3⤵
- Program crash
PID:408

C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Admin\AppData\Local\Temp\Castor.exe
2⤵
PID:1844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 92
3⤵
- Program crash
PID:1528

C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Admin\AppData\Local\Temp\Castor.exe
2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092

C:\Windows\SysWOW64\notepad.exe
notepad.exe
3⤵
- Deletes itself
PID:2476

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

3

T1089

Modify Registry

6

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/408-4-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

Filesize
4KB

Download
memory/648-3-0x0000000000401364-mapping.dmp

Download
memory/1528-7-0x0000000004720000-0x0000000004721000-memory.dmp

Filesize
4KB

Download
memory/1844-6-0x0000000000401364-mapping.dmp

Download
memory/2092-8-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2092-9-0x0000000000401364-mapping.dmp

Download
memory/2092-10-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2476-13-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads