Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7 -
submitted
27-10-2020 10:00
Static task
static1
Behavioral task
behavioral1
Sample
gunzipped.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
-
Target
gunzipped.exe
-
Size
765KB
-
MD5
2f7687172e06c6868282ba3e1428aaeb
-
SHA1
3c280b0e41b375b1748884eb1e3413c79f8c5c9a
-
SHA256
88b664781d7b10fc5130cf6453fbde5b26b129f0e2f5e002d62be833b0fcd020
-
SHA512
952301e069759ffb1c7cb71088525cd7c3460398e251d9c375a8dcb9123d3cf41e1fc4f19114ab7eae849acb3c044ccba39ec28184bb7f5197b4a3acbc406151
Malware Config
Extracted
Family
xpertrat
Version
3.0.10
Botnet
Test
C2
185.244.30.211:4576
Mutex
G2L6E3O1-E775-G5K4-R4C2-P5F660S1R4A8
Signatures
-
XpertRAT Core Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1108-15-0x0000000000400000-0x0000000000443000-memory.dmp xpertrat behavioral1/memory/1108-16-0x0000000000401364-mapping.dmp xpertrat behavioral1/memory/1108-17-0x0000000000400000-0x0000000000443000-memory.dmp xpertrat -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\G2L6E3O1-E775-G5K4-R4C2-P5F660S1R4A8 = "C:\\Users\\Admin\\AppData\\Roaming\\G2L6E3O1-E775-G5K4-R4C2-P5F660S1R4A8\\G2L6E3O1-E775-G5K4-R4C2-P5F660S1R4A8.exe" iexplore.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 1712 notepad.exe -
Processes:
gunzipped.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" gunzipped.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\G2L6E3O1-E775-G5K4-R4C2-P5F660S1R4A8 = "C:\\Users\\Admin\\AppData\\Roaming\\G2L6E3O1-E775-G5K4-R4C2-P5F660S1R4A8\\G2L6E3O1-E775-G5K4-R4C2-P5F660S1R4A8.exe" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Windows\CurrentVersion\Run\G2L6E3O1-E775-G5K4-R4C2-P5F660S1R4A8 = "C:\\Users\\Admin\\AppData\\Roaming\\G2L6E3O1-E775-G5K4-R4C2-P5F660S1R4A8\\G2L6E3O1-E775-G5K4-R4C2-P5F660S1R4A8.exe" iexplore.exe -
Processes:
gunzipped.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" gunzipped.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
gunzipped.exegunzipped.exedescription pid process target process PID 1880 set thread context of 796 1880 gunzipped.exe gunzipped.exe PID 796 set thread context of 1468 796 gunzipped.exe iexplore.exe PID 796 set thread context of 1048 796 gunzipped.exe iexplore.exe PID 796 set thread context of 1108 796 gunzipped.exe iexplore.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
gunzipped.exepid process 796 gunzipped.exe 796 gunzipped.exe 796 gunzipped.exe 796 gunzipped.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
iexplore.exedescription pid process Token: SeDebugPrivilege 1108 iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
gunzipped.exeiexplore.exepid process 796 gunzipped.exe 1108 iexplore.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
gunzipped.exegunzipped.exeiexplore.exedescription pid process target process PID 1880 wrote to memory of 796 1880 gunzipped.exe gunzipped.exe PID 1880 wrote to memory of 796 1880 gunzipped.exe gunzipped.exe PID 1880 wrote to memory of 796 1880 gunzipped.exe gunzipped.exe PID 1880 wrote to memory of 796 1880 gunzipped.exe gunzipped.exe PID 1880 wrote to memory of 796 1880 gunzipped.exe gunzipped.exe PID 1880 wrote to memory of 796 1880 gunzipped.exe gunzipped.exe PID 1880 wrote to memory of 796 1880 gunzipped.exe gunzipped.exe PID 1880 wrote to memory of 796 1880 gunzipped.exe gunzipped.exe PID 796 wrote to memory of 1468 796 gunzipped.exe iexplore.exe PID 796 wrote to memory of 1468 796 gunzipped.exe iexplore.exe PID 796 wrote to memory of 1468 796 gunzipped.exe iexplore.exe PID 796 wrote to memory of 1468 796 gunzipped.exe iexplore.exe PID 796 wrote to memory of 1468 796 gunzipped.exe iexplore.exe PID 796 wrote to memory of 1468 796 gunzipped.exe iexplore.exe PID 796 wrote to memory of 1468 796 gunzipped.exe iexplore.exe PID 796 wrote to memory of 1468 796 gunzipped.exe iexplore.exe PID 796 wrote to memory of 1468 796 gunzipped.exe iexplore.exe PID 796 wrote to memory of 1048 796 gunzipped.exe iexplore.exe PID 796 wrote to memory of 1048 796 gunzipped.exe iexplore.exe PID 796 wrote to memory of 1048 796 gunzipped.exe iexplore.exe PID 796 wrote to memory of 1048 796 gunzipped.exe iexplore.exe PID 796 wrote to memory of 1048 796 gunzipped.exe iexplore.exe PID 796 wrote to memory of 1048 796 gunzipped.exe iexplore.exe PID 796 wrote to memory of 1048 796 gunzipped.exe iexplore.exe PID 796 wrote to memory of 1048 796 gunzipped.exe iexplore.exe PID 796 wrote to memory of 1048 796 gunzipped.exe iexplore.exe PID 796 wrote to memory of 1108 796 gunzipped.exe iexplore.exe PID 796 wrote to memory of 1108 796 gunzipped.exe iexplore.exe PID 796 wrote to memory of 1108 796 gunzipped.exe iexplore.exe PID 796 wrote to memory of 1108 796 gunzipped.exe iexplore.exe PID 796 wrote to memory of 1108 796 gunzipped.exe iexplore.exe PID 796 wrote to memory of 1108 796 gunzipped.exe iexplore.exe PID 796 wrote to memory of 1108 796 gunzipped.exe iexplore.exe PID 796 wrote to memory of 1108 796 gunzipped.exe iexplore.exe PID 796 wrote to memory of 1108 796 gunzipped.exe iexplore.exe PID 1108 wrote to memory of 1712 1108 iexplore.exe notepad.exe PID 1108 wrote to memory of 1712 1108 iexplore.exe notepad.exe PID 1108 wrote to memory of 1712 1108 iexplore.exe notepad.exe PID 1108 wrote to memory of 1712 1108 iexplore.exe notepad.exe PID 1108 wrote to memory of 1712 1108 iexplore.exe notepad.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
gunzipped.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" gunzipped.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"{path}"2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\gunzipped.exe3⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\gunzipped.exe3⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\gunzipped.exe3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad.exe4⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/796-6-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/796-22-0x0000000002AA0000-0x0000000002AA4000-memory.dmpFilesize
16KB
-
memory/796-21-0x0000000000970000-0x0000000000974000-memory.dmpFilesize
16KB
-
memory/796-7-0x00000000004010B8-mapping.dmp
-
memory/1048-14-0x0000000000401364-mapping.dmp
-
memory/1108-15-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/1108-16-0x0000000000401364-mapping.dmp
-
memory/1108-17-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/1468-12-0x0000000000401364-mapping.dmp
-
memory/1712-20-0x0000000000000000-mapping.dmp
-
memory/1880-5-0x0000000007660000-0x00000000076D7000-memory.dmpFilesize
476KB
-
memory/1880-4-0x00000000004B0000-0x00000000004C6000-memory.dmpFilesize
88KB
-
memory/1880-0-0x00000000749F0000-0x00000000750DE000-memory.dmpFilesize
6.9MB
-
memory/1880-3-0x0000000001220000-0x00000000012A5000-memory.dmpFilesize
532KB
-
memory/1880-1-0x00000000013A0000-0x00000000013A1000-memory.dmpFilesize
4KB