Overview

overview

10

Static

static

ES17402891...df.exe

windows7_x64

10

ES17402891...df.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ES174028911-035110-sanlccjavap0004-1_pdf.exe

  • Size

    1.3MB

  • Sample

    201109-m22ephta2s

  • MD5

    a7433aeec10caba2de9978e0de200cc3

  • SHA1

    b5eb42feb127898ef72ad78ac039dd2e80dc0ab6

  • SHA256

    daf3291e47f8659d58a505b5ed585987018001e08827f3aff1ab0bb860bd5c80

  • SHA512

    c297fc86e40ac9654926eae90e00e03074f811968116de222e81df2760b41fee8b39bf1bff3f9466f7cf39eabd558462796009bc22c00696dac4d3771daa9503

Score
10/10
xpertratxeevasionpersistencerattrojanupx

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

xE

C2

79.134.225.99:6712

Mutex

Y550W6I4-W1O8-Y8D6-E6U5-B8X0R3E4K7S2

Targets

    • Target

      ES174028911-035110-sanlccjavap0004-1_pdf.exe

    • Size

      1.3MB

    • MD5

      a7433aeec10caba2de9978e0de200cc3

    • SHA1

      b5eb42feb127898ef72ad78ac039dd2e80dc0ab6

    • SHA256

      daf3291e47f8659d58a505b5ed585987018001e08827f3aff1ab0bb860bd5c80

    • SHA512

      c297fc86e40ac9654926eae90e00e03074f811968116de222e81df2760b41fee8b39bf1bff3f9466f7cf39eabd558462796009bc22c00696dac4d3771daa9503

    Score
    10/10
    xpertratxeevasionpersistencerattrojanupx

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • XpertRAT

      XpertRAT is a remote access trojan with various capabilities.

      ratxpertrat

    • XpertRAT Core Payload

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Adds policy Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Deletes itself

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Program crash

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

3
T1089

Modify Registry

6
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks