xpertrat | 276963ec4efb403c18a96f94786c7b9f775a1bb22169636d8f594241288df9d3

General

Target

RFQ 13970 DT.exe
Size

536KB
MD5

7fdc62d82d767e18af6869c620a52cd1
SHA1

b9943156ba008c49589df08a936f213ecdf52729
SHA256

276963ec4efb403c18a96f94786c7b9f775a1bb22169636d8f594241288df9d3
SHA512

10d516a75e3805268f28ddb4d86ecd438bb9f7823797112d55470f13c7286b91141d43c251cb04fff7d1090ef954d3b4d1fa264c28b6d930da60045ab977773b

Score

10^/10

xpertrat msn evasion persistence rat rezer0 trojan

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

msn

C2

194.5.99.136:3135

79.134.225.85:3135

Mutex

G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8

Signatures

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
XpertRAT
XpertRAT is a remote access trojan with various capabilities.
rat xpertrat

XpertRAT Core Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1348-14-0x0000000000400000-0x0000000000443000-memory.dmp	xpertrat
behavioral2/memory/1348-15-0x0000000000401364-mapping.dmp	xpertrat
behavioral2/memory/1348-16-0x0000000000400000-0x0000000000443000-memory.dmp	xpertrat

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral2/memory/936-7-0x0000000009D20000-0x0000000009D53000-memory.dmp	rezer0

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8 = "C:\\Users\\Admin\\AppData\\Roaming\\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8.exe"	iexplore.exe

Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

RFQ 13970 DT.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" RFQ 13970 DT.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	RFQ 13970 DT.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8 = "C:\\Users\\Admin\\AppData\\Roaming\\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8.exe"	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8 = "C:\\Users\\Admin\\AppData\\Roaming\\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8.exe"	iexplore.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

RFQ 13970 DT.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RFQ 13970 DT.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RFQ 13970 DT.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

RFQ 13970 DT.exeRFQ 13970 DT.exe

description	pid	process	target process
PID 936 set thread context of 2340	936	RFQ 13970 DT.exe	RFQ 13970 DT.exe
PID 2340 set thread context of 1348	2340	RFQ 13970 DT.exe	iexplore.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

RFQ 13970 DT.exeRFQ 13970 DT.exe

pid process

936 RFQ 13970 DT.exe
936 RFQ 13970 DT.exe
936 RFQ 13970 DT.exe
2340 RFQ 13970 DT.exe
2340 RFQ 13970 DT.exe
2340 RFQ 13970 DT.exe
2340 RFQ 13970 DT.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

RFQ 13970 DT.exeiexplore.exe

description pid process

Token: SeDebugPrivilege 936 RFQ 13970 DT.exe
Token: SeDebugPrivilege 1348 iexplore.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

RFQ 13970 DT.exeiexplore.exe

pid process

2340 RFQ 13970 DT.exe
1348 iexplore.exe

pid	process
936	RFQ 13970 DT.exe
936	RFQ 13970 DT.exe
936	RFQ 13970 DT.exe
2340	RFQ 13970 DT.exe
2340	RFQ 13970 DT.exe
2340	RFQ 13970 DT.exe
2340	RFQ 13970 DT.exe

description	pid	process
Token: SeDebugPrivilege	936	RFQ 13970 DT.exe
Token: SeDebugPrivilege	1348	iexplore.exe

pid	process
2340	RFQ 13970 DT.exe
1348	iexplore.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

RFQ 13970 DT.exeRFQ 13970 DT.exe

description	pid	process	target process
PID 936 wrote to memory of 2340	936	RFQ 13970 DT.exe	RFQ 13970 DT.exe
PID 936 wrote to memory of 2340	936	RFQ 13970 DT.exe	RFQ 13970 DT.exe
PID 936 wrote to memory of 2340	936	RFQ 13970 DT.exe	RFQ 13970 DT.exe
PID 936 wrote to memory of 2340	936	RFQ 13970 DT.exe	RFQ 13970 DT.exe
PID 936 wrote to memory of 2340	936	RFQ 13970 DT.exe	RFQ 13970 DT.exe
PID 936 wrote to memory of 2340	936	RFQ 13970 DT.exe	RFQ 13970 DT.exe
PID 936 wrote to memory of 2340	936	RFQ 13970 DT.exe	RFQ 13970 DT.exe
PID 2340 wrote to memory of 1348	2340	RFQ 13970 DT.exe	iexplore.exe
PID 2340 wrote to memory of 1348	2340	RFQ 13970 DT.exe	iexplore.exe
PID 2340 wrote to memory of 1348	2340	RFQ 13970 DT.exe	iexplore.exe
PID 2340 wrote to memory of 1348	2340	RFQ 13970 DT.exe	iexplore.exe
PID 2340 wrote to memory of 1348	2340	RFQ 13970 DT.exe	iexplore.exe
PID 2340 wrote to memory of 1348	2340	RFQ 13970 DT.exe	iexplore.exe
PID 2340 wrote to memory of 1348	2340	RFQ 13970 DT.exe	iexplore.exe
PID 2340 wrote to memory of 1348	2340	RFQ 13970 DT.exe	iexplore.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

RFQ 13970 DT.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RFQ 13970 DT.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RFQ 13970 DT.exe

C:\Users\Admin\AppData\Local\Temp\RFQ 13970 DT.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ 13970 DT.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:936

C:\Users\Admin\AppData\Local\Temp\RFQ 13970 DT.exe
"{path}"
2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2340

C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Admin\AppData\Local\Temp\RFQ 13970 DT.exe
3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1348

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

3

T1089

Modify Registry

6

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/936-7-0x0000000009D20000-0x0000000009D53000-memory.dmp

Filesize
204KB

Download
memory/936-0-0x0000000073BB0000-0x000000007429E000-memory.dmp

Filesize
6.9MB

Download
memory/936-3-0x0000000008220000-0x0000000008221000-memory.dmp

Filesize
4KB

Download
memory/936-4-0x0000000007DC0000-0x0000000007DC1000-memory.dmp

Filesize
4KB

Download
memory/936-5-0x0000000007D60000-0x0000000007D61000-memory.dmp

Filesize
4KB

Download
memory/936-6-0x0000000002DE0000-0x0000000002DE2000-memory.dmp

Filesize
8KB

Download
memory/936-1-0x0000000000A00000-0x0000000000A01000-memory.dmp

Filesize
4KB

Download
memory/936-8-0x0000000009E00000-0x0000000009E01000-memory.dmp

Filesize
4KB

Download
memory/1348-14-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1348-15-0x0000000000401364-mapping.dmp

Download
memory/1348-16-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2340-11-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2340-10-0x00000000004010B8-mapping.dmp

Download
memory/2340-9-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads