Analysis

  • max time kernel
    98s
  • max time network
    133s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    11-11-2020 16:08

General

  • Target

    0530c72ac087e821a13fd9173565dfe8.exe

  • Size

    28KB

  • MD5

    0530c72ac087e821a13fd9173565dfe8

  • SHA1

    a5a8ff2ee22dce4ec4d2d5674c29dc2483fb418e

  • SHA256

    d3f2094ff947212a812af1a551b602d9056843ae7f3bdf5f95c90e0590f9fb0a

  • SHA512

    72993dca21a351a1b7cfdf99cbf914ca0fe71437f250722f36c5da15ec8e80fca14143273fa5550fcc7ddf115d9b5749462ba304ba0f0faa441dd4901d917696

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

special X

C2

sandshoe.myfirewall.org:2054

sandshoe.myfirewall.org:4000

Mutex

C7H2A8R6-A3X1-J1N8-N887-L0I1C4O6U0D4

Signatures

  • UAC bypass 3 TTPs
  • Windows security bypass 2 TTPs
  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

  • XpertRAT Core Payload 3 IoCs
  • NirSoft MailPassView 3 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 3 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 11 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Program crash 6 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
  • Suspicious use of SetThreadContext 12 IoCs
  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0530c72ac087e821a13fd9173565dfe8.exe
    "C:\Users\Admin\AppData\Local\Temp\0530c72ac087e821a13fd9173565dfe8.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1272
    • C:\Windows\SysWOW64\timeout.exe
      timeout 5
      2⤵
      • Delays execution with timeout.exe
      PID:640
    • C:\Users\Admin\AppData\Local\Temp\0530c72ac087e821a13fd9173565dfe8.exe
      "C:\Users\Admin\AppData\Local\Temp\0530c72ac087e821a13fd9173565dfe8.exe"
      2⤵
      • Windows security modification
      • Checks whether UAC is enabled
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:360
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        C:\Users\Admin\AppData\Local\Temp\0530c72ac087e821a13fd9173565dfe8.exe
        3⤵
          PID:3808
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 92
            4⤵
            • Program crash
            PID:3904
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          C:\Users\Admin\AppData\Local\Temp\0530c72ac087e821a13fd9173565dfe8.exe
          3⤵
          • Adds policy Run key to start application
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1120
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            /stext "C:\Users\Admin\AppData\Roaming\C7H2A8R6-A3X1-J1N8-N887-L0I1C4O6U0D4\rxkybjtdw0.txt"
            4⤵
              PID:2732
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 92
                5⤵
                • Program crash
                PID:700
            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
              /stext "C:\Users\Admin\AppData\Roaming\C7H2A8R6-A3X1-J1N8-N887-L0I1C4O6U0D4\rxkybjtdw0.txt"
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:560
            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
              /stext "C:\Users\Admin\AppData\Roaming\C7H2A8R6-A3X1-J1N8-N887-L0I1C4O6U0D4\rxkybjtdw1.txt"
              4⤵
                PID:976
              • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                /stext "C:\Users\Admin\AppData\Roaming\C7H2A8R6-A3X1-J1N8-N887-L0I1C4O6U0D4\rxkybjtdw2.txt"
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:2164
              • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                /stext "C:\Users\Admin\AppData\Roaming\C7H2A8R6-A3X1-J1N8-N887-L0I1C4O6U0D4\rxkybjtdw3.txt"
                4⤵
                  PID:1556
                • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                  /stext "C:\Users\Admin\AppData\Roaming\C7H2A8R6-A3X1-J1N8-N887-L0I1C4O6U0D4\rxkybjtdw4.txt"
                  4⤵
                    PID:1044
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 92
                      5⤵
                      • Program crash
                      PID:2624
                  • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                    /stext "C:\Users\Admin\AppData\Roaming\C7H2A8R6-A3X1-J1N8-N887-L0I1C4O6U0D4\rxkybjtdw4.txt"
                    4⤵
                      PID:1016
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 92
                        5⤵
                        • Program crash
                        PID:1564
                    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                      /stext "C:\Users\Admin\AppData\Roaming\C7H2A8R6-A3X1-J1N8-N887-L0I1C4O6U0D4\rxkybjtdw4.txt"
                      4⤵
                        PID:2072
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 92
                          5⤵
                          • Program crash
                          PID:3176
                      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                        /stext "C:\Users\Admin\AppData\Roaming\C7H2A8R6-A3X1-J1N8-N887-L0I1C4O6U0D4\rxkybjtdw4.txt"
                        4⤵
                          PID:792
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 1720
                      2⤵
                      • Program crash
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3960

                  Network

                  MITRE ATT&CK Matrix ATT&CK v6

                  Persistence

                  Registry Run Keys / Startup Folder

                  2
                  T1060

                  Privilege Escalation

                  Bypass User Account Control

                  1
                  T1088

                  Defense Evasion

                  Bypass User Account Control

                  1
                  T1088

                  Disabling Security Tools

                  3
                  T1089

                  Modify Registry

                  6
                  T1112

                  Discovery

                  System Information Discovery

                  1
                  T1082

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Roaming\C7H2A8R6-A3X1-J1N8-N887-L0I1C4O6U0D4\rxkybjtdw2.txt
                    MD5

                    f94dc819ca773f1e3cb27abbc9e7fa27

                    SHA1

                    9a7700efadc5ea09ab288544ef1e3cd876255086

                    SHA256

                    a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92

                    SHA512

                    72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196

                  • C:\Users\Admin\AppData\Roaming\C7H2A8R6-A3X1-J1N8-N887-L0I1C4O6U0D4\rxkybjtdw4.txt
                    MD5

                    f3b25701fe362ec84616a93a45ce9998

                    SHA1

                    d62636d8caec13f04e28442a0a6fa1afeb024bbb

                    SHA256

                    b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                    SHA512

                    98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                  • memory/360-7-0x0000000000400000-0x000000000042C000-memory.dmp
                    Filesize

                    176KB

                  • memory/360-9-0x0000000000400000-0x000000000042C000-memory.dmp
                    Filesize

                    176KB

                  • memory/360-8-0x00000000004010B8-mapping.dmp
                  • memory/560-25-0x0000000000400000-0x0000000000426000-memory.dmp
                    Filesize

                    152KB

                  • memory/560-28-0x0000000000400000-0x0000000000426000-memory.dmp
                    Filesize

                    152KB

                  • memory/560-27-0x0000000000400000-0x0000000000426000-memory.dmp
                    Filesize

                    152KB

                  • memory/560-26-0x0000000000423BC0-mapping.dmp
                  • memory/640-4-0x0000000000000000-mapping.dmp
                  • memory/700-24-0x0000000004C60000-0x0000000004C61000-memory.dmp
                    Filesize

                    4KB

                  • memory/792-49-0x0000000000400000-0x0000000000415000-memory.dmp
                    Filesize

                    84KB

                  • memory/792-50-0x000000000040C2A8-mapping.dmp
                  • memory/792-51-0x0000000000400000-0x0000000000415000-memory.dmp
                    Filesize

                    84KB

                  • memory/976-29-0x0000000000400000-0x000000000041B000-memory.dmp
                    Filesize

                    108KB

                  • memory/976-31-0x0000000000400000-0x000000000041B000-memory.dmp
                    Filesize

                    108KB

                  • memory/976-30-0x0000000000411654-mapping.dmp
                  • memory/1016-44-0x000000000040C2A8-mapping.dmp
                  • memory/1044-41-0x000000000040C2A8-mapping.dmp
                  • memory/1120-17-0x0000000000400000-0x0000000000443000-memory.dmp
                    Filesize

                    268KB

                  • memory/1120-18-0x0000000000401364-mapping.dmp
                  • memory/1120-19-0x0000000000400000-0x0000000000443000-memory.dmp
                    Filesize

                    268KB

                  • memory/1272-1-0x0000000000630000-0x0000000000631000-memory.dmp
                    Filesize

                    4KB

                  • memory/1272-5-0x00000000028A0000-0x000000000291B000-memory.dmp
                    Filesize

                    492KB

                  • memory/1272-3-0x0000000004FB0000-0x0000000004FB1000-memory.dmp
                    Filesize

                    4KB

                  • memory/1272-6-0x0000000007110000-0x0000000007111000-memory.dmp
                    Filesize

                    4KB

                  • memory/1272-0-0x0000000073C50000-0x000000007433E000-memory.dmp
                    Filesize

                    6.9MB

                  • memory/1556-37-0x0000000000413750-mapping.dmp
                  • memory/1556-39-0x0000000000400000-0x0000000000416000-memory.dmp
                    Filesize

                    88KB

                  • memory/1556-36-0x0000000000400000-0x0000000000416000-memory.dmp
                    Filesize

                    88KB

                  • memory/1556-38-0x0000000000400000-0x0000000000416000-memory.dmp
                    Filesize

                    88KB

                  • memory/1564-45-0x0000000004C90000-0x0000000004C91000-memory.dmp
                    Filesize

                    4KB

                  • memory/2072-47-0x000000000040C2A8-mapping.dmp
                  • memory/2164-32-0x0000000000400000-0x0000000000459000-memory.dmp
                    Filesize

                    356KB

                  • memory/2164-33-0x0000000000442F04-mapping.dmp
                  • memory/2164-34-0x0000000000400000-0x0000000000459000-memory.dmp
                    Filesize

                    356KB

                  • memory/2624-42-0x0000000004620000-0x0000000004621000-memory.dmp
                    Filesize

                    4KB

                  • memory/2732-23-0x0000000000423BC0-mapping.dmp
                  • memory/3176-48-0x00000000046C0000-0x00000000046C1000-memory.dmp
                    Filesize

                    4KB

                  • memory/3808-14-0x0000000000401364-mapping.dmp
                  • memory/3904-15-0x0000000004510000-0x0000000004511000-memory.dmp
                    Filesize

                    4KB

                  • memory/3960-16-0x0000000004930000-0x0000000004931000-memory.dmp
                    Filesize

                    4KB

                  • memory/3960-12-0x0000000004100000-0x0000000004101000-memory.dmp
                    Filesize

                    4KB