xpertrat | e3c5d29533223d5a1cb39c9531bffce0bfbdae3b7335a8b203c034b581dda787

General

Target
4b448c2f70404c6b0dae7ee65bc2cd96.exe
Size 172KB
Sample201225-al3v2wmcej
SHA256 e3c5d29533223d5a1cb39c9531bffce0bfbdae3b7335a8b203c034b581dda787
MD5 4b448c2f70404c6b0dae7ee65bc2cd96
SHA1 4d10fb4f0f2d092aabe75fefda6b1f8e5081dcb3
SHA512 1e97572d22809adaa684cbf0a2acba4e6f19c93c76937b8b2f45db890607036a712e90bf6250e85658589eddcdbb5fca55b37ebb2692979654a23c6d0fb38570
MD5 SHA1 SHA512

Score

10^/10

xpertrat special x evasion persistence rat trojan

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

special X

C2

papertyy.duckdns.org:4145
ghytrty.duckdns.org:4145

Mutex

G7M3E0W6-E4D2-N1R0-S0C7-P1M2G5S6Y0H4

Signatures

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
XpertRAT
XpertRAT is a remote access trojan with various capabilities.
rat xpertrat

XpertRAT Core Payload 3 IoCs

resource	yara_rule
behavioral2/memory/2424-4-0x0000000000400000-0x0000000000443000-memory.dmp	xpertrat
behavioral2/memory/2424-5-0x0000000000401364-mapping.dmp	xpertrat
behavioral2/memory/2424-6-0x0000000000400000-0x0000000000443000-memory.dmp	xpertrat

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\G7M3E0W6-E4D2-N1R0-S0C7-P1M2G5S6Y0H4 = "C:\\Users\\Admin\\AppData\\Roaming\\G7M3E0W6-E4D2-N1R0-S0C7-P1M2G5S6Y0H4\\G7M3E0W6-E4D2-N1R0-S0C7-P1M2G5S6Y0H4.exe"	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	iexplore.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	4b448c2f70404c6b0dae7ee65bc2cd96.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\G7M3E0W6-E4D2-N1R0-S0C7-P1M2G5S6Y0H4 = "C:\\Users\\Admin\\AppData\\Roaming\\G7M3E0W6-E4D2-N1R0-S0C7-P1M2G5S6Y0H4\\G7M3E0W6-E4D2-N1R0-S0C7-P1M2G5S6Y0H4.exe"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\G7M3E0W6-E4D2-N1R0-S0C7-P1M2G5S6Y0H4 = "C:\\Users\\Admin\\AppData\\Roaming\\G7M3E0W6-E4D2-N1R0-S0C7-P1M2G5S6Y0H4\\G7M3E0W6-E4D2-N1R0-S0C7-P1M2G5S6Y0H4.exe"	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	iexplore.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	4b448c2f70404c6b0dae7ee65bc2cd96.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 732 set thread context of 2424	732	4b448c2f70404c6b0dae7ee65bc2cd96.exe	75

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
732	4b448c2f70404c6b0dae7ee65bc2cd96.exe
732	4b448c2f70404c6b0dae7ee65bc2cd96.exe
732	4b448c2f70404c6b0dae7ee65bc2cd96.exe
732	4b448c2f70404c6b0dae7ee65bc2cd96.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2424	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
732	4b448c2f70404c6b0dae7ee65bc2cd96.exe
2424	iexplore.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 732 wrote to memory of 2424	732	4b448c2f70404c6b0dae7ee65bc2cd96.exe	75
PID 732 wrote to memory of 2424	732	4b448c2f70404c6b0dae7ee65bc2cd96.exe	75
PID 732 wrote to memory of 2424	732	4b448c2f70404c6b0dae7ee65bc2cd96.exe	75
PID 732 wrote to memory of 2424	732	4b448c2f70404c6b0dae7ee65bc2cd96.exe	75
PID 732 wrote to memory of 2424	732	4b448c2f70404c6b0dae7ee65bc2cd96.exe	75
PID 732 wrote to memory of 2424	732	4b448c2f70404c6b0dae7ee65bc2cd96.exe	75
PID 732 wrote to memory of 2424	732	4b448c2f70404c6b0dae7ee65bc2cd96.exe	75
PID 732 wrote to memory of 2424	732	4b448c2f70404c6b0dae7ee65bc2cd96.exe	75

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	4b448c2f70404c6b0dae7ee65bc2cd96.exe

C:\Users\Admin\AppData\Local\Temp\4b448c2f70404c6b0dae7ee65bc2cd96.exe
"C:\Users\Admin\AppData\Local\Temp\4b448c2f70404c6b0dae7ee65bc2cd96.exe"
1⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:732
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  C:\Users\Admin\AppData\Local\Temp\4b448c2f70404c6b0dae7ee65bc2cd96.exe
  2⤵
  - Adds policy Run key to start application
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2424