Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
21-04-2021 13:35
Static task
static1
Behavioral task
behavioral1
Sample
40e678e7d38a1541c06d16895d75f856.exe
Resource
win7v20210408
General
-
Target
40e678e7d38a1541c06d16895d75f856.exe
-
Size
774KB
-
MD5
40e678e7d38a1541c06d16895d75f856
-
SHA1
5faee553c8dc1cc0492d7b8b78329ac56100c040
-
SHA256
7aa6ba1ed3e72514eac19d8b9ee4f95a17e33b63159bc75bd57ad8b38ce6361e
-
SHA512
4abce8638860dc80ec23516aba60cd1c87a66c8a98fb62730e042a8f78841afe45fd2c021f15395a06eb0b4b4e6a95809ce0d8d6806f95c2cc516caa7362be22
Malware Config
Extracted
xpertrat
3.0.10
XXX
kapasky-antivirus.firewall-gateway.net:2054
kapasky-antivirus.firewall-gateway.net:4000
U4G3L113-M7Y0-X0M5-M3D5-U8C7U551Q8Q7
Signatures
-
XpertRAT Core Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3456-128-0x0000000000400000-0x0000000000443000-memory.dmp xpertrat behavioral2/memory/3456-129-0x0000000000401364-mapping.dmp xpertrat -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\U4G3L113-M7Y0-X0M5-M3D5-U8C7U551Q8Q7 = "C:\\Users\\Admin\\AppData\\Roaming\\U4G3L113-M7Y0-X0M5-M3D5-U8C7U551Q8Q7\\U4G3L113-M7Y0-X0M5-M3D5-U8C7U551Q8Q7.exe" iexplore.exe -
Processes:
40e678e7d38a1541c06d16895d75f856.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" 40e678e7d38a1541c06d16895d75f856.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\U4G3L113-M7Y0-X0M5-M3D5-U8C7U551Q8Q7 = "C:\\Users\\Admin\\AppData\\Roaming\\U4G3L113-M7Y0-X0M5-M3D5-U8C7U551Q8Q7\\U4G3L113-M7Y0-X0M5-M3D5-U8C7U551Q8Q7.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\U4G3L113-M7Y0-X0M5-M3D5-U8C7U551Q8Q7 = "C:\\Users\\Admin\\AppData\\Roaming\\U4G3L113-M7Y0-X0M5-M3D5-U8C7U551Q8Q7\\U4G3L113-M7Y0-X0M5-M3D5-U8C7U551Q8Q7.exe" iexplore.exe -
Processes:
40e678e7d38a1541c06d16895d75f856.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 40e678e7d38a1541c06d16895d75f856.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
40e678e7d38a1541c06d16895d75f856.exe40e678e7d38a1541c06d16895d75f856.exedescription pid process target process PID 3896 set thread context of 3276 3896 40e678e7d38a1541c06d16895d75f856.exe 40e678e7d38a1541c06d16895d75f856.exe PID 3276 set thread context of 3456 3276 40e678e7d38a1541c06d16895d75f856.exe iexplore.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
40e678e7d38a1541c06d16895d75f856.exepid process 3276 40e678e7d38a1541c06d16895d75f856.exe 3276 40e678e7d38a1541c06d16895d75f856.exe 3276 40e678e7d38a1541c06d16895d75f856.exe 3276 40e678e7d38a1541c06d16895d75f856.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
iexplore.exedescription pid process Token: SeDebugPrivilege 3456 iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
40e678e7d38a1541c06d16895d75f856.exeiexplore.exepid process 3276 40e678e7d38a1541c06d16895d75f856.exe 3456 iexplore.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
40e678e7d38a1541c06d16895d75f856.exe40e678e7d38a1541c06d16895d75f856.exedescription pid process target process PID 3896 wrote to memory of 3276 3896 40e678e7d38a1541c06d16895d75f856.exe 40e678e7d38a1541c06d16895d75f856.exe PID 3896 wrote to memory of 3276 3896 40e678e7d38a1541c06d16895d75f856.exe 40e678e7d38a1541c06d16895d75f856.exe PID 3896 wrote to memory of 3276 3896 40e678e7d38a1541c06d16895d75f856.exe 40e678e7d38a1541c06d16895d75f856.exe PID 3896 wrote to memory of 3276 3896 40e678e7d38a1541c06d16895d75f856.exe 40e678e7d38a1541c06d16895d75f856.exe PID 3896 wrote to memory of 3276 3896 40e678e7d38a1541c06d16895d75f856.exe 40e678e7d38a1541c06d16895d75f856.exe PID 3896 wrote to memory of 3276 3896 40e678e7d38a1541c06d16895d75f856.exe 40e678e7d38a1541c06d16895d75f856.exe PID 3896 wrote to memory of 3276 3896 40e678e7d38a1541c06d16895d75f856.exe 40e678e7d38a1541c06d16895d75f856.exe PID 3276 wrote to memory of 3456 3276 40e678e7d38a1541c06d16895d75f856.exe iexplore.exe PID 3276 wrote to memory of 3456 3276 40e678e7d38a1541c06d16895d75f856.exe iexplore.exe PID 3276 wrote to memory of 3456 3276 40e678e7d38a1541c06d16895d75f856.exe iexplore.exe PID 3276 wrote to memory of 3456 3276 40e678e7d38a1541c06d16895d75f856.exe iexplore.exe PID 3276 wrote to memory of 3456 3276 40e678e7d38a1541c06d16895d75f856.exe iexplore.exe PID 3276 wrote to memory of 3456 3276 40e678e7d38a1541c06d16895d75f856.exe iexplore.exe PID 3276 wrote to memory of 3456 3276 40e678e7d38a1541c06d16895d75f856.exe iexplore.exe PID 3276 wrote to memory of 3456 3276 40e678e7d38a1541c06d16895d75f856.exe iexplore.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
40e678e7d38a1541c06d16895d75f856.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 40e678e7d38a1541c06d16895d75f856.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\40e678e7d38a1541c06d16895d75f856.exe"C:\Users\Admin\AppData\Local\Temp\40e678e7d38a1541c06d16895d75f856.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\40e678e7d38a1541c06d16895d75f856.exe"{path}"2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\40e678e7d38a1541c06d16895d75f856.exe3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3276-124-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/3276-130-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/3276-125-0x00000000004010B8-mapping.dmp
-
memory/3456-134-0x0000000003771000-0x000000000386D000-memory.dmpFilesize
1008KB
-
memory/3456-133-0x0000000003770000-0x00000000038C3000-memory.dmpFilesize
1.3MB
-
memory/3456-129-0x0000000000401364-mapping.dmp
-
memory/3456-128-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/3896-119-0x00000000050B0000-0x0000000005142000-memory.dmpFilesize
584KB
-
memory/3896-123-0x0000000009DB0000-0x0000000009E27000-memory.dmpFilesize
476KB
-
memory/3896-122-0x0000000007690000-0x0000000007755000-memory.dmpFilesize
788KB
-
memory/3896-121-0x0000000005690000-0x000000000569E000-memory.dmpFilesize
56KB
-
memory/3896-120-0x0000000007510000-0x0000000007511000-memory.dmpFilesize
4KB
-
memory/3896-114-0x0000000000860000-0x0000000000861000-memory.dmpFilesize
4KB
-
memory/3896-118-0x0000000005180000-0x0000000005181000-memory.dmpFilesize
4KB
-
memory/3896-117-0x00000000051E0000-0x00000000051E1000-memory.dmpFilesize
4KB
-
memory/3896-116-0x00000000056E0000-0x00000000056E1000-memory.dmpFilesize
4KB