Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
24-04-2021 07:40
Static task
static1
Behavioral task
behavioral1
Sample
63a7dd2640491df5075a08bf335545a6.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
63a7dd2640491df5075a08bf335545a6.exe
-
Size
1.9MB
-
MD5
63a7dd2640491df5075a08bf335545a6
-
SHA1
6bcdaa6627936d1c438d47016ad12ff018895fa6
-
SHA256
5c32fd3de4bce60a2529cebc5f47b8a1562ea9bd22549f829b22b0533b32f79b
-
SHA512
4e728c1d4d39efddc736c309fd5654cae0106ccaed8d40b9fc395a40576526e8e67afb6f974944c30ecf96476fe233aeeae56581d0647cb7d162ffbfeae0d756
Malware Config
Extracted
Family
xpertrat
Version
3.0.10
Botnet
special X
C2
ghytrty.duckdns.org:4145
spapertyy.duckdns.org:4145
Mutex
L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0
Signatures
-
XpertRAT Core Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1252-70-0x0000000000401364-mapping.dmp xpertrat behavioral1/memory/1252-69-0x0000000000400000-0x0000000000443000-memory.dmp xpertrat -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0\\L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0.exe" iexplore.exe -
Processes:
63a7dd2640491df5075a08bf335545a6.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" 63a7dd2640491df5075a08bf335545a6.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0\\L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0\\L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0.exe" iexplore.exe -
Processes:
63a7dd2640491df5075a08bf335545a6.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 63a7dd2640491df5075a08bf335545a6.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
63a7dd2640491df5075a08bf335545a6.exe63a7dd2640491df5075a08bf335545a6.exedescription pid process target process PID 1056 set thread context of 1656 1056 63a7dd2640491df5075a08bf335545a6.exe 63a7dd2640491df5075a08bf335545a6.exe PID 1656 set thread context of 1252 1656 63a7dd2640491df5075a08bf335545a6.exe iexplore.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
63a7dd2640491df5075a08bf335545a6.exe63a7dd2640491df5075a08bf335545a6.exepid process 1056 63a7dd2640491df5075a08bf335545a6.exe 1056 63a7dd2640491df5075a08bf335545a6.exe 1656 63a7dd2640491df5075a08bf335545a6.exe 1656 63a7dd2640491df5075a08bf335545a6.exe 1656 63a7dd2640491df5075a08bf335545a6.exe 1656 63a7dd2640491df5075a08bf335545a6.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
63a7dd2640491df5075a08bf335545a6.exeiexplore.exedescription pid process Token: SeDebugPrivilege 1056 63a7dd2640491df5075a08bf335545a6.exe Token: SeDebugPrivilege 1252 iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
63a7dd2640491df5075a08bf335545a6.exeiexplore.exepid process 1656 63a7dd2640491df5075a08bf335545a6.exe 1252 iexplore.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
63a7dd2640491df5075a08bf335545a6.exe63a7dd2640491df5075a08bf335545a6.exedescription pid process target process PID 1056 wrote to memory of 1612 1056 63a7dd2640491df5075a08bf335545a6.exe 63a7dd2640491df5075a08bf335545a6.exe PID 1056 wrote to memory of 1612 1056 63a7dd2640491df5075a08bf335545a6.exe 63a7dd2640491df5075a08bf335545a6.exe PID 1056 wrote to memory of 1612 1056 63a7dd2640491df5075a08bf335545a6.exe 63a7dd2640491df5075a08bf335545a6.exe PID 1056 wrote to memory of 1612 1056 63a7dd2640491df5075a08bf335545a6.exe 63a7dd2640491df5075a08bf335545a6.exe PID 1056 wrote to memory of 1656 1056 63a7dd2640491df5075a08bf335545a6.exe 63a7dd2640491df5075a08bf335545a6.exe PID 1056 wrote to memory of 1656 1056 63a7dd2640491df5075a08bf335545a6.exe 63a7dd2640491df5075a08bf335545a6.exe PID 1056 wrote to memory of 1656 1056 63a7dd2640491df5075a08bf335545a6.exe 63a7dd2640491df5075a08bf335545a6.exe PID 1056 wrote to memory of 1656 1056 63a7dd2640491df5075a08bf335545a6.exe 63a7dd2640491df5075a08bf335545a6.exe PID 1056 wrote to memory of 1656 1056 63a7dd2640491df5075a08bf335545a6.exe 63a7dd2640491df5075a08bf335545a6.exe PID 1056 wrote to memory of 1656 1056 63a7dd2640491df5075a08bf335545a6.exe 63a7dd2640491df5075a08bf335545a6.exe PID 1056 wrote to memory of 1656 1056 63a7dd2640491df5075a08bf335545a6.exe 63a7dd2640491df5075a08bf335545a6.exe PID 1056 wrote to memory of 1656 1056 63a7dd2640491df5075a08bf335545a6.exe 63a7dd2640491df5075a08bf335545a6.exe PID 1656 wrote to memory of 1252 1656 63a7dd2640491df5075a08bf335545a6.exe iexplore.exe PID 1656 wrote to memory of 1252 1656 63a7dd2640491df5075a08bf335545a6.exe iexplore.exe PID 1656 wrote to memory of 1252 1656 63a7dd2640491df5075a08bf335545a6.exe iexplore.exe PID 1656 wrote to memory of 1252 1656 63a7dd2640491df5075a08bf335545a6.exe iexplore.exe PID 1656 wrote to memory of 1252 1656 63a7dd2640491df5075a08bf335545a6.exe iexplore.exe PID 1656 wrote to memory of 1252 1656 63a7dd2640491df5075a08bf335545a6.exe iexplore.exe PID 1656 wrote to memory of 1252 1656 63a7dd2640491df5075a08bf335545a6.exe iexplore.exe PID 1656 wrote to memory of 1252 1656 63a7dd2640491df5075a08bf335545a6.exe iexplore.exe PID 1656 wrote to memory of 1252 1656 63a7dd2640491df5075a08bf335545a6.exe iexplore.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
63a7dd2640491df5075a08bf335545a6.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 63a7dd2640491df5075a08bf335545a6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\63a7dd2640491df5075a08bf335545a6.exe"C:\Users\Admin\AppData\Local\Temp\63a7dd2640491df5075a08bf335545a6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\63a7dd2640491df5075a08bf335545a6.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\63a7dd2640491df5075a08bf335545a6.exe"{path}"2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\63a7dd2640491df5075a08bf335545a6.exe3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1056-59-0x0000000001380000-0x0000000001381000-memory.dmpFilesize
4KB
-
memory/1056-61-0x0000000001340000-0x0000000001341000-memory.dmpFilesize
4KB
-
memory/1056-62-0x0000000000610000-0x000000000061E000-memory.dmpFilesize
56KB
-
memory/1056-63-0x0000000008F00000-0x0000000008F7D000-memory.dmpFilesize
500KB
-
memory/1056-64-0x0000000008E50000-0x0000000008E7D000-memory.dmpFilesize
180KB
-
memory/1252-70-0x0000000000401364-mapping.dmp
-
memory/1252-69-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/1252-71-0x0000000000450000-0x00000000005A3000-memory.dmpFilesize
1.3MB
-
memory/1252-75-0x00000000766D1000-0x00000000766D3000-memory.dmpFilesize
8KB
-
memory/1656-65-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1656-66-0x00000000004010B8-mapping.dmp