Analysis
-
max time kernel
79s -
max time network
136s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
24-04-2021 08:03
Static task
static1
Behavioral task
behavioral1
Sample
63a7dd2640491df5075a08bf335545a6.exe
Resource
win7v20210408
General
-
Target
63a7dd2640491df5075a08bf335545a6.exe
-
Size
1.9MB
-
MD5
63a7dd2640491df5075a08bf335545a6
-
SHA1
6bcdaa6627936d1c438d47016ad12ff018895fa6
-
SHA256
5c32fd3de4bce60a2529cebc5f47b8a1562ea9bd22549f829b22b0533b32f79b
-
SHA512
4e728c1d4d39efddc736c309fd5654cae0106ccaed8d40b9fc395a40576526e8e67afb6f974944c30ecf96476fe233aeeae56581d0647cb7d162ffbfeae0d756
Malware Config
Extracted
xpertrat
3.0.10
special X
ghytrty.duckdns.org:4145
spapertyy.duckdns.org:4145
L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0
Signatures
-
XpertRAT Core Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3812-130-0x0000000000401364-mapping.dmp xpertrat behavioral2/memory/3812-129-0x0000000000400000-0x0000000000443000-memory.dmp xpertrat -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0\\L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0.exe" iexplore.exe -
Processes:
63a7dd2640491df5075a08bf335545a6.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" 63a7dd2640491df5075a08bf335545a6.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0\\L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0\\L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0.exe" iexplore.exe -
Processes:
63a7dd2640491df5075a08bf335545a6.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 63a7dd2640491df5075a08bf335545a6.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
63a7dd2640491df5075a08bf335545a6.exe63a7dd2640491df5075a08bf335545a6.exedescription pid process target process PID 3680 set thread context of 3016 3680 63a7dd2640491df5075a08bf335545a6.exe 63a7dd2640491df5075a08bf335545a6.exe PID 3016 set thread context of 3812 3016 63a7dd2640491df5075a08bf335545a6.exe iexplore.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
63a7dd2640491df5075a08bf335545a6.exepid process 3016 63a7dd2640491df5075a08bf335545a6.exe 3016 63a7dd2640491df5075a08bf335545a6.exe 3016 63a7dd2640491df5075a08bf335545a6.exe 3016 63a7dd2640491df5075a08bf335545a6.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
iexplore.exedescription pid process Token: SeDebugPrivilege 3812 iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
63a7dd2640491df5075a08bf335545a6.exeiexplore.exepid process 3016 63a7dd2640491df5075a08bf335545a6.exe 3812 iexplore.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
63a7dd2640491df5075a08bf335545a6.exe63a7dd2640491df5075a08bf335545a6.exedescription pid process target process PID 3680 wrote to memory of 3016 3680 63a7dd2640491df5075a08bf335545a6.exe 63a7dd2640491df5075a08bf335545a6.exe PID 3680 wrote to memory of 3016 3680 63a7dd2640491df5075a08bf335545a6.exe 63a7dd2640491df5075a08bf335545a6.exe PID 3680 wrote to memory of 3016 3680 63a7dd2640491df5075a08bf335545a6.exe 63a7dd2640491df5075a08bf335545a6.exe PID 3680 wrote to memory of 3016 3680 63a7dd2640491df5075a08bf335545a6.exe 63a7dd2640491df5075a08bf335545a6.exe PID 3680 wrote to memory of 3016 3680 63a7dd2640491df5075a08bf335545a6.exe 63a7dd2640491df5075a08bf335545a6.exe PID 3680 wrote to memory of 3016 3680 63a7dd2640491df5075a08bf335545a6.exe 63a7dd2640491df5075a08bf335545a6.exe PID 3680 wrote to memory of 3016 3680 63a7dd2640491df5075a08bf335545a6.exe 63a7dd2640491df5075a08bf335545a6.exe PID 3016 wrote to memory of 3812 3016 63a7dd2640491df5075a08bf335545a6.exe iexplore.exe PID 3016 wrote to memory of 3812 3016 63a7dd2640491df5075a08bf335545a6.exe iexplore.exe PID 3016 wrote to memory of 3812 3016 63a7dd2640491df5075a08bf335545a6.exe iexplore.exe PID 3016 wrote to memory of 3812 3016 63a7dd2640491df5075a08bf335545a6.exe iexplore.exe PID 3016 wrote to memory of 3812 3016 63a7dd2640491df5075a08bf335545a6.exe iexplore.exe PID 3016 wrote to memory of 3812 3016 63a7dd2640491df5075a08bf335545a6.exe iexplore.exe PID 3016 wrote to memory of 3812 3016 63a7dd2640491df5075a08bf335545a6.exe iexplore.exe PID 3016 wrote to memory of 3812 3016 63a7dd2640491df5075a08bf335545a6.exe iexplore.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
63a7dd2640491df5075a08bf335545a6.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 63a7dd2640491df5075a08bf335545a6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\63a7dd2640491df5075a08bf335545a6.exe"C:\Users\Admin\AppData\Local\Temp\63a7dd2640491df5075a08bf335545a6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\63a7dd2640491df5075a08bf335545a6.exe"{path}"2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\63a7dd2640491df5075a08bf335545a6.exe3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3016-125-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/3016-137-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/3016-126-0x00000000004010B8-mapping.dmp
-
memory/3680-123-0x00000000077C0000-0x000000000783D000-memory.dmpFilesize
500KB
-
memory/3680-118-0x0000000005AC0000-0x0000000005AC1000-memory.dmpFilesize
4KB
-
memory/3680-120-0x00000000058B0000-0x00000000058B1000-memory.dmpFilesize
4KB
-
memory/3680-121-0x000000000A2C0000-0x000000000A2C1000-memory.dmpFilesize
4KB
-
memory/3680-122-0x000000000A230000-0x000000000A23E000-memory.dmpFilesize
56KB
-
memory/3680-114-0x0000000000B10000-0x0000000000B11000-memory.dmpFilesize
4KB
-
memory/3680-124-0x000000000CB70000-0x000000000CB9D000-memory.dmpFilesize
180KB
-
memory/3680-119-0x0000000005AA0000-0x0000000005AA1000-memory.dmpFilesize
4KB
-
memory/3680-117-0x0000000005EC0000-0x0000000005EC1000-memory.dmpFilesize
4KB
-
memory/3680-116-0x00000000054A0000-0x00000000054A1000-memory.dmpFilesize
4KB
-
memory/3812-129-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/3812-133-0x0000000003130000-0x0000000003283000-memory.dmpFilesize
1.3MB
-
memory/3812-134-0x0000000003131000-0x000000000322D000-memory.dmpFilesize
1008KB
-
memory/3812-130-0x0000000000401364-mapping.dmp