Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
25-04-2021 07:07
Static task
static1
Behavioral task
behavioral1
Sample
1f609ed72b74f23379e8d7636b5faa13.exe
Resource
win7v20210410
General
-
Target
1f609ed72b74f23379e8d7636b5faa13.exe
-
Size
25KB
-
MD5
1f609ed72b74f23379e8d7636b5faa13
-
SHA1
439d50691f585b1a3cd674a0852834a97d9fc9cb
-
SHA256
29a4c9380a91012be5a2b3659f9a4c46d0eca15c689a95707f78ccde9cd11f02
-
SHA512
15eb37df42c5747aad644844b7ed3a7da98855e443e5293a64ebf092025e9210e99dbc7889c92854bcbfbf1840004a6c0b2c086a20d6a968f22354f0cd1161b4
Malware Config
Extracted
xpertrat
3.0.10
special X
ghytrty.duckdns.org:4145
spapertyy.duckdns.org:4145
L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0
Signatures
-
XpertRAT Core Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3900-126-0x0000000000400000-0x0000000000443000-memory.dmp xpertrat behavioral2/memory/3900-127-0x0000000000401364-mapping.dmp xpertrat -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0\\L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0.exe" iexplore.exe -
Processes:
1f609ed72b74f23379e8d7636b5faa13.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" 1f609ed72b74f23379e8d7636b5faa13.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0\\L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0\\L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0.exe" iexplore.exe -
Processes:
1f609ed72b74f23379e8d7636b5faa13.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1f609ed72b74f23379e8d7636b5faa13.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
Processes:
1f609ed72b74f23379e8d7636b5faa13.exepid process 3876 1f609ed72b74f23379e8d7636b5faa13.exe 3876 1f609ed72b74f23379e8d7636b5faa13.exe 3876 1f609ed72b74f23379e8d7636b5faa13.exe 3876 1f609ed72b74f23379e8d7636b5faa13.exe 3876 1f609ed72b74f23379e8d7636b5faa13.exe 3876 1f609ed72b74f23379e8d7636b5faa13.exe 3876 1f609ed72b74f23379e8d7636b5faa13.exe 3876 1f609ed72b74f23379e8d7636b5faa13.exe 3876 1f609ed72b74f23379e8d7636b5faa13.exe 3876 1f609ed72b74f23379e8d7636b5faa13.exe 3876 1f609ed72b74f23379e8d7636b5faa13.exe 3876 1f609ed72b74f23379e8d7636b5faa13.exe 3876 1f609ed72b74f23379e8d7636b5faa13.exe 3876 1f609ed72b74f23379e8d7636b5faa13.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
1f609ed72b74f23379e8d7636b5faa13.exe1f609ed72b74f23379e8d7636b5faa13.exedescription pid process target process PID 3876 set thread context of 192 3876 1f609ed72b74f23379e8d7636b5faa13.exe 1f609ed72b74f23379e8d7636b5faa13.exe PID 192 set thread context of 3900 192 1f609ed72b74f23379e8d7636b5faa13.exe iexplore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3560 3876 WerFault.exe 1f609ed72b74f23379e8d7636b5faa13.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3904 timeout.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
1f609ed72b74f23379e8d7636b5faa13.exe1f609ed72b74f23379e8d7636b5faa13.exeWerFault.exepid process 3876 1f609ed72b74f23379e8d7636b5faa13.exe 3876 1f609ed72b74f23379e8d7636b5faa13.exe 3876 1f609ed72b74f23379e8d7636b5faa13.exe 192 1f609ed72b74f23379e8d7636b5faa13.exe 192 1f609ed72b74f23379e8d7636b5faa13.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 192 1f609ed72b74f23379e8d7636b5faa13.exe 192 1f609ed72b74f23379e8d7636b5faa13.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
1f609ed72b74f23379e8d7636b5faa13.exeWerFault.exeiexplore.exedescription pid process Token: SeDebugPrivilege 3876 1f609ed72b74f23379e8d7636b5faa13.exe Token: SeRestorePrivilege 3560 WerFault.exe Token: SeBackupPrivilege 3560 WerFault.exe Token: SeDebugPrivilege 3900 iexplore.exe Token: SeDebugPrivilege 3560 WerFault.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
1f609ed72b74f23379e8d7636b5faa13.exeiexplore.exepid process 192 1f609ed72b74f23379e8d7636b5faa13.exe 3900 iexplore.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
1f609ed72b74f23379e8d7636b5faa13.execmd.exe1f609ed72b74f23379e8d7636b5faa13.exedescription pid process target process PID 3876 wrote to memory of 3940 3876 1f609ed72b74f23379e8d7636b5faa13.exe cmd.exe PID 3876 wrote to memory of 3940 3876 1f609ed72b74f23379e8d7636b5faa13.exe cmd.exe PID 3876 wrote to memory of 3940 3876 1f609ed72b74f23379e8d7636b5faa13.exe cmd.exe PID 3940 wrote to memory of 3904 3940 cmd.exe timeout.exe PID 3940 wrote to memory of 3904 3940 cmd.exe timeout.exe PID 3940 wrote to memory of 3904 3940 cmd.exe timeout.exe PID 3876 wrote to memory of 192 3876 1f609ed72b74f23379e8d7636b5faa13.exe 1f609ed72b74f23379e8d7636b5faa13.exe PID 3876 wrote to memory of 192 3876 1f609ed72b74f23379e8d7636b5faa13.exe 1f609ed72b74f23379e8d7636b5faa13.exe PID 3876 wrote to memory of 192 3876 1f609ed72b74f23379e8d7636b5faa13.exe 1f609ed72b74f23379e8d7636b5faa13.exe PID 3876 wrote to memory of 192 3876 1f609ed72b74f23379e8d7636b5faa13.exe 1f609ed72b74f23379e8d7636b5faa13.exe PID 3876 wrote to memory of 192 3876 1f609ed72b74f23379e8d7636b5faa13.exe 1f609ed72b74f23379e8d7636b5faa13.exe PID 3876 wrote to memory of 192 3876 1f609ed72b74f23379e8d7636b5faa13.exe 1f609ed72b74f23379e8d7636b5faa13.exe PID 3876 wrote to memory of 192 3876 1f609ed72b74f23379e8d7636b5faa13.exe 1f609ed72b74f23379e8d7636b5faa13.exe PID 192 wrote to memory of 3900 192 1f609ed72b74f23379e8d7636b5faa13.exe iexplore.exe PID 192 wrote to memory of 3900 192 1f609ed72b74f23379e8d7636b5faa13.exe iexplore.exe PID 192 wrote to memory of 3900 192 1f609ed72b74f23379e8d7636b5faa13.exe iexplore.exe PID 192 wrote to memory of 3900 192 1f609ed72b74f23379e8d7636b5faa13.exe iexplore.exe PID 192 wrote to memory of 3900 192 1f609ed72b74f23379e8d7636b5faa13.exe iexplore.exe PID 192 wrote to memory of 3900 192 1f609ed72b74f23379e8d7636b5faa13.exe iexplore.exe PID 192 wrote to memory of 3900 192 1f609ed72b74f23379e8d7636b5faa13.exe iexplore.exe PID 192 wrote to memory of 3900 192 1f609ed72b74f23379e8d7636b5faa13.exe iexplore.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
1f609ed72b74f23379e8d7636b5faa13.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1f609ed72b74f23379e8d7636b5faa13.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f609ed72b74f23379e8d7636b5faa13.exe"C:\Users\Admin\AppData\Local\Temp\1f609ed72b74f23379e8d7636b5faa13.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\1f609ed72b74f23379e8d7636b5faa13.exe"C:\Users\Admin\AppData\Local\Temp\1f609ed72b74f23379e8d7636b5faa13.exe"2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\1f609ed72b74f23379e8d7636b5faa13.exe3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 18402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/192-122-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/192-130-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/192-123-0x00000000004010B8-mapping.dmp
-
memory/3876-116-0x0000000005010000-0x0000000005011000-memory.dmpFilesize
4KB
-
memory/3876-117-0x0000000004BF0000-0x0000000004BF1000-memory.dmpFilesize
4KB
-
memory/3876-118-0x0000000004B10000-0x000000000500E000-memory.dmpFilesize
5.0MB
-
memory/3876-119-0x00000000024C0000-0x00000000024F9000-memory.dmpFilesize
228KB
-
memory/3876-114-0x0000000000390000-0x0000000000391000-memory.dmpFilesize
4KB
-
memory/3900-126-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/3900-127-0x0000000000401364-mapping.dmp
-
memory/3900-132-0x0000000003100000-0x0000000003253000-memory.dmpFilesize
1.3MB
-
memory/3900-133-0x0000000003101000-0x00000000031FD000-memory.dmpFilesize
1008KB
-
memory/3904-121-0x0000000000000000-mapping.dmp
-
memory/3940-120-0x0000000000000000-mapping.dmp