Analysis
-
max time kernel
149s -
max time network
181s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
25-06-2021 08:07
Static task
static1
Behavioral task
behavioral1
Sample
66587368e39228edf1f6034794f17579.exe
Resource
win7v20210410
General
-
Target
66587368e39228edf1f6034794f17579.exe
-
Size
419KB
-
MD5
66587368e39228edf1f6034794f17579
-
SHA1
31268b1ac9bb83c698eadf5e74f65d58b12d2a50
-
SHA256
b6b8326fd527390a435242178b6a45a973c4516d831669ce7527c5d97e90ab10
-
SHA512
fdf02be618eb51fbdafa952b2eb60801d8448f0078c2127024ae2eb4d2542fdabad14bf0e5b127bea5c891a1986ed857032d1a519f3fc537e8296b7bb6a2d9f6
Malware Config
Extracted
xpertrat
3.0.10
special X
mertrerfeyy.duckdns.org:8494
gwtruwhgw.duckdns.org:8494
dfgrttuutii.duckdns.org:8494
J0B4S3L1-T6W3-H2L6-N2T2-W4T8H1F1E6U4
Signatures
-
XpertRAT Core Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1508-70-0x0000000000400000-0x0000000000443000-memory.dmp xpertrat behavioral1/memory/1508-71-0x0000000000401364-mapping.dmp xpertrat -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\J0B4S3L1-T6W3-H2L6-N2T2-W4T8H1F1E6U4 = "C:\\Users\\Admin\\AppData\\Roaming\\J0B4S3L1-T6W3-H2L6-N2T2-W4T8H1F1E6U4\\J0B4S3L1-T6W3-H2L6-N2T2-W4T8H1F1E6U4.exe" iexplore.exe -
Processes:
66587368e39228edf1f6034794f17579.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" 66587368e39228edf1f6034794f17579.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\J0B4S3L1-T6W3-H2L6-N2T2-W4T8H1F1E6U4 = "C:\\Users\\Admin\\AppData\\Roaming\\J0B4S3L1-T6W3-H2L6-N2T2-W4T8H1F1E6U4\\J0B4S3L1-T6W3-H2L6-N2T2-W4T8H1F1E6U4.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\J0B4S3L1-T6W3-H2L6-N2T2-W4T8H1F1E6U4 = "C:\\Users\\Admin\\AppData\\Roaming\\J0B4S3L1-T6W3-H2L6-N2T2-W4T8H1F1E6U4\\J0B4S3L1-T6W3-H2L6-N2T2-W4T8H1F1E6U4.exe" iexplore.exe -
Processes:
66587368e39228edf1f6034794f17579.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 66587368e39228edf1f6034794f17579.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
66587368e39228edf1f6034794f17579.exe66587368e39228edf1f6034794f17579.exedescription pid process target process PID 1208 set thread context of 1172 1208 66587368e39228edf1f6034794f17579.exe 66587368e39228edf1f6034794f17579.exe PID 1172 set thread context of 1508 1172 66587368e39228edf1f6034794f17579.exe iexplore.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
66587368e39228edf1f6034794f17579.exepid process 1172 66587368e39228edf1f6034794f17579.exe 1172 66587368e39228edf1f6034794f17579.exe 1172 66587368e39228edf1f6034794f17579.exe 1172 66587368e39228edf1f6034794f17579.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
iexplore.exedescription pid process Token: SeDebugPrivilege 1508 iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
66587368e39228edf1f6034794f17579.exeiexplore.exepid process 1172 66587368e39228edf1f6034794f17579.exe 1508 iexplore.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
66587368e39228edf1f6034794f17579.exe66587368e39228edf1f6034794f17579.exedescription pid process target process PID 1208 wrote to memory of 1172 1208 66587368e39228edf1f6034794f17579.exe 66587368e39228edf1f6034794f17579.exe PID 1208 wrote to memory of 1172 1208 66587368e39228edf1f6034794f17579.exe 66587368e39228edf1f6034794f17579.exe PID 1208 wrote to memory of 1172 1208 66587368e39228edf1f6034794f17579.exe 66587368e39228edf1f6034794f17579.exe PID 1208 wrote to memory of 1172 1208 66587368e39228edf1f6034794f17579.exe 66587368e39228edf1f6034794f17579.exe PID 1208 wrote to memory of 1172 1208 66587368e39228edf1f6034794f17579.exe 66587368e39228edf1f6034794f17579.exe PID 1208 wrote to memory of 1172 1208 66587368e39228edf1f6034794f17579.exe 66587368e39228edf1f6034794f17579.exe PID 1208 wrote to memory of 1172 1208 66587368e39228edf1f6034794f17579.exe 66587368e39228edf1f6034794f17579.exe PID 1208 wrote to memory of 1172 1208 66587368e39228edf1f6034794f17579.exe 66587368e39228edf1f6034794f17579.exe PID 1172 wrote to memory of 1508 1172 66587368e39228edf1f6034794f17579.exe iexplore.exe PID 1172 wrote to memory of 1508 1172 66587368e39228edf1f6034794f17579.exe iexplore.exe PID 1172 wrote to memory of 1508 1172 66587368e39228edf1f6034794f17579.exe iexplore.exe PID 1172 wrote to memory of 1508 1172 66587368e39228edf1f6034794f17579.exe iexplore.exe PID 1172 wrote to memory of 1508 1172 66587368e39228edf1f6034794f17579.exe iexplore.exe PID 1172 wrote to memory of 1508 1172 66587368e39228edf1f6034794f17579.exe iexplore.exe PID 1172 wrote to memory of 1508 1172 66587368e39228edf1f6034794f17579.exe iexplore.exe PID 1172 wrote to memory of 1508 1172 66587368e39228edf1f6034794f17579.exe iexplore.exe PID 1172 wrote to memory of 1508 1172 66587368e39228edf1f6034794f17579.exe iexplore.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
66587368e39228edf1f6034794f17579.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 66587368e39228edf1f6034794f17579.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\66587368e39228edf1f6034794f17579.exe"C:\Users\Admin\AppData\Local\Temp\66587368e39228edf1f6034794f17579.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\66587368e39228edf1f6034794f17579.exe"{path}"2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\66587368e39228edf1f6034794f17579.exe3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1172-66-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1172-67-0x00000000004010B8-mapping.dmp
-
memory/1208-60-0x0000000000CD0000-0x0000000000CD1000-memory.dmpFilesize
4KB
-
memory/1208-62-0x0000000004CD0000-0x0000000004CD1000-memory.dmpFilesize
4KB
-
memory/1208-63-0x0000000000230000-0x0000000000232000-memory.dmpFilesize
8KB
-
memory/1208-64-0x00000000050F0000-0x000000000516D000-memory.dmpFilesize
500KB
-
memory/1208-65-0x0000000000660000-0x000000000068E000-memory.dmpFilesize
184KB
-
memory/1508-70-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/1508-71-0x0000000000401364-mapping.dmp
-
memory/1508-72-0x0000000000850000-0x00000000009A3000-memory.dmpFilesize
1.3MB
-
memory/1508-76-0x0000000076281000-0x0000000076283000-memory.dmpFilesize
8KB