Analysis
-
max time kernel
135s -
max time network
183s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
01-07-2021 06:32
Static task
static1
Behavioral task
behavioral1
Sample
173e540463300babea87380df68d79c2.exe
Resource
win7v20210410
General
-
Target
173e540463300babea87380df68d79c2.exe
-
Size
888KB
-
MD5
173e540463300babea87380df68d79c2
-
SHA1
2743c5503618c05afa9cea47b04d4965c1539d9a
-
SHA256
51297f05449c2fe207a4635e0d1123c137bfdfd97157e09b00af119733952197
-
SHA512
f2e3f94c0c8a32ef545f11da9ff6924f8d906b6099ce0239b7308dc8216b4b7055e642c1aea212e9147911bc275a455e51f0f6fb67ba24264a6728823c8c53fa
Malware Config
Extracted
xpertrat
3.0.10
special X
mertrerfeyy.duckdns.org:8494
gwtruwhgw.duckdns.org:8494
dfgrttuutii.duckdns.org:8494
M2P7W1K1-J110-W5Y5-F7Y0-B2B7A0M6B1K7
Signatures
-
XpertRAT Core Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1460-70-0x0000000000400000-0x0000000000443000-memory.dmp xpertrat behavioral1/memory/1460-71-0x0000000000401364-mapping.dmp xpertrat -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\M2P7W1K1-J110-W5Y5-F7Y0-B2B7A0M6B1K7 = "C:\\Users\\Admin\\AppData\\Roaming\\M2P7W1K1-J110-W5Y5-F7Y0-B2B7A0M6B1K7\\M2P7W1K1-J110-W5Y5-F7Y0-B2B7A0M6B1K7.exe" iexplore.exe -
Processes:
173e540463300babea87380df68d79c2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" 173e540463300babea87380df68d79c2.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\M2P7W1K1-J110-W5Y5-F7Y0-B2B7A0M6B1K7 = "C:\\Users\\Admin\\AppData\\Roaming\\M2P7W1K1-J110-W5Y5-F7Y0-B2B7A0M6B1K7\\M2P7W1K1-J110-W5Y5-F7Y0-B2B7A0M6B1K7.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\M2P7W1K1-J110-W5Y5-F7Y0-B2B7A0M6B1K7 = "C:\\Users\\Admin\\AppData\\Roaming\\M2P7W1K1-J110-W5Y5-F7Y0-B2B7A0M6B1K7\\M2P7W1K1-J110-W5Y5-F7Y0-B2B7A0M6B1K7.exe" iexplore.exe -
Processes:
173e540463300babea87380df68d79c2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 173e540463300babea87380df68d79c2.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
173e540463300babea87380df68d79c2.exe173e540463300babea87380df68d79c2.exedescription pid process target process PID 1836 set thread context of 268 1836 173e540463300babea87380df68d79c2.exe 173e540463300babea87380df68d79c2.exe PID 268 set thread context of 1460 268 173e540463300babea87380df68d79c2.exe iexplore.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
173e540463300babea87380df68d79c2.exepid process 268 173e540463300babea87380df68d79c2.exe 268 173e540463300babea87380df68d79c2.exe 268 173e540463300babea87380df68d79c2.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
iexplore.exedescription pid process Token: SeDebugPrivilege 1460 iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
173e540463300babea87380df68d79c2.exeiexplore.exepid process 268 173e540463300babea87380df68d79c2.exe 1460 iexplore.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
173e540463300babea87380df68d79c2.exe173e540463300babea87380df68d79c2.exedescription pid process target process PID 1836 wrote to memory of 268 1836 173e540463300babea87380df68d79c2.exe 173e540463300babea87380df68d79c2.exe PID 1836 wrote to memory of 268 1836 173e540463300babea87380df68d79c2.exe 173e540463300babea87380df68d79c2.exe PID 1836 wrote to memory of 268 1836 173e540463300babea87380df68d79c2.exe 173e540463300babea87380df68d79c2.exe PID 1836 wrote to memory of 268 1836 173e540463300babea87380df68d79c2.exe 173e540463300babea87380df68d79c2.exe PID 1836 wrote to memory of 268 1836 173e540463300babea87380df68d79c2.exe 173e540463300babea87380df68d79c2.exe PID 1836 wrote to memory of 268 1836 173e540463300babea87380df68d79c2.exe 173e540463300babea87380df68d79c2.exe PID 1836 wrote to memory of 268 1836 173e540463300babea87380df68d79c2.exe 173e540463300babea87380df68d79c2.exe PID 1836 wrote to memory of 268 1836 173e540463300babea87380df68d79c2.exe 173e540463300babea87380df68d79c2.exe PID 268 wrote to memory of 1460 268 173e540463300babea87380df68d79c2.exe iexplore.exe PID 268 wrote to memory of 1460 268 173e540463300babea87380df68d79c2.exe iexplore.exe PID 268 wrote to memory of 1460 268 173e540463300babea87380df68d79c2.exe iexplore.exe PID 268 wrote to memory of 1460 268 173e540463300babea87380df68d79c2.exe iexplore.exe PID 268 wrote to memory of 1460 268 173e540463300babea87380df68d79c2.exe iexplore.exe PID 268 wrote to memory of 1460 268 173e540463300babea87380df68d79c2.exe iexplore.exe PID 268 wrote to memory of 1460 268 173e540463300babea87380df68d79c2.exe iexplore.exe PID 268 wrote to memory of 1460 268 173e540463300babea87380df68d79c2.exe iexplore.exe PID 268 wrote to memory of 1460 268 173e540463300babea87380df68d79c2.exe iexplore.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
173e540463300babea87380df68d79c2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 173e540463300babea87380df68d79c2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\173e540463300babea87380df68d79c2.exe"C:\Users\Admin\AppData\Local\Temp\173e540463300babea87380df68d79c2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\173e540463300babea87380df68d79c2.exe"{path}"2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\173e540463300babea87380df68d79c2.exe3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/268-67-0x00000000004010B8-mapping.dmp
-
memory/268-66-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1460-70-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/1460-71-0x0000000000401364-mapping.dmp
-
memory/1460-72-0x0000000000160000-0x00000000002B3000-memory.dmpFilesize
1.3MB
-
memory/1460-76-0x00000000757D1000-0x00000000757D3000-memory.dmpFilesize
8KB
-
memory/1836-0-0x0000000000990000-0x0000000000991000-memory.dmpFilesize
4KB
-
memory/1836-2-0x0000000004D70000-0x0000000004D71000-memory.dmpFilesize
4KB
-
memory/1836-3-0x0000000000380000-0x0000000000382000-memory.dmpFilesize
8KB
-
memory/1836-64-0x00000000080F0000-0x00000000081A1000-memory.dmpFilesize
708KB
-
memory/1836-65-0x0000000005230000-0x0000000005295000-memory.dmpFilesize
404KB