Analysis
-
max time kernel
145s -
max time network
154s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
01-07-2021 06:32
Static task
static1
Behavioral task
behavioral1
Sample
173e540463300babea87380df68d79c2.exe
Resource
win7v20210410
General
-
Target
173e540463300babea87380df68d79c2.exe
-
Size
888KB
-
MD5
173e540463300babea87380df68d79c2
-
SHA1
2743c5503618c05afa9cea47b04d4965c1539d9a
-
SHA256
51297f05449c2fe207a4635e0d1123c137bfdfd97157e09b00af119733952197
-
SHA512
f2e3f94c0c8a32ef545f11da9ff6924f8d906b6099ce0239b7308dc8216b4b7055e642c1aea212e9147911bc275a455e51f0f6fb67ba24264a6728823c8c53fa
Malware Config
Extracted
xpertrat
3.0.10
special X
mertrerfeyy.duckdns.org:8494
gwtruwhgw.duckdns.org:8494
dfgrttuutii.duckdns.org:8494
M2P7W1K1-J110-W5Y5-F7Y0-B2B7A0M6B1K7
Signatures
-
XpertRAT Core Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4068-129-0x0000000000400000-0x0000000000443000-memory.dmp xpertrat behavioral2/memory/4068-130-0x0000000000401364-mapping.dmp xpertrat -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\M2P7W1K1-J110-W5Y5-F7Y0-B2B7A0M6B1K7 = "C:\\Users\\Admin\\AppData\\Roaming\\M2P7W1K1-J110-W5Y5-F7Y0-B2B7A0M6B1K7\\M2P7W1K1-J110-W5Y5-F7Y0-B2B7A0M6B1K7.exe" iexplore.exe -
Processes:
173e540463300babea87380df68d79c2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" 173e540463300babea87380df68d79c2.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\M2P7W1K1-J110-W5Y5-F7Y0-B2B7A0M6B1K7 = "C:\\Users\\Admin\\AppData\\Roaming\\M2P7W1K1-J110-W5Y5-F7Y0-B2B7A0M6B1K7\\M2P7W1K1-J110-W5Y5-F7Y0-B2B7A0M6B1K7.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\M2P7W1K1-J110-W5Y5-F7Y0-B2B7A0M6B1K7 = "C:\\Users\\Admin\\AppData\\Roaming\\M2P7W1K1-J110-W5Y5-F7Y0-B2B7A0M6B1K7\\M2P7W1K1-J110-W5Y5-F7Y0-B2B7A0M6B1K7.exe" iexplore.exe -
Processes:
173e540463300babea87380df68d79c2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 173e540463300babea87380df68d79c2.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
173e540463300babea87380df68d79c2.exe173e540463300babea87380df68d79c2.exedescription pid process target process PID 4048 set thread context of 2932 4048 173e540463300babea87380df68d79c2.exe 173e540463300babea87380df68d79c2.exe PID 2932 set thread context of 4068 2932 173e540463300babea87380df68d79c2.exe iexplore.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
173e540463300babea87380df68d79c2.exepid process 2932 173e540463300babea87380df68d79c2.exe 2932 173e540463300babea87380df68d79c2.exe 2932 173e540463300babea87380df68d79c2.exe 2932 173e540463300babea87380df68d79c2.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
iexplore.exedescription pid process Token: SeDebugPrivilege 4068 iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
173e540463300babea87380df68d79c2.exeiexplore.exepid process 2932 173e540463300babea87380df68d79c2.exe 4068 iexplore.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
173e540463300babea87380df68d79c2.exe173e540463300babea87380df68d79c2.exedescription pid process target process PID 4048 wrote to memory of 2932 4048 173e540463300babea87380df68d79c2.exe 173e540463300babea87380df68d79c2.exe PID 4048 wrote to memory of 2932 4048 173e540463300babea87380df68d79c2.exe 173e540463300babea87380df68d79c2.exe PID 4048 wrote to memory of 2932 4048 173e540463300babea87380df68d79c2.exe 173e540463300babea87380df68d79c2.exe PID 4048 wrote to memory of 2932 4048 173e540463300babea87380df68d79c2.exe 173e540463300babea87380df68d79c2.exe PID 4048 wrote to memory of 2932 4048 173e540463300babea87380df68d79c2.exe 173e540463300babea87380df68d79c2.exe PID 4048 wrote to memory of 2932 4048 173e540463300babea87380df68d79c2.exe 173e540463300babea87380df68d79c2.exe PID 4048 wrote to memory of 2932 4048 173e540463300babea87380df68d79c2.exe 173e540463300babea87380df68d79c2.exe PID 2932 wrote to memory of 4068 2932 173e540463300babea87380df68d79c2.exe iexplore.exe PID 2932 wrote to memory of 4068 2932 173e540463300babea87380df68d79c2.exe iexplore.exe PID 2932 wrote to memory of 4068 2932 173e540463300babea87380df68d79c2.exe iexplore.exe PID 2932 wrote to memory of 4068 2932 173e540463300babea87380df68d79c2.exe iexplore.exe PID 2932 wrote to memory of 4068 2932 173e540463300babea87380df68d79c2.exe iexplore.exe PID 2932 wrote to memory of 4068 2932 173e540463300babea87380df68d79c2.exe iexplore.exe PID 2932 wrote to memory of 4068 2932 173e540463300babea87380df68d79c2.exe iexplore.exe PID 2932 wrote to memory of 4068 2932 173e540463300babea87380df68d79c2.exe iexplore.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
173e540463300babea87380df68d79c2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 173e540463300babea87380df68d79c2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\173e540463300babea87380df68d79c2.exe"C:\Users\Admin\AppData\Local\Temp\173e540463300babea87380df68d79c2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\173e540463300babea87380df68d79c2.exe"{path}"2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\173e540463300babea87380df68d79c2.exe3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2932-124-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2932-128-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2932-125-0x00000000004010B8-mapping.dmp
-
memory/4048-123-0x000000000B370000-0x000000000B3D5000-memory.dmpFilesize
404KB
-
memory/4048-119-0x00000000051F0000-0x00000000051F1000-memory.dmpFilesize
4KB
-
memory/4048-120-0x0000000005140000-0x000000000563E000-memory.dmpFilesize
5.0MB
-
memory/4048-121-0x00000000055D0000-0x00000000055D2000-memory.dmpFilesize
8KB
-
memory/4048-122-0x0000000008B40000-0x0000000008BF1000-memory.dmpFilesize
708KB
-
memory/4048-114-0x0000000000810000-0x0000000000811000-memory.dmpFilesize
4KB
-
memory/4048-118-0x0000000005280000-0x0000000005281000-memory.dmpFilesize
4KB
-
memory/4048-117-0x0000000005140000-0x0000000005141000-memory.dmpFilesize
4KB
-
memory/4048-116-0x0000000005640000-0x0000000005641000-memory.dmpFilesize
4KB
-
memory/4068-129-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/4068-130-0x0000000000401364-mapping.dmp
-
memory/4068-133-0x0000000000EA0000-0x0000000000FF3000-memory.dmpFilesize
1.3MB
-
memory/4068-134-0x0000000000EA1000-0x0000000000F9D000-memory.dmpFilesize
1008KB