Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    12-07-2021 08:58

General

  • Target

    810436f7d29ced22beac8734da3acacf.exe

  • Size

    772KB

  • MD5

    810436f7d29ced22beac8734da3acacf

  • SHA1

    d057887e566aa744eb8c82fc5ac05132ece9e218

  • SHA256

    86214e9a4b21afd0a46c93ee39eb99b188e43cc773a15f632fe8bea3169ee0a5

  • SHA512

    d1f97c990abe6eb28289d36d3c20a21e078bd5561d4765ca202be24a570a742cc37cd063195581e7b6ebd02705f453ee532b59239a6c06195856727339d3fbb7

Malware Config

Extracted

Family

xpertrat

Version

3.1.9

Botnet

BXK

C2

ioxg.ix.tc:4000

Mutex

R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6

Signatures

  • UAC bypass 3 TTPs
  • Windows security bypass 2 TTPs
  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

  • XpertRAT Core Payload 2 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\810436f7d29ced22beac8734da3acacf.exe
    "C:\Users\Admin\AppData\Local\Temp\810436f7d29ced22beac8734da3acacf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1420
    • C:\Users\Admin\AppData\Local\Temp\810436f7d29ced22beac8734da3acacf.exe
      "{path}"
      2⤵
        PID:304
      • C:\Users\Admin\AppData\Local\Temp\810436f7d29ced22beac8734da3acacf.exe
        "{path}"
        2⤵
        • Windows security modification
        • Checks whether UAC is enabled
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:1688
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          C:\Users\Admin\AppData\Local\Temp\810436f7d29ced22beac8734da3acacf.exe
          3⤵
          • Adds policy Run key to start application
          • Adds Run key to start application
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1008

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1008-71-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB

    • memory/1008-72-0x0000000000401364-mapping.dmp

    • memory/1008-73-0x0000000000580000-0x00000000006D3000-memory.dmp

      Filesize

      1.3MB

    • memory/1420-60-0x0000000010080000-0x0000000010081000-memory.dmp

      Filesize

      4KB

    • memory/1420-62-0x0000000074FB1000-0x0000000074FB3000-memory.dmp

      Filesize

      8KB

    • memory/1420-63-0x0000000000250000-0x0000000000252000-memory.dmp

      Filesize

      8KB

    • memory/1420-64-0x0000000005060000-0x0000000005061000-memory.dmp

      Filesize

      4KB

    • memory/1420-65-0x0000000005880000-0x0000000005926000-memory.dmp

      Filesize

      664KB

    • memory/1420-66-0x0000000001F40000-0x0000000001F97000-memory.dmp

      Filesize

      348KB

    • memory/1688-67-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB

    • memory/1688-68-0x00000000004010B8-mapping.dmp