Analysis

  • max time kernel
    145s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    12-07-2021 08:58

General

  • Target

    810436f7d29ced22beac8734da3acacf.exe

  • Size

    772KB

  • MD5

    810436f7d29ced22beac8734da3acacf

  • SHA1

    d057887e566aa744eb8c82fc5ac05132ece9e218

  • SHA256

    86214e9a4b21afd0a46c93ee39eb99b188e43cc773a15f632fe8bea3169ee0a5

  • SHA512

    d1f97c990abe6eb28289d36d3c20a21e078bd5561d4765ca202be24a570a742cc37cd063195581e7b6ebd02705f453ee532b59239a6c06195856727339d3fbb7

Malware Config

Extracted

Family

xpertrat

Version

3.1.9

Botnet

BXK

C2

ioxg.ix.tc:4000

Mutex

R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6

Signatures

  • UAC bypass 3 TTPs
  • Windows security bypass 2 TTPs
  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

  • XpertRAT Core Payload 2 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\810436f7d29ced22beac8734da3acacf.exe
    "C:\Users\Admin\AppData\Local\Temp\810436f7d29ced22beac8734da3acacf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:772
    • C:\Users\Admin\AppData\Local\Temp\810436f7d29ced22beac8734da3acacf.exe
      "{path}"
      2⤵
      • Windows security modification
      • Checks whether UAC is enabled
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4004
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        C:\Users\Admin\AppData\Local\Temp\810436f7d29ced22beac8734da3acacf.exe
        3⤵
        • Adds policy Run key to start application
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:3148

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/772-123-0x000000000AFE0000-0x000000000B037000-memory.dmp

    Filesize

    348KB

  • memory/772-121-0x0000000006930000-0x0000000006932000-memory.dmp

    Filesize

    8KB

  • memory/772-117-0x0000000004E60000-0x0000000004E61000-memory.dmp

    Filesize

    4KB

  • memory/772-118-0x00000000052F0000-0x00000000052F1000-memory.dmp

    Filesize

    4KB

  • memory/772-114-0x00000000004C0000-0x00000000004C1000-memory.dmp

    Filesize

    4KB

  • memory/772-120-0x00000000069C0000-0x00000000069C1000-memory.dmp

    Filesize

    4KB

  • memory/772-116-0x0000000005360000-0x0000000005361000-memory.dmp

    Filesize

    4KB

  • memory/772-122-0x00000000087F0000-0x0000000008896000-memory.dmp

    Filesize

    664KB

  • memory/772-119-0x0000000004E20000-0x0000000004E21000-memory.dmp

    Filesize

    4KB

  • memory/3148-128-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

  • memory/3148-129-0x0000000000401364-mapping.dmp

  • memory/3148-132-0x0000000003560000-0x00000000036B3000-memory.dmp

    Filesize

    1.3MB

  • memory/3148-133-0x0000000003561000-0x000000000365D000-memory.dmp

    Filesize

    1008KB

  • memory/4004-124-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/4004-125-0x00000000004010B8-mapping.dmp

  • memory/4004-136-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB