Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-en -
submitted
05-09-2021 12:42
Static task
static1
Behavioral task
behavioral1
Sample
DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe
Resource
win7-en
windows7_x64
0 signatures
0 seconds
General
-
Target
DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe
-
Size
686KB
-
MD5
6ddea92be72b5543d108ec83b588297d
-
SHA1
c13a41eb03b9e26fec3e6d6f6c1e273111729c03
-
SHA256
ddde7cd1d82b5dee479ac17413690cedd04ad04ee14ae271d590da80e5a2a8bd
-
SHA512
cc4771f3ee1d12f4610aa87f505f8616e5a35d1d541ed30a267b143ae7c683eb239477aa923493ed4db59dfb6a0d2c4c047d158a7bd4cbbe2b8e415281e80d93
Malware Config
Extracted
Family
xpertrat
Version
3.0.10
Botnet
Test
C2
csimich.duckdns.org:1989
Mutex
Y1E5W2H0-W6U4-K5S1-S8J1-Y5X8K0K337V4
Signatures
-
XpertRAT Core Payload 2 IoCs
resource yara_rule behavioral1/memory/112-61-0x0000000000400000-0x0000000000443000-memory.dmp xpertrat behavioral1/memory/240-65-0x0000000000401364-mapping.dmp xpertrat -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Y1E5W2H0-W6U4-K5S1-S8J1-Y5X8K0K337V4 = "C:\\Users\\Admin\\AppData\\Roaming\\Y1E5W2H0-W6U4-K5S1-S8J1-Y5X8K0K337V4\\Y1E5W2H0-W6U4-K5S1-S8J1-Y5X8K0K337V4.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Y1E5W2H0-W6U4-K5S1-S8J1-Y5X8K0K337V4 = "C:\\Users\\Admin\\AppData\\Roaming\\Y1E5W2H0-W6U4-K5S1-S8J1-Y5X8K0K337V4\\Y1E5W2H0-W6U4-K5S1-S8J1-Y5X8K0K337V4.exe" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Windows\CurrentVersion\Run\Y1E5W2H0-W6U4-K5S1-S8J1-Y5X8K0K337V4 = "C:\\Users\\Admin\\AppData\\Roaming\\Y1E5W2H0-W6U4-K5S1-S8J1-Y5X8K0K337V4\\Y1E5W2H0-W6U4-K5S1-S8J1-Y5X8K0K337V4.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 820 set thread context of 1220 820 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 30 PID 1220 set thread context of 112 1220 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 32 PID 1220 set thread context of 240 1220 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 33 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 820 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 1220 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 1220 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 1220 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 1224 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 1224 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 820 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 820 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 240 iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1220 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 240 iexplore.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 820 wrote to memory of 1220 820 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 30 PID 820 wrote to memory of 1220 820 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 30 PID 820 wrote to memory of 1220 820 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 30 PID 820 wrote to memory of 1220 820 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 30 PID 820 wrote to memory of 1224 820 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 31 PID 820 wrote to memory of 1224 820 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 31 PID 820 wrote to memory of 1224 820 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 31 PID 820 wrote to memory of 1224 820 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 31 PID 1220 wrote to memory of 112 1220 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 32 PID 1220 wrote to memory of 112 1220 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 32 PID 1220 wrote to memory of 112 1220 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 32 PID 1220 wrote to memory of 112 1220 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 32 PID 1220 wrote to memory of 112 1220 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 32 PID 1220 wrote to memory of 112 1220 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 32 PID 1220 wrote to memory of 112 1220 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 32 PID 1220 wrote to memory of 112 1220 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 32 PID 1220 wrote to memory of 112 1220 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 32 PID 1220 wrote to memory of 240 1220 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 33 PID 1220 wrote to memory of 240 1220 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 33 PID 1220 wrote to memory of 240 1220 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 33 PID 1220 wrote to memory of 240 1220 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 33 PID 1220 wrote to memory of 240 1220 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 33 PID 1220 wrote to memory of 240 1220 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 33 PID 1220 wrote to memory of 240 1220 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 33 PID 1220 wrote to memory of 240 1220 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 33 PID 1220 wrote to memory of 240 1220 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 33 PID 1224 wrote to memory of 1828 1224 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 34 PID 1224 wrote to memory of 1828 1224 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 34 PID 1224 wrote to memory of 1828 1224 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 34 PID 1224 wrote to memory of 1828 1224 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 34 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe"C:\Users\Admin\AppData\Local\Temp\DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe"C:\Users\Admin\AppData\Local\Temp\DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe"2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1220 -
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe3⤵PID:112
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:240
-
-
-
C:\Users\Admin\AppData\Local\Temp\DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe"C:\Users\Admin\AppData\Local\Temp\DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe" 2 1220 2593246892⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe"C:\Users\Admin\AppData\Local\Temp\DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe"3⤵PID:1828
-
-