Analysis
-
max time kernel
152s -
max time network
162s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
05-09-2021 12:42
Static task
static1
Behavioral task
behavioral1
Sample
DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe
Resource
win7-en
windows7_x64
0 signatures
0 seconds
General
-
Target
DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe
-
Size
686KB
-
MD5
6ddea92be72b5543d108ec83b588297d
-
SHA1
c13a41eb03b9e26fec3e6d6f6c1e273111729c03
-
SHA256
ddde7cd1d82b5dee479ac17413690cedd04ad04ee14ae271d590da80e5a2a8bd
-
SHA512
cc4771f3ee1d12f4610aa87f505f8616e5a35d1d541ed30a267b143ae7c683eb239477aa923493ed4db59dfb6a0d2c4c047d158a7bd4cbbe2b8e415281e80d93
Malware Config
Extracted
Family
xpertrat
Version
3.0.10
Botnet
Test
C2
csimich.duckdns.org:1989
Mutex
Y1E5W2H0-W6U4-K5S1-S8J1-Y5X8K0K337V4
Signatures
-
XpertRAT Core Payload 2 IoCs
resource yara_rule behavioral2/memory/2360-119-0x0000000000400000-0x0000000000443000-memory.dmp xpertrat behavioral2/memory/2360-120-0x0000000000401364-mapping.dmp xpertrat -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Y1E5W2H0-W6U4-K5S1-S8J1-Y5X8K0K337V4 = "C:\\Users\\Admin\\AppData\\Roaming\\Y1E5W2H0-W6U4-K5S1-S8J1-Y5X8K0K337V4\\Y1E5W2H0-W6U4-K5S1-S8J1-Y5X8K0K337V4.exe" iexplore.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Y1E5W2H0-W6U4-K5S1-S8J1-Y5X8K0K337V4 = "C:\\Users\\Admin\\AppData\\Roaming\\Y1E5W2H0-W6U4-K5S1-S8J1-Y5X8K0K337V4\\Y1E5W2H0-W6U4-K5S1-S8J1-Y5X8K0K337V4.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Y1E5W2H0-W6U4-K5S1-S8J1-Y5X8K0K337V4 = "C:\\Users\\Admin\\AppData\\Roaming\\Y1E5W2H0-W6U4-K5S1-S8J1-Y5X8K0K337V4\\Y1E5W2H0-W6U4-K5S1-S8J1-Y5X8K0K337V4.exe" iexplore.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 740 set thread context of 2844 740 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 78 PID 2844 set thread context of 2360 2844 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 80 -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 740 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 740 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 2844 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 2844 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 2844 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 2844 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 3500 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 3500 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 3500 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 3500 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 740 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 740 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2360 iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2844 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 2360 iexplore.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 740 wrote to memory of 2844 740 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 78 PID 740 wrote to memory of 2844 740 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 78 PID 740 wrote to memory of 2844 740 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 78 PID 740 wrote to memory of 3500 740 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 79 PID 740 wrote to memory of 3500 740 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 79 PID 740 wrote to memory of 3500 740 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 79 PID 2844 wrote to memory of 2360 2844 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 80 PID 2844 wrote to memory of 2360 2844 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 80 PID 2844 wrote to memory of 2360 2844 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 80 PID 2844 wrote to memory of 2360 2844 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 80 PID 2844 wrote to memory of 2360 2844 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 80 PID 2844 wrote to memory of 2360 2844 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 80 PID 2844 wrote to memory of 2360 2844 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 80 PID 2844 wrote to memory of 2360 2844 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 80 PID 3500 wrote to memory of 492 3500 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 81 PID 3500 wrote to memory of 492 3500 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 81 PID 3500 wrote to memory of 492 3500 DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe 81 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe"C:\Users\Admin\AppData\Local\Temp\DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe"C:\Users\Admin\AppData\Local\Temp\DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe"2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2844 -
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2360
-
-
-
C:\Users\Admin\AppData\Local\Temp\DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe"C:\Users\Admin\AppData\Local\Temp\DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe" 2 2844 2593663282⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe"C:\Users\Admin\AppData\Local\Temp\DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe"3⤵PID:492
-
-