Analysis

  • max time kernel
    118s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    21-09-2021 16:20

General

  • Target

    bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe

  • Size

    33KB

  • MD5

    49af0abba03a7d559171f378728e9bc7

  • SHA1

    7e6e1ccf693bb62f2a36119996583228a9e5c665

  • SHA256

    bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b

  • SHA512

    d155349a6dae76775b26a96ec00a8dc860749eb46450c6dcc479303afa01325b1fb31b41c8adac3cbabb2b17c7b23a6768949a8bf5221c3edee0a25082e71a8f

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

Test

C2

kapasky-antivirus.firewall-gateway.net:4000

Mutex

L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0

Signatures

  • UAC bypass 3 TTPs
  • Windows security bypass 2 TTPs
  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

  • XpertRAT Core Payload 2 IoCs
  • NirSoft MailPassView 2 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 2 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 4 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Deletes itself 1 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Program crash 4 IoCs
  • Suspicious use of SetThreadContext 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe
    "C:\Users\Admin\AppData\Local\Temp\bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2352
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -Seconds 3
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3016
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 15
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:680
    • C:\Users\Admin\AppData\Local\Temp\bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe
      C:\Users\Admin\AppData\Local\Temp\bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe
      2⤵
        PID:3680
      • C:\Users\Admin\AppData\Local\Temp\bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe
        C:\Users\Admin\AppData\Local\Temp\bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe
        2⤵
        • Windows security modification
        • Checks whether UAC is enabled
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:3672
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          C:\Users\Admin\AppData\Local\Temp\bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe
          3⤵
            PID:1484
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 96
              4⤵
              • Program crash
              PID:2012
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            C:\Users\Admin\AppData\Local\Temp\bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe
            3⤵
              PID:3796
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 92
                4⤵
                • Program crash
                PID:3824
            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
              C:\Users\Admin\AppData\Local\Temp\bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe
              3⤵
              • Adds policy Run key to start application
              • Adds Run key to start application
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2448
              • C:\Windows\SysWOW64\notepad.exe
                notepad.exe
                4⤵
                • Deletes itself
                PID:3632
              • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                /stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ktucvqjcs0.txt"
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:504
              • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                /stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ktucvqjcs1.txt"
                4⤵
                  PID:1204
                • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                  /stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ktucvqjcs2.txt"
                  4⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3092
                • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                  /stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ktucvqjcs3.txt"
                  4⤵
                    PID:1932
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 92
                      5⤵
                      • Program crash
                      PID:3792
                  • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                    /stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ktucvqjcs3.txt"
                    4⤵
                      PID:3704
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 164
                        5⤵
                        • Program crash
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1304

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                MD5

                66382a4ca6c4dcf75ce41417d44be93e

                SHA1

                8132cbef1c12f8a89a68a6153ade4286bf130812

                SHA256

                a70acce0f4c6ab59b88ce79d84c38d4abffe19b72b033250499b17d788a2db56

                SHA512

                2bf66f2850f4a65220085c55a5b3c8866453104d78fe516e5bd6e3e47df783062ce4ea10de580f2eb0274ac8c3ce71965201c49ef55a78f307731ccc8600aadc

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                MD5

                848d460d46a279e4ecb4176f2617761b

                SHA1

                ecc09b6671e6813eca980926b3d204d7a9a7ab0c

                SHA256

                fd01b8faeb6155cee73cefdb4727f4b6a6aa3c092e0d9cbc0758deae945d0b71

                SHA512

                2d26266583ad29c1cc0ef9ef45455bc85e1380a761e0f6f160e06de57b4832655b1707b73f8889de07dc4f98a882e02303801f9936fbae7ec46c48a8bbe23b74

              • C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ktucvqjcs2.txt

                MD5

                f94dc819ca773f1e3cb27abbc9e7fa27

                SHA1

                9a7700efadc5ea09ab288544ef1e3cd876255086

                SHA256

                a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92

                SHA512

                72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196

              • memory/504-187-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

              • memory/504-188-0x0000000000423BC0-mapping.dmp

              • memory/680-166-0x0000000007563000-0x0000000007564000-memory.dmp

                Filesize

                4KB

              • memory/680-154-0x0000000007562000-0x0000000007563000-memory.dmp

                Filesize

                4KB

              • memory/680-142-0x0000000000000000-mapping.dmp

              • memory/680-153-0x0000000007560000-0x0000000007561000-memory.dmp

                Filesize

                4KB

              • memory/1204-192-0x0000000000411654-mapping.dmp

              • memory/1204-191-0x0000000000400000-0x000000000041B000-memory.dmp

                Filesize

                108KB

              • memory/1484-174-0x0000000000401364-mapping.dmp

              • memory/1932-201-0x0000000000413750-mapping.dmp

              • memory/2352-120-0x00000000049B0000-0x0000000004EAE000-memory.dmp

                Filesize

                5.0MB

              • memory/2352-167-0x0000000007AE0000-0x0000000007B2F000-memory.dmp

                Filesize

                316KB

              • memory/2352-118-0x00000000049B0000-0x00000000049B1000-memory.dmp

                Filesize

                4KB

              • memory/2352-117-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

                Filesize

                4KB

              • memory/2352-168-0x0000000006E00000-0x0000000006E30000-memory.dmp

                Filesize

                192KB

              • memory/2352-115-0x0000000000080000-0x0000000000081000-memory.dmp

                Filesize

                4KB

              • memory/2352-119-0x0000000002360000-0x0000000002361000-memory.dmp

                Filesize

                4KB

              • memory/2448-183-0x0000000003721000-0x000000000381D000-memory.dmp

                Filesize

                1008KB

              • memory/2448-179-0x0000000000401364-mapping.dmp

              • memory/2448-182-0x0000000003720000-0x0000000003873000-memory.dmp

                Filesize

                1.3MB

              • memory/2448-178-0x0000000000400000-0x0000000000443000-memory.dmp

                Filesize

                268KB

              • memory/3016-131-0x00000000082D0000-0x00000000082D1000-memory.dmp

                Filesize

                4KB

              • memory/3016-140-0x0000000009660000-0x0000000009661000-memory.dmp

                Filesize

                4KB

              • memory/3016-132-0x0000000008110000-0x0000000008111000-memory.dmp

                Filesize

                4KB

              • memory/3016-152-0x0000000004EB3000-0x0000000004EB4000-memory.dmp

                Filesize

                4KB

              • memory/3016-121-0x0000000000000000-mapping.dmp

              • memory/3016-124-0x0000000004E60000-0x0000000004E61000-memory.dmp

                Filesize

                4KB

              • memory/3016-130-0x0000000007F10000-0x0000000007F11000-memory.dmp

                Filesize

                4KB

              • memory/3016-125-0x0000000007870000-0x0000000007871000-memory.dmp

                Filesize

                4KB

              • memory/3016-126-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

                Filesize

                4KB

              • memory/3016-134-0x0000000008A30000-0x0000000008A31000-memory.dmp

                Filesize

                4KB

              • memory/3016-139-0x000000000A060000-0x000000000A061000-memory.dmp

                Filesize

                4KB

              • memory/3016-133-0x0000000008920000-0x0000000008921000-memory.dmp

                Filesize

                4KB

              • memory/3016-129-0x0000000007EA0000-0x0000000007EA1000-memory.dmp

                Filesize

                4KB

              • memory/3016-127-0x0000000004EB2000-0x0000000004EB3000-memory.dmp

                Filesize

                4KB

              • memory/3016-128-0x00000000077B0000-0x00000000077B1000-memory.dmp

                Filesize

                4KB

              • memory/3092-195-0x0000000000400000-0x0000000000459000-memory.dmp

                Filesize

                356KB

              • memory/3092-196-0x0000000000442F04-mapping.dmp

              • memory/3632-186-0x0000000000000000-mapping.dmp

              • memory/3672-175-0x0000000000400000-0x000000000042C000-memory.dmp

                Filesize

                176KB

              • memory/3672-170-0x00000000004010B8-mapping.dmp

              • memory/3672-169-0x0000000000400000-0x000000000042C000-memory.dmp

                Filesize

                176KB

              • memory/3704-203-0x0000000000413750-mapping.dmp

              • memory/3704-202-0x0000000000400000-0x0000000000416000-memory.dmp

                Filesize

                88KB

              • memory/3796-177-0x0000000000401364-mapping.dmp