Analysis

  • max time kernel
    148s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    30-09-2021 06:04

General

  • Target

    cb12b24b0f69225693168e9c35761a1b.exe

  • Size

    503KB

  • MD5

    cb12b24b0f69225693168e9c35761a1b

  • SHA1

    0f68f676d76e3546d7d625cdb14f0947c59beff5

  • SHA256

    c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

  • SHA512

    9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

Test

C2

kapasky-antivirus.firewall-gateway.net:4000

Mutex

L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0

Signatures

  • UAC bypass 3 TTPs
  • Windows security bypass 2 TTPs
  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

  • XpertRAT Core Payload 2 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Deletes itself 1 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe
    "C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1324
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection -TraceRoute twitch.com
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1644
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:268
    • C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe
      C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe
      2⤵
      • Windows security modification
      • Checks whether UAC is enabled
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1880
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe
        3⤵
        • Adds policy Run key to start application
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:552
        • C:\Windows\SysWOW64\notepad.exe
          notepad.exe
          4⤵
          • Deletes itself
          PID:1016

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    MD5

    cd5fce51bb8b4dc69d0249c4e85dc95b

    SHA1

    735173046504155064e79fbdb31f5d89b840b005

    SHA256

    eaa773519fc09fffdf46c8fb5521a8de21626afde318a1519fce1f333831669e

    SHA512

    f8a4b1884d9c163440a755b65f1bec3a728ca6e87c27fd19bb216fc2ed0b0785181aced4b06ba397e47fc9495e61f53d26f21e82dbd0791d9ee36033418d6d79

  • memory/268-63-0x0000000000000000-mapping.dmp

  • memory/268-66-0x0000000002340000-0x0000000002F8A000-memory.dmp

    Filesize

    12.3MB

  • memory/552-73-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

  • memory/552-75-0x0000000000560000-0x00000000006B3000-memory.dmp

    Filesize

    1.3MB

  • memory/552-74-0x0000000000401364-mapping.dmp

  • memory/1016-78-0x0000000000000000-mapping.dmp

  • memory/1324-56-0x0000000075661000-0x0000000075663000-memory.dmp

    Filesize

    8KB

  • memory/1324-57-0x0000000004B40000-0x0000000004B41000-memory.dmp

    Filesize

    4KB

  • memory/1324-54-0x00000000010B0000-0x00000000010B1000-memory.dmp

    Filesize

    4KB

  • memory/1324-67-0x00000000049C0000-0x0000000004A0F000-memory.dmp

    Filesize

    316KB

  • memory/1324-68-0x0000000000AD0000-0x0000000000B00000-memory.dmp

    Filesize

    192KB

  • memory/1644-61-0x0000000002531000-0x0000000002532000-memory.dmp

    Filesize

    4KB

  • memory/1644-62-0x0000000002532000-0x0000000002534000-memory.dmp

    Filesize

    8KB

  • memory/1644-60-0x0000000002530000-0x0000000002531000-memory.dmp

    Filesize

    4KB

  • memory/1644-58-0x0000000000000000-mapping.dmp

  • memory/1880-70-0x00000000004010B8-mapping.dmp

  • memory/1880-69-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB