Analysis
-
max time kernel
148s -
max time network
139s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
30-09-2021 06:04
Static task
static1
Behavioral task
behavioral1
Sample
cb12b24b0f69225693168e9c35761a1b.exe
Resource
win7-en-20210920
General
-
Target
cb12b24b0f69225693168e9c35761a1b.exe
-
Size
503KB
-
MD5
cb12b24b0f69225693168e9c35761a1b
-
SHA1
0f68f676d76e3546d7d625cdb14f0947c59beff5
-
SHA256
c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535
-
SHA512
9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65
Malware Config
Extracted
xpertrat
3.0.10
Test
kapasky-antivirus.firewall-gateway.net:4000
L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0
Signatures
-
XpertRAT Core Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/552-73-0x0000000000400000-0x0000000000443000-memory.dmp xpertrat behavioral1/memory/552-74-0x0000000000401364-mapping.dmp xpertrat -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 1016 notepad.exe -
Processes:
cb12b24b0f69225693168e9c35761a1b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" cb12b24b0f69225693168e9c35761a1b.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe -
Processes:
cb12b24b0f69225693168e9c35761a1b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cb12b24b0f69225693168e9c35761a1b.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
cb12b24b0f69225693168e9c35761a1b.execb12b24b0f69225693168e9c35761a1b.exedescription pid process target process PID 1324 set thread context of 1880 1324 cb12b24b0f69225693168e9c35761a1b.exe cb12b24b0f69225693168e9c35761a1b.exe PID 1880 set thread context of 552 1880 cb12b24b0f69225693168e9c35761a1b.exe iexplore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.execb12b24b0f69225693168e9c35761a1b.execb12b24b0f69225693168e9c35761a1b.exepid process 1644 powershell.exe 268 powershell.exe 1324 cb12b24b0f69225693168e9c35761a1b.exe 1324 cb12b24b0f69225693168e9c35761a1b.exe 1880 cb12b24b0f69225693168e9c35761a1b.exe 1880 cb12b24b0f69225693168e9c35761a1b.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
cb12b24b0f69225693168e9c35761a1b.exepowershell.exepowershell.exeiexplore.exedescription pid process Token: SeDebugPrivilege 1324 cb12b24b0f69225693168e9c35761a1b.exe Token: SeDebugPrivilege 1644 powershell.exe Token: SeDebugPrivilege 268 powershell.exe Token: SeDebugPrivilege 552 iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
cb12b24b0f69225693168e9c35761a1b.exeiexplore.exepid process 1880 cb12b24b0f69225693168e9c35761a1b.exe 552 iexplore.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
cb12b24b0f69225693168e9c35761a1b.execb12b24b0f69225693168e9c35761a1b.exeiexplore.exedescription pid process target process PID 1324 wrote to memory of 1644 1324 cb12b24b0f69225693168e9c35761a1b.exe powershell.exe PID 1324 wrote to memory of 1644 1324 cb12b24b0f69225693168e9c35761a1b.exe powershell.exe PID 1324 wrote to memory of 1644 1324 cb12b24b0f69225693168e9c35761a1b.exe powershell.exe PID 1324 wrote to memory of 1644 1324 cb12b24b0f69225693168e9c35761a1b.exe powershell.exe PID 1324 wrote to memory of 268 1324 cb12b24b0f69225693168e9c35761a1b.exe powershell.exe PID 1324 wrote to memory of 268 1324 cb12b24b0f69225693168e9c35761a1b.exe powershell.exe PID 1324 wrote to memory of 268 1324 cb12b24b0f69225693168e9c35761a1b.exe powershell.exe PID 1324 wrote to memory of 268 1324 cb12b24b0f69225693168e9c35761a1b.exe powershell.exe PID 1324 wrote to memory of 1880 1324 cb12b24b0f69225693168e9c35761a1b.exe cb12b24b0f69225693168e9c35761a1b.exe PID 1324 wrote to memory of 1880 1324 cb12b24b0f69225693168e9c35761a1b.exe cb12b24b0f69225693168e9c35761a1b.exe PID 1324 wrote to memory of 1880 1324 cb12b24b0f69225693168e9c35761a1b.exe cb12b24b0f69225693168e9c35761a1b.exe PID 1324 wrote to memory of 1880 1324 cb12b24b0f69225693168e9c35761a1b.exe cb12b24b0f69225693168e9c35761a1b.exe PID 1324 wrote to memory of 1880 1324 cb12b24b0f69225693168e9c35761a1b.exe cb12b24b0f69225693168e9c35761a1b.exe PID 1324 wrote to memory of 1880 1324 cb12b24b0f69225693168e9c35761a1b.exe cb12b24b0f69225693168e9c35761a1b.exe PID 1324 wrote to memory of 1880 1324 cb12b24b0f69225693168e9c35761a1b.exe cb12b24b0f69225693168e9c35761a1b.exe PID 1324 wrote to memory of 1880 1324 cb12b24b0f69225693168e9c35761a1b.exe cb12b24b0f69225693168e9c35761a1b.exe PID 1324 wrote to memory of 1880 1324 cb12b24b0f69225693168e9c35761a1b.exe cb12b24b0f69225693168e9c35761a1b.exe PID 1324 wrote to memory of 1880 1324 cb12b24b0f69225693168e9c35761a1b.exe cb12b24b0f69225693168e9c35761a1b.exe PID 1324 wrote to memory of 1880 1324 cb12b24b0f69225693168e9c35761a1b.exe cb12b24b0f69225693168e9c35761a1b.exe PID 1880 wrote to memory of 552 1880 cb12b24b0f69225693168e9c35761a1b.exe iexplore.exe PID 1880 wrote to memory of 552 1880 cb12b24b0f69225693168e9c35761a1b.exe iexplore.exe PID 1880 wrote to memory of 552 1880 cb12b24b0f69225693168e9c35761a1b.exe iexplore.exe PID 1880 wrote to memory of 552 1880 cb12b24b0f69225693168e9c35761a1b.exe iexplore.exe PID 1880 wrote to memory of 552 1880 cb12b24b0f69225693168e9c35761a1b.exe iexplore.exe PID 1880 wrote to memory of 552 1880 cb12b24b0f69225693168e9c35761a1b.exe iexplore.exe PID 1880 wrote to memory of 552 1880 cb12b24b0f69225693168e9c35761a1b.exe iexplore.exe PID 1880 wrote to memory of 552 1880 cb12b24b0f69225693168e9c35761a1b.exe iexplore.exe PID 1880 wrote to memory of 552 1880 cb12b24b0f69225693168e9c35761a1b.exe iexplore.exe PID 552 wrote to memory of 1016 552 iexplore.exe notepad.exe PID 552 wrote to memory of 1016 552 iexplore.exe notepad.exe PID 552 wrote to memory of 1016 552 iexplore.exe notepad.exe PID 552 wrote to memory of 1016 552 iexplore.exe notepad.exe PID 552 wrote to memory of 1016 552 iexplore.exe notepad.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
cb12b24b0f69225693168e9c35761a1b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cb12b24b0f69225693168e9c35761a1b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe"C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection -TraceRoute twitch.com2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1644 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 52⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:268 -
C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exeC:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1880 -
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\SysWOW64\notepad.exenotepad.exe4⤵
- Deletes itself
PID:1016
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5cd5fce51bb8b4dc69d0249c4e85dc95b
SHA1735173046504155064e79fbdb31f5d89b840b005
SHA256eaa773519fc09fffdf46c8fb5521a8de21626afde318a1519fce1f333831669e
SHA512f8a4b1884d9c163440a755b65f1bec3a728ca6e87c27fd19bb216fc2ed0b0785181aced4b06ba397e47fc9495e61f53d26f21e82dbd0791d9ee36033418d6d79