Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
30-09-2021 07:14
Static task
static1
Behavioral task
behavioral1
Sample
cb12b24b0f69225693168e9c35761a1b.exe
Resource
win7-en-20210920
General
-
Target
cb12b24b0f69225693168e9c35761a1b.exe
-
Size
503KB
-
MD5
cb12b24b0f69225693168e9c35761a1b
-
SHA1
0f68f676d76e3546d7d625cdb14f0947c59beff5
-
SHA256
c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535
-
SHA512
9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65
Malware Config
Extracted
xpertrat
3.0.10
Test
kapasky-antivirus.firewall-gateway.net:4000
L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0
Signatures
-
XpertRAT Core Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1324-75-0x0000000000400000-0x0000000000443000-memory.dmp xpertrat behavioral1/memory/1324-76-0x0000000000401364-mapping.dmp xpertrat -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" iexplore.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 816 notepad.exe -
Processes:
cb12b24b0f69225693168e9c35761a1b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" cb12b24b0f69225693168e9c35761a1b.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe -
Processes:
cb12b24b0f69225693168e9c35761a1b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cb12b24b0f69225693168e9c35761a1b.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
cb12b24b0f69225693168e9c35761a1b.execb12b24b0f69225693168e9c35761a1b.exedescription pid process target process PID 1356 set thread context of 612 1356 cb12b24b0f69225693168e9c35761a1b.exe cb12b24b0f69225693168e9c35761a1b.exe PID 612 set thread context of 1324 612 cb12b24b0f69225693168e9c35761a1b.exe iexplore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.execb12b24b0f69225693168e9c35761a1b.execb12b24b0f69225693168e9c35761a1b.exepid process 1692 powershell.exe 648 powershell.exe 1356 cb12b24b0f69225693168e9c35761a1b.exe 1356 cb12b24b0f69225693168e9c35761a1b.exe 612 cb12b24b0f69225693168e9c35761a1b.exe 612 cb12b24b0f69225693168e9c35761a1b.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
cb12b24b0f69225693168e9c35761a1b.exepowershell.exepowershell.exeiexplore.exedescription pid process Token: SeDebugPrivilege 1356 cb12b24b0f69225693168e9c35761a1b.exe Token: SeDebugPrivilege 1692 powershell.exe Token: SeDebugPrivilege 648 powershell.exe Token: SeDebugPrivilege 1324 iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
cb12b24b0f69225693168e9c35761a1b.exeiexplore.exepid process 612 cb12b24b0f69225693168e9c35761a1b.exe 1324 iexplore.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
cb12b24b0f69225693168e9c35761a1b.execb12b24b0f69225693168e9c35761a1b.exeiexplore.exedescription pid process target process PID 1356 wrote to memory of 1692 1356 cb12b24b0f69225693168e9c35761a1b.exe powershell.exe PID 1356 wrote to memory of 1692 1356 cb12b24b0f69225693168e9c35761a1b.exe powershell.exe PID 1356 wrote to memory of 1692 1356 cb12b24b0f69225693168e9c35761a1b.exe powershell.exe PID 1356 wrote to memory of 1692 1356 cb12b24b0f69225693168e9c35761a1b.exe powershell.exe PID 1356 wrote to memory of 648 1356 cb12b24b0f69225693168e9c35761a1b.exe powershell.exe PID 1356 wrote to memory of 648 1356 cb12b24b0f69225693168e9c35761a1b.exe powershell.exe PID 1356 wrote to memory of 648 1356 cb12b24b0f69225693168e9c35761a1b.exe powershell.exe PID 1356 wrote to memory of 648 1356 cb12b24b0f69225693168e9c35761a1b.exe powershell.exe PID 1356 wrote to memory of 612 1356 cb12b24b0f69225693168e9c35761a1b.exe cb12b24b0f69225693168e9c35761a1b.exe PID 1356 wrote to memory of 612 1356 cb12b24b0f69225693168e9c35761a1b.exe cb12b24b0f69225693168e9c35761a1b.exe PID 1356 wrote to memory of 612 1356 cb12b24b0f69225693168e9c35761a1b.exe cb12b24b0f69225693168e9c35761a1b.exe PID 1356 wrote to memory of 612 1356 cb12b24b0f69225693168e9c35761a1b.exe cb12b24b0f69225693168e9c35761a1b.exe PID 1356 wrote to memory of 612 1356 cb12b24b0f69225693168e9c35761a1b.exe cb12b24b0f69225693168e9c35761a1b.exe PID 1356 wrote to memory of 612 1356 cb12b24b0f69225693168e9c35761a1b.exe cb12b24b0f69225693168e9c35761a1b.exe PID 1356 wrote to memory of 612 1356 cb12b24b0f69225693168e9c35761a1b.exe cb12b24b0f69225693168e9c35761a1b.exe PID 1356 wrote to memory of 612 1356 cb12b24b0f69225693168e9c35761a1b.exe cb12b24b0f69225693168e9c35761a1b.exe PID 1356 wrote to memory of 612 1356 cb12b24b0f69225693168e9c35761a1b.exe cb12b24b0f69225693168e9c35761a1b.exe PID 1356 wrote to memory of 612 1356 cb12b24b0f69225693168e9c35761a1b.exe cb12b24b0f69225693168e9c35761a1b.exe PID 1356 wrote to memory of 612 1356 cb12b24b0f69225693168e9c35761a1b.exe cb12b24b0f69225693168e9c35761a1b.exe PID 612 wrote to memory of 1324 612 cb12b24b0f69225693168e9c35761a1b.exe iexplore.exe PID 612 wrote to memory of 1324 612 cb12b24b0f69225693168e9c35761a1b.exe iexplore.exe PID 612 wrote to memory of 1324 612 cb12b24b0f69225693168e9c35761a1b.exe iexplore.exe PID 612 wrote to memory of 1324 612 cb12b24b0f69225693168e9c35761a1b.exe iexplore.exe PID 612 wrote to memory of 1324 612 cb12b24b0f69225693168e9c35761a1b.exe iexplore.exe PID 612 wrote to memory of 1324 612 cb12b24b0f69225693168e9c35761a1b.exe iexplore.exe PID 612 wrote to memory of 1324 612 cb12b24b0f69225693168e9c35761a1b.exe iexplore.exe PID 612 wrote to memory of 1324 612 cb12b24b0f69225693168e9c35761a1b.exe iexplore.exe PID 612 wrote to memory of 1324 612 cb12b24b0f69225693168e9c35761a1b.exe iexplore.exe PID 1324 wrote to memory of 816 1324 iexplore.exe notepad.exe PID 1324 wrote to memory of 816 1324 iexplore.exe notepad.exe PID 1324 wrote to memory of 816 1324 iexplore.exe notepad.exe PID 1324 wrote to memory of 816 1324 iexplore.exe notepad.exe PID 1324 wrote to memory of 816 1324 iexplore.exe notepad.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
cb12b24b0f69225693168e9c35761a1b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cb12b24b0f69225693168e9c35761a1b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe"C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection -TraceRoute twitch.com2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1692 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 52⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:648 -
C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exeC:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:612 -
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\notepad.exenotepad.exe4⤵
- Deletes itself
PID:816
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD54fff3b4920cec843637588f8be815a94
SHA1a8ec480d629b22a433d20124d545525fa0146bd3
SHA256b028c3a6e0e7fb25c53f3ac7e3e257ecb0aa3b840f46585d14d7f242d398d4c4
SHA5120c0845fae3b6b96e0ceda29a7d96f38b2cabd6ffb8555194a93d93cf46e2660e197aaa37bc4b0c5ff6aa53920c277f1ef1a065afbb77b14b7935a09245f5ce71