Analysis

  • max time kernel
    153s
  • max time network
    139s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    30-09-2021 07:14

General

  • Target

    cb12b24b0f69225693168e9c35761a1b.exe

  • Size

    503KB

  • MD5

    cb12b24b0f69225693168e9c35761a1b

  • SHA1

    0f68f676d76e3546d7d625cdb14f0947c59beff5

  • SHA256

    c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

  • SHA512

    9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

Test

C2

kapasky-antivirus.firewall-gateway.net:4000

Mutex

L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0

Signatures

  • UAC bypass 3 TTPs
  • Windows security bypass 2 TTPs
  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

  • XpertRAT Core Payload 2 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Deletes itself 1 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe
    "C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2160
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection -TraceRoute twitch.com
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3020
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3892
    • C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe
      C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe
      2⤵
        PID:1764
      • C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe
        C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe
        2⤵
          PID:644
        • C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe
          C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe
          2⤵
          • Windows security modification
          • Checks whether UAC is enabled
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2688
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            C:\Users\Admin\AppData\Local\Temp\cb12b24b0f69225693168e9c35761a1b.exe
            3⤵
            • Adds policy Run key to start application
            • Adds Run key to start application
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1744
            • C:\Windows\SysWOW64\notepad.exe
              notepad.exe
              4⤵
              • Deletes itself
              PID:504

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

        MD5

        1712dab0a1bf4e9e3ff666b9c431550d

        SHA1

        34d1dec8fa95f62c72cb3f92a22c13ad9eece10f

        SHA256

        7184a35390c8d6549ef4ddf2909c8fc3446572229bb1788fe178332d80ebfa97

        SHA512

        6ae29c37c11c851ed337afee3c3ad654593063e76df88a6974933e449ac8d86bfa005b9bf2e0ee29aad4647b8f8f32ac753587077fd745424be7f9765688e7b7

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

        MD5

        1c33ff599b382b705675229c91fc2f99

        SHA1

        c20086746c14c5d57be9a3df47bd75fa77abe7e0

        SHA256

        d46b6790776328125154bb8231deafcc7786911bea48fbcd2742c05fa1c4da0a

        SHA512

        5b975f6b0d5407d8d43975c0fd0c26ecb155f6ee9b7416e39478f84e97deea590d1eb0cf2a972adcf96eba6745fdef472f6fcf51d85cd53c2da9b4c550ee413c

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        MD5

        1ce89b036d04eb1f0b975003d078e6ce

        SHA1

        55b7173835682adeaa37c4691d027b1687473632

        SHA256

        bd90ffe349735104d521d5aff8b0da6b1c90c480e354122b5d33df22b25fe8b1

        SHA512

        cbbb2d61e58dcb0888466b6f9c913af92438c35db4a5b079d9d841459f22c3b9166bbe46424e705f314be0c3583a8485980044dc89d323e3db7106d92c7f0482

      • memory/504-715-0x0000000000000000-mapping.dmp

      • memory/1744-708-0x0000000000401364-mapping.dmp

      • memory/1744-711-0x0000000003610000-0x0000000003763000-memory.dmp

        Filesize

        1.3MB

      • memory/1744-712-0x0000000003611000-0x000000000370D000-memory.dmp

        Filesize

        1008KB

      • memory/1744-707-0x0000000000400000-0x0000000000443000-memory.dmp

        Filesize

        268KB

      • memory/2160-702-0x0000000003060000-0x0000000003090000-memory.dmp

        Filesize

        192KB

      • memory/2160-115-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

        Filesize

        4KB

      • memory/2160-701-0x00000000011F0000-0x000000000123F000-memory.dmp

        Filesize

        316KB

      • memory/2160-117-0x0000000005710000-0x0000000005711000-memory.dmp

        Filesize

        4KB

      • memory/2688-703-0x0000000000400000-0x000000000042C000-memory.dmp

        Filesize

        176KB

      • memory/2688-704-0x00000000004010B8-mapping.dmp

      • memory/2688-717-0x0000000000400000-0x000000000042C000-memory.dmp

        Filesize

        176KB

      • memory/3020-129-0x0000000007D50000-0x0000000007D51000-memory.dmp

        Filesize

        4KB

      • memory/3020-125-0x0000000004B70000-0x0000000004B71000-memory.dmp

        Filesize

        4KB

      • memory/3020-152-0x0000000009910000-0x0000000009911000-memory.dmp

        Filesize

        4KB

      • memory/3020-155-0x000000007FB40000-0x000000007FB41000-memory.dmp

        Filesize

        4KB

      • memory/3020-156-0x0000000004B73000-0x0000000004B74000-memory.dmp

        Filesize

        4KB

      • memory/3020-381-0x000000000B070000-0x000000000B071000-memory.dmp

        Filesize

        4KB

      • memory/3020-382-0x000000000AA30000-0x000000000AA31000-memory.dmp

        Filesize

        4KB

      • memory/3020-393-0x0000000002BD0000-0x0000000002BD1000-memory.dmp

        Filesize

        4KB

      • memory/3020-469-0x0000000002E50000-0x0000000002E51000-memory.dmp

        Filesize

        4KB

      • memory/3020-552-0x0000000002F60000-0x0000000002F61000-memory.dmp

        Filesize

        4KB

      • memory/3020-570-0x0000000002E40000-0x0000000002E41000-memory.dmp

        Filesize

        4KB

      • memory/3020-613-0x0000000004B76000-0x0000000004B78000-memory.dmp

        Filesize

        8KB

      • memory/3020-118-0x0000000000000000-mapping.dmp

      • memory/3020-146-0x00000000093C0000-0x00000000093C1000-memory.dmp

        Filesize

        4KB

      • memory/3020-139-0x00000000093E0000-0x0000000009413000-memory.dmp

        Filesize

        204KB

      • memory/3020-121-0x0000000004B20000-0x0000000004B21000-memory.dmp

        Filesize

        4KB

      • memory/3020-122-0x00000000075B0000-0x00000000075B1000-memory.dmp

        Filesize

        4KB

      • memory/3020-131-0x0000000008640000-0x0000000008641000-memory.dmp

        Filesize

        4KB

      • memory/3020-130-0x00000000087A0000-0x00000000087A1000-memory.dmp

        Filesize

        4KB

      • memory/3020-128-0x0000000007FA0000-0x0000000007FA1000-memory.dmp

        Filesize

        4KB

      • memory/3020-127-0x0000000007DE0000-0x0000000007DE1000-memory.dmp

        Filesize

        4KB

      • memory/3020-126-0x0000000004B72000-0x0000000004B73000-memory.dmp

        Filesize

        4KB

      • memory/3020-151-0x0000000009750000-0x0000000009751000-memory.dmp

        Filesize

        4KB

      • memory/3020-124-0x0000000007C90000-0x0000000007C91000-memory.dmp

        Filesize

        4KB

      • memory/3020-123-0x0000000007490000-0x0000000007491000-memory.dmp

        Filesize

        4KB

      • memory/3892-689-0x0000000006C00000-0x0000000006C01000-memory.dmp

        Filesize

        4KB

      • memory/3892-691-0x0000000006C02000-0x0000000006C03000-memory.dmp

        Filesize

        4KB

      • memory/3892-677-0x0000000000000000-mapping.dmp

      • memory/3892-716-0x0000000006C03000-0x0000000006C04000-memory.dmp

        Filesize

        4KB