Analysis

  • max time kernel
    149s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    01-10-2021 07:22

General

  • Target

    fed0dec9c86e3f1057e7cf1c7eb22c8d528da1f6a966de89587b41f7b78e2f98.bin.exe

  • Size

    358KB

  • MD5

    d952cb0acf14545d0e6da5509db9088d

  • SHA1

    9e4c5b31c821cc46f8eba61d65442f0bdbe67b98

  • SHA256

    fed0dec9c86e3f1057e7cf1c7eb22c8d528da1f6a966de89587b41f7b78e2f98

  • SHA512

    e66869cc859af82d4ad9db0c877d949905e3f28876e1022f434083e6f26492e3edac72624ce3143ca85446f4bce7ed208e41f846c5bcb13af7343047c7df8ebc

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

Test

C2

kapasky-antivirus.firewall-gateway.net:4000

Mutex

L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0

Signatures

  • UAC bypass 3 TTPs
  • Windows security bypass 2 TTPs
  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

  • XpertRAT Core Payload 2 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Deletes itself 1 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fed0dec9c86e3f1057e7cf1c7eb22c8d528da1f6a966de89587b41f7b78e2f98.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\fed0dec9c86e3f1057e7cf1c7eb22c8d528da1f6a966de89587b41f7b78e2f98.bin.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1544
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1700
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:320
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:892
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1084
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1836
    • C:\Users\Admin\AppData\Local\Temp\fed0dec9c86e3f1057e7cf1c7eb22c8d528da1f6a966de89587b41f7b78e2f98.bin.exe
      C:\Users\Admin\AppData\Local\Temp\fed0dec9c86e3f1057e7cf1c7eb22c8d528da1f6a966de89587b41f7b78e2f98.bin.exe
      2⤵
      • Windows security modification
      • Checks whether UAC is enabled
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:744
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        C:\Users\Admin\AppData\Local\Temp\fed0dec9c86e3f1057e7cf1c7eb22c8d528da1f6a966de89587b41f7b78e2f98.bin.exe
        3⤵
        • Adds policy Run key to start application
        • Adds Run key to start application
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:516
        • C:\Windows\SysWOW64\notepad.exe
          notepad.exe
          4⤵
          • Deletes itself
          PID:672

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    MD5

    51664d5229299fe0d5e213a4e9368bf9

    SHA1

    2c17f962e0c623267936bb08a7a0d88b35809ceb

    SHA256

    34190fba1faaed501f4efa8ac443f408d625f4c72a5a2da37dd2aa998024787c

    SHA512

    1b46144d4cdc51bec067cb2dbb8a04cdc65626fe21e8319cf95aff0c381d4d70dcbaf2fe196c103cdad396ab658eb9cc8f074db0913472a1c039f92de1cad9aa

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    MD5

    51664d5229299fe0d5e213a4e9368bf9

    SHA1

    2c17f962e0c623267936bb08a7a0d88b35809ceb

    SHA256

    34190fba1faaed501f4efa8ac443f408d625f4c72a5a2da37dd2aa998024787c

    SHA512

    1b46144d4cdc51bec067cb2dbb8a04cdc65626fe21e8319cf95aff0c381d4d70dcbaf2fe196c103cdad396ab658eb9cc8f074db0913472a1c039f92de1cad9aa

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    MD5

    51664d5229299fe0d5e213a4e9368bf9

    SHA1

    2c17f962e0c623267936bb08a7a0d88b35809ceb

    SHA256

    34190fba1faaed501f4efa8ac443f408d625f4c72a5a2da37dd2aa998024787c

    SHA512

    1b46144d4cdc51bec067cb2dbb8a04cdc65626fe21e8319cf95aff0c381d4d70dcbaf2fe196c103cdad396ab658eb9cc8f074db0913472a1c039f92de1cad9aa

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    MD5

    51664d5229299fe0d5e213a4e9368bf9

    SHA1

    2c17f962e0c623267936bb08a7a0d88b35809ceb

    SHA256

    34190fba1faaed501f4efa8ac443f408d625f4c72a5a2da37dd2aa998024787c

    SHA512

    1b46144d4cdc51bec067cb2dbb8a04cdc65626fe21e8319cf95aff0c381d4d70dcbaf2fe196c103cdad396ab658eb9cc8f074db0913472a1c039f92de1cad9aa

  • memory/320-59-0x0000000000000000-mapping.dmp

  • memory/516-86-0x0000000000401364-mapping.dmp

  • memory/516-85-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

  • memory/516-87-0x0000000000660000-0x00000000007B3000-memory.dmp

    Filesize

    1.3MB

  • memory/672-90-0x0000000000000000-mapping.dmp

  • memory/744-82-0x00000000004010B8-mapping.dmp

  • memory/744-81-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/892-62-0x0000000000000000-mapping.dmp

  • memory/892-66-0x0000000002441000-0x0000000002442000-memory.dmp

    Filesize

    4KB

  • memory/892-65-0x0000000002440000-0x0000000002441000-memory.dmp

    Filesize

    4KB

  • memory/892-67-0x0000000002442000-0x0000000002444000-memory.dmp

    Filesize

    8KB

  • memory/1084-71-0x0000000001D90000-0x0000000001D91000-memory.dmp

    Filesize

    4KB

  • memory/1084-72-0x0000000001D91000-0x0000000001D92000-memory.dmp

    Filesize

    4KB

  • memory/1084-73-0x0000000001D92000-0x0000000001D94000-memory.dmp

    Filesize

    8KB

  • memory/1084-68-0x0000000000000000-mapping.dmp

  • memory/1544-53-0x0000000000310000-0x0000000000311000-memory.dmp

    Filesize

    4KB

  • memory/1544-55-0x00000000007C0000-0x00000000007C1000-memory.dmp

    Filesize

    4KB

  • memory/1544-79-0x0000000005880000-0x00000000058D4000-memory.dmp

    Filesize

    336KB

  • memory/1544-80-0x0000000000A80000-0x0000000000AAA000-memory.dmp

    Filesize

    168KB

  • memory/1700-58-0x00000000023C0000-0x000000000300A000-memory.dmp

    Filesize

    12.3MB

  • memory/1700-57-0x0000000074B91000-0x0000000074B93000-memory.dmp

    Filesize

    8KB

  • memory/1700-56-0x0000000000000000-mapping.dmp

  • memory/1836-78-0x00000000023A0000-0x0000000002FEA000-memory.dmp

    Filesize

    12.3MB

  • memory/1836-77-0x00000000023A0000-0x0000000002FEA000-memory.dmp

    Filesize

    12.3MB

  • memory/1836-74-0x0000000000000000-mapping.dmp