Analysis

  • max time kernel
    70s
  • max time network
    138s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    04-10-2021 14:55

General

  • Target

    9bd273556358606717f3d0e7d4a2521dba396d6838d8dfccb78bfc5c98590b84.exe

  • Size

    20KB

  • MD5

    5028df0da2732dc8528ca9b7d7e41be5

  • SHA1

    462a178ab8063511109a91e11d44443485edd49d

  • SHA256

    9bd273556358606717f3d0e7d4a2521dba396d6838d8dfccb78bfc5c98590b84

  • SHA512

    dc31474f8a6ac3a1ca811a769a6c8c13b7beec22071565a37cbd8db85831e5d0fc3f270dc1328705849c23fac6eb7c1b55bc255db69ec3d7380771914fc8c3ae

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

Test

C2

kapasky-antivirus.firewall-gateway.net:4000

Mutex

L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0

Signatures

  • UAC bypass 3 TTPs
  • Windows security bypass 2 TTPs
  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

  • XpertRAT Core Payload 2 IoCs
  • NirSoft MailPassView 2 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 2 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 6 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Deletes itself 1 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9bd273556358606717f3d0e7d4a2521dba396d6838d8dfccb78bfc5c98590b84.exe
    "C:\Users\Admin\AppData\Local\Temp\9bd273556358606717f3d0e7d4a2521dba396d6838d8dfccb78bfc5c98590b84.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:664
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 10
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:376
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 10
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2284
    • C:\Users\Admin\AppData\Local\Temp\9bd273556358606717f3d0e7d4a2521dba396d6838d8dfccb78bfc5c98590b84.exe
      C:\Users\Admin\AppData\Local\Temp\9bd273556358606717f3d0e7d4a2521dba396d6838d8dfccb78bfc5c98590b84.exe
      2⤵
        PID:2204
      • C:\Users\Admin\AppData\Local\Temp\9bd273556358606717f3d0e7d4a2521dba396d6838d8dfccb78bfc5c98590b84.exe
        C:\Users\Admin\AppData\Local\Temp\9bd273556358606717f3d0e7d4a2521dba396d6838d8dfccb78bfc5c98590b84.exe
        2⤵
          PID:1172
        • C:\Users\Admin\AppData\Local\Temp\9bd273556358606717f3d0e7d4a2521dba396d6838d8dfccb78bfc5c98590b84.exe
          C:\Users\Admin\AppData\Local\Temp\9bd273556358606717f3d0e7d4a2521dba396d6838d8dfccb78bfc5c98590b84.exe
          2⤵
            PID:1152
          • C:\Users\Admin\AppData\Local\Temp\9bd273556358606717f3d0e7d4a2521dba396d6838d8dfccb78bfc5c98590b84.exe
            C:\Users\Admin\AppData\Local\Temp\9bd273556358606717f3d0e7d4a2521dba396d6838d8dfccb78bfc5c98590b84.exe
            2⤵
            • Windows security modification
            • Checks whether UAC is enabled
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1148
            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
              C:\Users\Admin\AppData\Local\Temp\9bd273556358606717f3d0e7d4a2521dba396d6838d8dfccb78bfc5c98590b84.exe
              3⤵
              • Adds policy Run key to start application
              • Adds Run key to start application
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1704
              • C:\Windows\SysWOW64\notepad.exe
                notepad.exe
                4⤵
                • Deletes itself
                PID:2528
              • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                /stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\znzanztle0.txt"
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3696
              • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                /stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\znzanztle1.txt"
                4⤵
                  PID:3756
                • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                  /stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\znzanztle2.txt"
                  4⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2788
                • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                  /stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\znzanztle3.txt"
                  4⤵
                    PID:2372
                  • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                    /stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\znzanztle4.txt"
                    4⤵
                      PID:2696

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                MD5

                66382a4ca6c4dcf75ce41417d44be93e

                SHA1

                8132cbef1c12f8a89a68a6153ade4286bf130812

                SHA256

                a70acce0f4c6ab59b88ce79d84c38d4abffe19b72b033250499b17d788a2db56

                SHA512

                2bf66f2850f4a65220085c55a5b3c8866453104d78fe516e5bd6e3e47df783062ce4ea10de580f2eb0274ac8c3ce71965201c49ef55a78f307731ccc8600aadc

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                MD5

                b4821eabebcec7042a448bd51c62a017

                SHA1

                e40827e39346f55e9b06c9e7b94519e9a9e37095

                SHA256

                e8febcc4e368a4003407b101bff5a97518335e6eae6a359df95cea7e7fb54ef5

                SHA512

                33caf76b86b70c6c705da3df6bd84bd2d880f0217551989996ce2a8764126d894b7e0375057f0dc1eed41c982dd4e1137596228791cfd3edc3b755cbf16a22be

              • C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\znzanztle2.txt

                MD5

                f94dc819ca773f1e3cb27abbc9e7fa27

                SHA1

                9a7700efadc5ea09ab288544ef1e3cd876255086

                SHA256

                a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92

                SHA512

                72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196

              • C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\znzanztle4.txt

                MD5

                f3b25701fe362ec84616a93a45ce9998

                SHA1

                d62636d8caec13f04e28442a0a6fa1afeb024bbb

                SHA256

                b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                SHA512

                98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

              • memory/376-125-0x0000000007C70000-0x0000000007C71000-memory.dmp

                Filesize

                4KB

              • memory/376-128-0x00000000086A0000-0x00000000086A1000-memory.dmp

                Filesize

                4KB

              • memory/376-123-0x00000000072E0000-0x00000000072E1000-memory.dmp

                Filesize

                4KB

              • memory/376-124-0x0000000007B00000-0x0000000007B01000-memory.dmp

                Filesize

                4KB

              • memory/376-121-0x0000000004A70000-0x0000000004A71000-memory.dmp

                Filesize

                4KB

              • memory/376-126-0x0000000007DD0000-0x0000000007DD1000-memory.dmp

                Filesize

                4KB

              • memory/376-127-0x0000000007DA0000-0x0000000007DA1000-memory.dmp

                Filesize

                4KB

              • memory/376-122-0x0000000004A72000-0x0000000004A73000-memory.dmp

                Filesize

                4KB

              • memory/376-129-0x00000000084F0000-0x00000000084F1000-memory.dmp

                Filesize

                4KB

              • memory/376-134-0x0000000009A00000-0x0000000009A01000-memory.dmp

                Filesize

                4KB

              • memory/376-135-0x0000000009170000-0x0000000009171000-memory.dmp

                Filesize

                4KB

              • memory/376-120-0x0000000007460000-0x0000000007461000-memory.dmp

                Filesize

                4KB

              • memory/376-119-0x00000000049A0000-0x00000000049A1000-memory.dmp

                Filesize

                4KB

              • memory/376-147-0x0000000004A73000-0x0000000004A74000-memory.dmp

                Filesize

                4KB

              • memory/376-116-0x0000000000000000-mapping.dmp

              • memory/664-162-0x0000000005CD0000-0x0000000005CD1000-memory.dmp

                Filesize

                4KB

              • memory/664-114-0x0000000000850000-0x0000000000851000-memory.dmp

                Filesize

                4KB

              • memory/664-163-0x00000000061E0000-0x000000000631E000-memory.dmp

                Filesize

                1.2MB

              • memory/664-164-0x0000000005C60000-0x0000000005C90000-memory.dmp

                Filesize

                192KB

              • memory/1148-166-0x00000000004010B8-mapping.dmp

              • memory/1148-176-0x0000000000400000-0x000000000042C000-memory.dmp

                Filesize

                176KB

              • memory/1148-165-0x0000000000400000-0x000000000042C000-memory.dmp

                Filesize

                176KB

              • memory/1704-170-0x0000000000401364-mapping.dmp

              • memory/1704-169-0x0000000000400000-0x0000000000443000-memory.dmp

                Filesize

                268KB

              • memory/1704-173-0x0000000003280000-0x00000000033D3000-memory.dmp

                Filesize

                1.3MB

              • memory/1704-174-0x0000000003281000-0x000000000337D000-memory.dmp

                Filesize

                1008KB

              • memory/2284-148-0x00000000010D0000-0x00000000010D1000-memory.dmp

                Filesize

                4KB

              • memory/2284-161-0x00000000010D3000-0x00000000010D4000-memory.dmp

                Filesize

                4KB

              • memory/2284-149-0x00000000010D2000-0x00000000010D3000-memory.dmp

                Filesize

                4KB

              • memory/2284-137-0x0000000000000000-mapping.dmp

              • memory/2372-192-0x0000000000400000-0x0000000000416000-memory.dmp

                Filesize

                88KB

              • memory/2372-193-0x0000000000413750-mapping.dmp

              • memory/2528-178-0x0000000000000000-mapping.dmp

              • memory/2696-196-0x0000000000400000-0x0000000000415000-memory.dmp

                Filesize

                84KB

              • memory/2696-197-0x000000000040C2A8-mapping.dmp

              • memory/2788-187-0x0000000000400000-0x0000000000459000-memory.dmp

                Filesize

                356KB

              • memory/2788-188-0x0000000000442F04-mapping.dmp

              • memory/3696-180-0x0000000000423BC0-mapping.dmp

              • memory/3696-179-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

              • memory/3756-183-0x0000000000400000-0x000000000041B000-memory.dmp

                Filesize

                108KB

              • memory/3756-184-0x0000000000411654-mapping.dmp