Analysis

  • max time kernel
    85s
  • max time network
    143s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    04-10-2021 15:59

General

  • Target

    5028df0da2732dc8528ca9b7d7e41be5.exe

  • Size

    20KB

  • MD5

    5028df0da2732dc8528ca9b7d7e41be5

  • SHA1

    462a178ab8063511109a91e11d44443485edd49d

  • SHA256

    9bd273556358606717f3d0e7d4a2521dba396d6838d8dfccb78bfc5c98590b84

  • SHA512

    dc31474f8a6ac3a1ca811a769a6c8c13b7beec22071565a37cbd8db85831e5d0fc3f270dc1328705849c23fac6eb7c1b55bc255db69ec3d7380771914fc8c3ae

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

Test

C2

kapasky-antivirus.firewall-gateway.net:4000

Mutex

L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0

Signatures

  • UAC bypass 3 TTPs
  • Windows security bypass 2 TTPs
  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

  • XpertRAT Core Payload 2 IoCs
  • NirSoft MailPassView 2 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 2 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 6 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Deletes itself 1 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Program crash 2 IoCs
  • Suspicious use of SetThreadContext 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5028df0da2732dc8528ca9b7d7e41be5.exe
    "C:\Users\Admin\AppData\Local\Temp\5028df0da2732dc8528ca9b7d7e41be5.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1832
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 10
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1632
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 10
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1264
    • C:\Users\Admin\AppData\Local\Temp\5028df0da2732dc8528ca9b7d7e41be5.exe
      C:\Users\Admin\AppData\Local\Temp\5028df0da2732dc8528ca9b7d7e41be5.exe
      2⤵
      • Windows security modification
      • Checks whether UAC is enabled
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2944
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        C:\Users\Admin\AppData\Local\Temp\5028df0da2732dc8528ca9b7d7e41be5.exe
        3⤵
        • Adds policy Run key to start application
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3732
        • C:\Windows\SysWOW64\notepad.exe
          notepad.exe
          4⤵
          • Deletes itself
          PID:2836
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          /stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\qefowcddn0.txt"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3988
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          /stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\qefowcddn1.txt"
          4⤵
            PID:3836
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            /stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\qefowcddn2.txt"
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:2208
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            /stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\qefowcddn3.txt"
            4⤵
              PID:920
            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
              /stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\qefowcddn4.txt"
              4⤵
                PID:1036
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 92
                  5⤵
                  • Program crash
                  PID:2724
              • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                /stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\qefowcddn4.txt"
                4⤵
                  PID:1280
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 1280 -s 92
                    5⤵
                    • Program crash
                    PID:384
                • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                  /stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\qefowcddn4.txt"
                  4⤵
                    PID:824

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

              MD5

              66382a4ca6c4dcf75ce41417d44be93e

              SHA1

              8132cbef1c12f8a89a68a6153ade4286bf130812

              SHA256

              a70acce0f4c6ab59b88ce79d84c38d4abffe19b72b033250499b17d788a2db56

              SHA512

              2bf66f2850f4a65220085c55a5b3c8866453104d78fe516e5bd6e3e47df783062ce4ea10de580f2eb0274ac8c3ce71965201c49ef55a78f307731ccc8600aadc

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              MD5

              2e398f58bc6e1d9a56d56725948d8ae3

              SHA1

              52440dfe0628c2f558ccb5f6f2cf354b5ad447d5

              SHA256

              3c4152d14a92f3642d86586382fdc77e506df8e2dab21a8b2e8ad463ae6c40e0

              SHA512

              64ac4e09ee1ee80ee4786209f746c5b7a006f0dc4390d4bad37d1e799deaeb986e0df925c07f8eb64a5996e70c532ac6098d3d75d712a8d0eee69e757f84419e

            • C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\qefowcddn2.txt

              MD5

              f94dc819ca773f1e3cb27abbc9e7fa27

              SHA1

              9a7700efadc5ea09ab288544ef1e3cd876255086

              SHA256

              a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92

              SHA512

              72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196

            • C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\qefowcddn4.txt

              MD5

              f3b25701fe362ec84616a93a45ce9998

              SHA1

              d62636d8caec13f04e28442a0a6fa1afeb024bbb

              SHA256

              b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

              SHA512

              98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

            • memory/824-201-0x000000000040C2A8-mapping.dmp

            • memory/824-200-0x0000000000400000-0x0000000000415000-memory.dmp

              Filesize

              84KB

            • memory/920-192-0x0000000000400000-0x0000000000416000-memory.dmp

              Filesize

              88KB

            • memory/920-193-0x0000000000413750-mapping.dmp

            • memory/1036-197-0x000000000040C2A8-mapping.dmp

            • memory/1264-161-0x0000000006F03000-0x0000000006F04000-memory.dmp

              Filesize

              4KB

            • memory/1264-152-0x0000000006F02000-0x0000000006F03000-memory.dmp

              Filesize

              4KB

            • memory/1264-151-0x0000000006F00000-0x0000000006F01000-memory.dmp

              Filesize

              4KB

            • memory/1264-137-0x0000000000000000-mapping.dmp

            • memory/1280-199-0x000000000040C2A8-mapping.dmp

            • memory/1632-124-0x0000000006BF0000-0x0000000006BF1000-memory.dmp

              Filesize

              4KB

            • memory/1632-126-0x0000000007530000-0x0000000007531000-memory.dmp

              Filesize

              4KB

            • memory/1632-134-0x0000000009380000-0x0000000009381000-memory.dmp

              Filesize

              4KB

            • memory/1632-129-0x0000000007CD0000-0x0000000007CD1000-memory.dmp

              Filesize

              4KB

            • memory/1632-150-0x0000000006753000-0x0000000006754000-memory.dmp

              Filesize

              4KB

            • memory/1632-128-0x0000000007C00000-0x0000000007C01000-memory.dmp

              Filesize

              4KB

            • memory/1632-127-0x0000000006D70000-0x0000000006D71000-memory.dmp

              Filesize

              4KB

            • memory/1632-135-0x0000000008940000-0x0000000008941000-memory.dmp

              Filesize

              4KB

            • memory/1632-125-0x00000000074C0000-0x00000000074C1000-memory.dmp

              Filesize

              4KB

            • memory/1632-123-0x0000000006A50000-0x0000000006A51000-memory.dmp

              Filesize

              4KB

            • memory/1632-121-0x0000000006750000-0x0000000006751000-memory.dmp

              Filesize

              4KB

            • memory/1632-122-0x0000000006752000-0x0000000006753000-memory.dmp

              Filesize

              4KB

            • memory/1632-120-0x0000000006D90000-0x0000000006D91000-memory.dmp

              Filesize

              4KB

            • memory/1632-119-0x0000000004120000-0x0000000004121000-memory.dmp

              Filesize

              4KB

            • memory/1632-116-0x0000000000000000-mapping.dmp

            • memory/1832-162-0x00000000030D0000-0x00000000030D1000-memory.dmp

              Filesize

              4KB

            • memory/1832-114-0x0000000000E30000-0x0000000000E31000-memory.dmp

              Filesize

              4KB

            • memory/1832-163-0x0000000006610000-0x000000000674E000-memory.dmp

              Filesize

              1.2MB

            • memory/1832-164-0x0000000006AD0000-0x0000000006B00000-memory.dmp

              Filesize

              192KB

            • memory/2208-188-0x0000000000442F04-mapping.dmp

            • memory/2208-187-0x0000000000400000-0x0000000000459000-memory.dmp

              Filesize

              356KB

            • memory/2836-178-0x0000000000000000-mapping.dmp

            • memory/2944-166-0x00000000004010B8-mapping.dmp

            • memory/2944-165-0x0000000000400000-0x000000000042C000-memory.dmp

              Filesize

              176KB

            • memory/2944-176-0x0000000000400000-0x000000000042C000-memory.dmp

              Filesize

              176KB

            • memory/3732-173-0x0000000003340000-0x0000000003493000-memory.dmp

              Filesize

              1.3MB

            • memory/3732-170-0x0000000000401364-mapping.dmp

            • memory/3732-169-0x0000000000400000-0x0000000000443000-memory.dmp

              Filesize

              268KB

            • memory/3732-174-0x0000000003341000-0x000000000343D000-memory.dmp

              Filesize

              1008KB

            • memory/3836-184-0x0000000000411654-mapping.dmp

            • memory/3836-183-0x0000000000400000-0x000000000041B000-memory.dmp

              Filesize

              108KB

            • memory/3988-179-0x0000000000400000-0x0000000000426000-memory.dmp

              Filesize

              152KB

            • memory/3988-180-0x0000000000423BC0-mapping.dmp