Overview

overview

10

Static

static

5f38c61d58...e0.exe

windows7_x64

10

5f38c61d58...e0.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5f38c61d58d0d5522178242d87339de0.exe

  • Size

    531KB

  • Sample

    211220-1d7casbgh8

  • MD5

    5f38c61d58d0d5522178242d87339de0

  • SHA1

    98a281508114a6af38e4a4df1d5c0b14e1d20287

  • SHA256

    4249f5106c811376877169cfb829b5274dc840e6487e34c690c0e6511a8149d1

  • SHA512

    ef8477aa4f80211dfad3a7935ce059b584c269a7d85210e38bcc372b8b2b6bc62d13ad2dda67b82dfb727b91a3dcc06f63580201ac18fa0f7589572a5b7d615b

Score
10/10
xpertratcollectionevasionpersistencerattrojan

Malware Config

Targets

    • Target

      5f38c61d58d0d5522178242d87339de0.exe

    • Size

      531KB

    • MD5

      5f38c61d58d0d5522178242d87339de0

    • SHA1

      98a281508114a6af38e4a4df1d5c0b14e1d20287

    • SHA256

      4249f5106c811376877169cfb829b5274dc840e6487e34c690c0e6511a8149d1

    • SHA512

      ef8477aa4f80211dfad3a7935ce059b584c269a7d85210e38bcc372b8b2b6bc62d13ad2dda67b82dfb727b91a3dcc06f63580201ac18fa0f7589572a5b7d615b

    Score
    10/10
    xpertratcollectionevasionpersistencerattrojan

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • XpertRAT

      XpertRAT is a remote access trojan with various capabilities.

      ratxpertrat

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Adds policy Run key to start application

      persistence

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Windows security modification

      evasiontrojan

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Program crash

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

3
T1089

Modify Registry

6
T1112

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks