xpertrat | 25a80f4addf74c82d8ae815164c44dcd530fd59fc278f306552d35d5140b880b | Triage

Submit
Reports

Overview

overview

Static

static

CS-SUPPLIE...B).exe

windows7_x64

CS-SUPPLIE...B).exe

windows10-2004_x64

Sharing

General

Target

CS-SUPPLIER QUOTATION SPECIFICATION 2022-0120 45PCS.PDF(97KB).exe
Size

380KB
Sample

220120-jbv3taggd4
MD5

1402bc75caa465e3c69c302a7390a8e7
SHA1

df94f132f82c48cdda43a1121266320a1520ffdc
SHA256

25a80f4addf74c82d8ae815164c44dcd530fd59fc278f306552d35d5140b880b
SHA512

5fc4fe7216c19ae454bf681a53bf0a573a4aed13ca2d596c2c361b4390cffe4b232887e32c1bbf75b6d770100e4878a88b7fea564c7efee211bf80c763f0bcc2

Score

10^/10

xpertrat collection evasion persistence rat trojan

Static task

static1

Behavioral task

behavioral1

Sample

CS-SUPPLIER QUOTATION SPECIFICATION 2022-0120 45PCS.PDF(97KB).exe

Resource

win7-en-20211208

xpertrat collection evasion persistence rat trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

CS-SUPPLIER QUOTATION SPECIFICATION 2022-0120 45PCS.PDF(97KB).exe

Resource

win10v2004-en-20220112

xpertrat collection evasion persistence rat trojan

windows10-2004_x64

0 signatures

0 seconds

Malware Config

Targets

- Target
  
  CS-SUPPLIER QUOTATION SPECIFICATION 2022-0120 45PCS.PDF(97KB).exe
- Size
  
  380KB
- MD5
  
  1402bc75caa465e3c69c302a7390a8e7
- SHA1
  
  df94f132f82c48cdda43a1121266320a1520ffdc
- SHA256
  
  25a80f4addf74c82d8ae815164c44dcd530fd59fc278f306552d35d5140b880b
- SHA512
  
  5fc4fe7216c19ae454bf681a53bf0a573a4aed13ca2d596c2c361b4390cffe4b232887e32c1bbf75b6d770100e4878a88b7fea564c7efee211bf80c763f0bcc2
Score

10^/10

xpertrat collection evasion persistence rat trojan
- Suspicious use of NtCreateProcessExOtherParentProcess
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- XpertRAT
  XpertRAT is a remote access trojan with various capabilities.
  rat xpertrat
- Adds policy Run key to start application
  persistence
- Sets service image path in registry
  persistence
- Windows security modification
  evasion trojan
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Program crash
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Email Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

xpertratcollectionevasionpersistencerattrojan

behavioral2

xpertratcollectionevasionpersistencerattrojan

© 2018-2024

Terms | Privacy