Analysis

  • max time kernel
    4294216s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20220310-en
  • submitted
    26-03-2022 13:28

General

  • Target

    65989f6e9b94e49f8ab86cda80572b8b5d1cddd02297b453c81ab13c3368a1bd.exe

  • Size

    4.7MB

  • MD5

    5381190ae2511b2374d61486cf69c37b

  • SHA1

    22972a0f1482cb5343dc5623a95fcfbe7ec966de

  • SHA256

    65989f6e9b94e49f8ab86cda80572b8b5d1cddd02297b453c81ab13c3368a1bd

  • SHA512

    51ac0d0a1959324b4bddc5299d724aa1b9058faae643f2e7b04597be6a4b363f33cd5b603d5888dd9b80faf2a2150e5423184f6e09c95142a89f3a14e271e065

Malware Config

Signatures

  • UAC bypass 3 TTPs
  • Windows security bypass 2 TTPs
  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\65989f6e9b94e49f8ab86cda80572b8b5d1cddd02297b453c81ab13c3368a1bd.exe
    "C:\Users\Admin\AppData\Local\Temp\65989f6e9b94e49f8ab86cda80572b8b5d1cddd02297b453c81ab13c3368a1bd.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1096
    • C:\Users\Admin\AppData\Local\Temp\65989f6e9b94e49f8ab86cda80572b8b5d1cddd02297b453c81ab13c3368a1bd.exe
      "C:\Users\Admin\AppData\Local\Temp\65989f6e9b94e49f8ab86cda80572b8b5d1cddd02297b453c81ab13c3368a1bd.exe"
      2⤵
        PID:1948
      • C:\Users\Admin\AppData\Local\Temp\65989f6e9b94e49f8ab86cda80572b8b5d1cddd02297b453c81ab13c3368a1bd.exe
        "C:\Users\Admin\AppData\Local\Temp\65989f6e9b94e49f8ab86cda80572b8b5d1cddd02297b453c81ab13c3368a1bd.exe"
        2⤵
        • Windows security modification
        • Checks whether UAC is enabled
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:1956
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          C:\Users\Admin\AppData\Local\Temp\65989f6e9b94e49f8ab86cda80572b8b5d1cddd02297b453c81ab13c3368a1bd.exe
          3⤵
          • Adds policy Run key to start application
          • Adds Run key to start application
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1624

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    2
    T1060

    Privilege Escalation

    Bypass User Account Control

    1
    T1088

    Defense Evasion

    Bypass User Account Control

    1
    T1088

    Disabling Security Tools

    3
    T1089

    Modify Registry

    6
    T1112

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1096-54-0x0000000000AA0000-0x0000000000F5E000-memory.dmp
      Filesize

      4.7MB

    • memory/1096-55-0x00000000004D0000-0x000000000054E000-memory.dmp
      Filesize

      504KB

    • memory/1096-56-0x0000000075BA1000-0x0000000075BA3000-memory.dmp
      Filesize

      8KB

    • memory/1956-57-0x0000000000400000-0x000000000045B000-memory.dmp
      Filesize

      364KB

    • memory/1956-58-0x0000000000400000-0x000000000045B000-memory.dmp
      Filesize

      364KB

    • memory/1956-60-0x0000000000400000-0x000000000045B000-memory.dmp
      Filesize

      364KB

    • memory/1956-62-0x0000000000400000-0x000000000045B000-memory.dmp
      Filesize

      364KB

    • memory/1956-63-0x00000000004010B8-mapping.dmp