Analysis

  • max time kernel
    151s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    15-04-2022 16:14

General

  • Target

    14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe

  • Size

    656KB

  • MD5

    fabd1bde9dfaf4ea736727c8b84d2f3b

  • SHA1

    389a3e4d6185a9857053451979dd8ba74cb04886

  • SHA256

    14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789

  • SHA512

    2fecda06d9370b98e88c08e3c6cc0b805c66083a41081201ed9e72d3a5124e5b3bab4b8d70845d30aa612257cd16d5b5184618b803a29f93b3d5451d48dd14d9

Malware Config

Signatures

  • UAC bypass 3 TTPs
  • Windows security bypass 2 TTPs
  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe
    "C:\Users\Admin\AppData\Local\Temp\14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3740
    • C:\Users\Admin\AppData\Local\Temp\14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe
      "{path}"
      2⤵
      • Windows security modification
      • Checks whether UAC is enabled
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2244
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        C:\Users\Admin\AppData\Local\Temp\14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe
        3⤵
        • Adds policy Run key to start application
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2984
        • C:\Windows\SysWOW64\notepad.exe
          notepad.exe
          4⤵
            PID:1760

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    2
    T1060

    Privilege Escalation

    Bypass User Account Control

    1
    T1088

    Defense Evasion

    Bypass User Account Control

    1
    T1088

    Disabling Security Tools

    3
    T1089

    Modify Registry

    6
    T1112

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1760-142-0x0000000000000000-mapping.dmp
    • memory/2244-136-0x0000000000000000-mapping.dmp
    • memory/2244-137-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

    • memory/2244-139-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

    • memory/2244-143-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

    • memory/3740-130-0x00000000009E0000-0x0000000000A8A000-memory.dmp
      Filesize

      680KB

    • memory/3740-131-0x0000000005A50000-0x0000000005FF4000-memory.dmp
      Filesize

      5.6MB

    • memory/3740-132-0x00000000054A0000-0x0000000005532000-memory.dmp
      Filesize

      584KB

    • memory/3740-133-0x0000000005440000-0x000000000544A000-memory.dmp
      Filesize

      40KB

    • memory/3740-134-0x0000000006530000-0x0000000006A5C000-memory.dmp
      Filesize

      5.2MB

    • memory/3740-135-0x0000000006C60000-0x0000000006CFC000-memory.dmp
      Filesize

      624KB