Overview

overview

10

Static

static

8ae24ff669...6a.exe

windows7_x64

10

8ae24ff669...6a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8ae24ff669ba9e67c0a9617b5057c9fa8605aeceb13ce16883cd47f8f4f4e16a

  • Size

    2.7MB

  • Sample

    220420-elp74aadg8

  • MD5

    b88f7a11b9f3b4573bc22462dc292606

  • SHA1

    121f600ab2ba4534b3a7f7580cb434007ef81d5c

  • SHA256

    8ae24ff669ba9e67c0a9617b5057c9fa8605aeceb13ce16883cd47f8f4f4e16a

  • SHA512

    0a8935aa8bc7161a485bfeb9da5cab2aa492bc4e992f50fcd31e3a0d5c09c1a4f841749cbb3fedf7e76cf9119549848dc42c20029a7bbb6f355018efb3c0179c

Score
10/10
xpertratevasionpersistencerattrojan

Malware Config

Targets

    • Target

      8ae24ff669ba9e67c0a9617b5057c9fa8605aeceb13ce16883cd47f8f4f4e16a

    • Size

      2.7MB

    • MD5

      b88f7a11b9f3b4573bc22462dc292606

    • SHA1

      121f600ab2ba4534b3a7f7580cb434007ef81d5c

    • SHA256

      8ae24ff669ba9e67c0a9617b5057c9fa8605aeceb13ce16883cd47f8f4f4e16a

    • SHA512

      0a8935aa8bc7161a485bfeb9da5cab2aa492bc4e992f50fcd31e3a0d5c09c1a4f841749cbb3fedf7e76cf9119549848dc42c20029a7bbb6f355018efb3c0179c

    Score
    10/10
    xpertratevasionpersistencerattrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Turns off Windows Defender SpyNet reporting

      evasion

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • XpertRAT

      XpertRAT is a remote access trojan with various capabilities.

      ratxpertrat

    • Adds policy Run key to start application

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Modify Registry

8
T1112

Disabling Security Tools

5
T1089

Bypass User Account Control

1
T1088

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks