Analysis

  • max time kernel
    170s
  • max time network
    176s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    12-05-2022 21:44

General

  • Target

    SecuriteInfo.com.Trojan.Siggen17.50772.426.exe

  • Size

    502KB

  • MD5

    d1d7f23ea413b011f029e5d97890c41e

  • SHA1

    82153f7e21609a7dfb1ee98e56915393bdb504b8

  • SHA256

    d37b127c493bbf59bff2017e49513c0f80a5db906715f5e22bbb23d24c2cca3b

  • SHA512

    a7bfc0c64be27fd45ab3d0b0aab47553a25de6535667e643b3caeecc8b9b7557b5ca361936ef2a32d44387ba5418ad5ece5065403992e1fbda869e7a49e5e298

Malware Config

Signatures

  • UAC bypass 3 TTPs
  • Windows security bypass 2 TTPs
  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Program crash 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen17.50772.426.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen17.50772.426.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2592
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3212
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        3⤵
          PID:208
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 84
            4⤵
            • Program crash
            PID:1400
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          3⤵
          • Adds policy Run key to start application
          • Adds Run key to start application
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3808
          • C:\Windows\SysWOW64\notepad.exe
            notepad.exe
            4⤵
              PID:2936
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 208 -ip 208
        1⤵
          PID:4772

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Persistence

        Registry Run Keys / Startup Folder

        2
        T1060

        Privilege Escalation

        Bypass User Account Control

        1
        T1088

        Defense Evasion

        Bypass User Account Control

        1
        T1088

        Disabling Security Tools

        2
        T1089

        Modify Registry

        4
        T1112

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2592-130-0x00000000007E0000-0x0000000000864000-memory.dmp
          Filesize

          528KB

        • memory/2592-131-0x00000000055E0000-0x0000000005B84000-memory.dmp
          Filesize

          5.6MB

        • memory/2592-132-0x00000000050D0000-0x0000000005162000-memory.dmp
          Filesize

          584KB

        • memory/2592-133-0x0000000005210000-0x00000000052AC000-memory.dmp
          Filesize

          624KB

        • memory/2592-134-0x0000000005170000-0x000000000517A000-memory.dmp
          Filesize

          40KB

        • memory/2592-135-0x00000000075C0000-0x0000000007626000-memory.dmp
          Filesize

          408KB

        • memory/2936-143-0x0000000000000000-mapping.dmp
        • memory/3212-136-0x0000000000000000-mapping.dmp
        • memory/3212-137-0x0000000000400000-0x000000000042C000-memory.dmp
          Filesize

          176KB

        • memory/3212-139-0x0000000000400000-0x000000000042C000-memory.dmp
          Filesize

          176KB

        • memory/3212-142-0x0000000000400000-0x000000000042C000-memory.dmp
          Filesize

          176KB