Overview

overview

10

Static

static

24b0f646c3...30.exe

windows7_x64

10

24b0f646c3...30.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    147s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    11-06-2022 21:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    24b0f646c3bb9d35e9761b5d851b09c866eb8466d7438cedb561e8e79fe2af30.exe

  • Size

    584KB

  • MD5

    171569a4ca58064919c3d9e9cffcd1d0

  • SHA1

    754db0cdffc636d95ee6a12d19a045bc95d9444c

  • SHA256

    24b0f646c3bb9d35e9761b5d851b09c866eb8466d7438cedb561e8e79fe2af30

  • SHA512

    fb08c20a852663129aeb5e50d4e1c9e63d0a084a27cc81d60a79525f996bbcc25f04859b7c381f01f3c266e14a12e03b1c5b1efbd3affeb5b348c1d32075b151

Score
10/10
xpertratevasionpersistencerattrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 1 IoCs
    evasiontrojan
  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat
  • Adds policy Run key to start application 2 TTPs 2 IoCs
    persistence
  • Windows security modification 2 TTPs 1 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Program crash 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\24b0f646c3bb9d35e9761b5d851b09c866eb8466d7438cedb561e8e79fe2af30.exe
    "C:\Users\Admin\AppData\Local\Temp\24b0f646c3bb9d35e9761b5d851b09c866eb8466d7438cedb561e8e79fe2af30.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3780
    • C:\Users\Admin\AppData\Local\Temp\24b0f646c3bb9d35e9761b5d851b09c866eb8466d7438cedb561e8e79fe2af30.exe
      C:\Users\Admin\AppData\Local\Temp\24b0f646c3bb9d35e9761b5d851b09c866eb8466d7438cedb561e8e79fe2af30.exe"
      2⤵
      • UAC bypass
      • Windows security bypass
      • Windows security modification
      • Checks whether UAC is enabled
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2196
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        C:\Users\Admin\AppData\Local\Temp\24b0f646c3bb9d35e9761b5d851b09c866eb8466d7438cedb561e8e79fe2af30.exe
        3⤵
          PID:1428
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 192
            4⤵
            • Program crash
            PID:2656
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          C:\Users\Admin\AppData\Local\Temp\24b0f646c3bb9d35e9761b5d851b09c866eb8466d7438cedb561e8e79fe2af30.exe
          3⤵
            PID:2168
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 84
              4⤵
              • Program crash
              PID:4708
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            C:\Users\Admin\AppData\Local\Temp\24b0f646c3bb9d35e9761b5d851b09c866eb8466d7438cedb561e8e79fe2af30.exe
            3⤵
            • Adds policy Run key to start application
            • Adds Run key to start application
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4716
            • C:\Windows\SysWOW64\notepad.exe
              notepad.exe
              4⤵
                PID:2652
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1428 -ip 1428
          1⤵
            PID:2844
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2168 -ip 2168
            1⤵
              PID:1472

            Network

            MITRE ATT&CK Matrix ATT&CK v6

            Initial Access

            Execution

            Persistence

            Registry Run Keys / Startup Folder

            2
            T1060

            Privilege Escalation

            Bypass User Account Control

            1
            T1088

            Defense Evasion

            Bypass User Account Control

            1
            T1088

            Disabling Security Tools

            3
            T1089

            Modify Registry

            6
            T1112

            Credential Access

            Discovery

            System Information Discovery

            1
            T1082

            Lateral Movement

            Collection

            Exfiltration

            Command and Control

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/2196-133-0x0000000000000000-mapping.dmp
              Download
            • memory/2196-138-0x0000000000400000-0x000000000042C000-memory.dmp
              Filesize

              176KB

              Download
            • memory/2196-137-0x0000000000400000-0x0000000000495000-memory.dmp
              Filesize

              596KB

              Download
            • memory/2196-141-0x00007FFBF29F0000-0x00007FFBF2BE5000-memory.dmp
              Filesize

              2.0MB

              Download
            • memory/2196-142-0x0000000077C90000-0x0000000077E33000-memory.dmp
              Filesize

              1.6MB

              Download
            • memory/2196-146-0x00000000004E0000-0x00000000004E7000-memory.dmp
              Filesize

              28KB

              Download
            • memory/2196-147-0x0000000077C90000-0x0000000077E33000-memory.dmp
              Filesize

              1.6MB

              Download
            • memory/2652-145-0x0000000000000000-mapping.dmp
              Download
            • memory/3780-132-0x0000000000680000-0x0000000000687000-memory.dmp
              Filesize

              28KB

              Download
            • memory/3780-134-0x0000000000680000-0x0000000000687000-memory.dmp
              Filesize

              28KB

              Download
            • memory/3780-135-0x00007FFBF29F0000-0x00007FFBF2BE5000-memory.dmp
              Filesize

              2.0MB

              Download
            • memory/3780-136-0x0000000077C90000-0x0000000077E33000-memory.dmp
              Filesize

              1.6MB

              Download