Overview

overview

10

Static

static

962d681a9f...53.exe

windows7_x64

10

962d681a9f...53.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    962d681a9f42e1cd5245ca02d7114d4f7daf496ccbf17b2b37b7a94c58199353

  • Size

    792KB

  • Sample

    220630-vml5tsfah5

  • MD5

    322b2bfde9f2f3d691b4fc1526182305

  • SHA1

    99bf7caed11dee1bf41bd039634af9d1468e8f69

  • SHA256

    962d681a9f42e1cd5245ca02d7114d4f7daf496ccbf17b2b37b7a94c58199353

  • SHA512

    6fb915635d37375fd08aa854fb5a1e85ca9bdb6b7a7f5972bf0ea8e677dd24f6128003635626bb0036ef62f04afae7296230cac38adea880a7fa537d694cb132

Score
10/10
xpertratevasionpersistencerattrojan

Malware Config

Targets

    • Target

      962d681a9f42e1cd5245ca02d7114d4f7daf496ccbf17b2b37b7a94c58199353

    • Size

      792KB

    • MD5

      322b2bfde9f2f3d691b4fc1526182305

    • SHA1

      99bf7caed11dee1bf41bd039634af9d1468e8f69

    • SHA256

      962d681a9f42e1cd5245ca02d7114d4f7daf496ccbf17b2b37b7a94c58199353

    • SHA512

      6fb915635d37375fd08aa854fb5a1e85ca9bdb6b7a7f5972bf0ea8e677dd24f6128003635626bb0036ef62f04afae7296230cac38adea880a7fa537d694cb132

    Score
    10/10
    xpertratevasionpersistencerattrojan

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • XpertRAT

      XpertRAT is a remote access trojan with various capabilities.

      ratxpertrat

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

3
T1089

Modify Registry

7
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks