xpertrat | a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf

Analysis

max time kernel
159s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220722-en
resource tags

arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2022 05:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
Size

1.2MB
MD5

d58b1c2f540268bd9dd920455568d45f
SHA1

58fa23062ee8e44912be9712eed62fbe753289fd
SHA256

a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf
SHA512

f36c1bbf62b091647151751896b98c3edffbfc711c12f02db6ef588c5a4661d1f1c3b9a1615fb3405eb9298d06d4dade3ba3286291ff11b5fc980d2f1e4519c8

Score

10^/10

xpertrat hauk902 evasion rat trojan

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

Hauk902

expertworldwithout.gleeze.com:4444

Mutex

R2Q3F8F6-L8M2-T1G2-O4Y1-C3N4I3V1R3O0

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	svchost.exe

XpertRAT
XpertRAT is a remote access trojan with various capabilities.
rat xpertrat

XpertRAT Core payload 5 IoCs

resource	yara_rule
behavioral2/memory/3588-139-0x0000000000000000-mapping.dmp	xpertrat
behavioral2/memory/3588-140-0x0000000000400000-0x0000000000443000-memory.dmp	xpertrat
behavioral2/memory/3588-142-0x0000000000400000-0x0000000000443000-memory.dmp	xpertrat
behavioral2/memory/3588-145-0x0000000000400000-0x0000000000443000-memory.dmp	xpertrat
behavioral2/memory/3588-147-0x0000000000400000-0x0000000000443000-memory.dmp	xpertrat

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scp.lnk	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ut	svchost.exe
File opened for modification	C:\Windows\SysWOW64\R2Q3F8F6-L8M2-T1G2-O4Y1-C3N4I3V1R3O0	svchost.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2260 set thread context of 3468	2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe	81
PID 3468 set thread context of 2900	3468	svchost.exe	82
PID 3468 set thread context of 3588	3468	svchost.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1080	2900	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
3468	svchost.exe
3468	svchost.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
3468	svchost.exe
3468	svchost.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
3468	svchost.exe
3468	svchost.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3588	svchost.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3468	svchost.exe
3588	svchost.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 3468	2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe	81
PID 2260 wrote to memory of 3468	2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe	81
PID 2260 wrote to memory of 3468	2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe	81
PID 2260 wrote to memory of 3468	2260	a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe	81
PID 3468 wrote to memory of 2900	3468	svchost.exe	82
PID 3468 wrote to memory of 2900	3468	svchost.exe	82
PID 3468 wrote to memory of 2900	3468	svchost.exe	82
PID 3468 wrote to memory of 2900	3468	svchost.exe	82
PID 3468 wrote to memory of 2900	3468	svchost.exe	82
PID 3468 wrote to memory of 2900	3468	svchost.exe	82
PID 3468 wrote to memory of 2900	3468	svchost.exe	82
PID 3468 wrote to memory of 2900	3468	svchost.exe	82
PID 3468 wrote to memory of 3588	3468	svchost.exe	86
PID 3468 wrote to memory of 3588	3468	svchost.exe	86
PID 3468 wrote to memory of 3588	3468	svchost.exe	86
PID 3468 wrote to memory of 3588	3468	svchost.exe	86
PID 3468 wrote to memory of 3588	3468	svchost.exe	86
PID 3468 wrote to memory of 3588	3468	svchost.exe	86
PID 3468 wrote to memory of 3588	3468	svchost.exe	86
PID 3468 wrote to memory of 3588	3468	svchost.exe	86

C:\Users\Admin\AppData\Local\Temp\a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
"C:\Users\Admin\AppData\Local\Temp\a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\SysWOW64\svchost.exe"
  2⤵
  - UAC bypass
  - Windows security bypass
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:2900
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 84
      4⤵
      Program crash
      PID:1080
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2900 -ip 2900
1⤵
PID:2888

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2260-132-0x0000000000B90000-0x0000000000B93000-memory.dmp

Filesize
12KB

Download
memory/3468-135-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3468-146-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3588-140-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3588-142-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3588-145-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3588-147-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download