xpertrat | efa98ba251a3da83fa3443007da3f63ee7bec8000bfa20baa45a3be561e8327f

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

Processes:

frm_assemblerrutinernes.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	frm_assemblerrutinernes.exe

Windows security bypass 2 TTPs 1 IoCs

Disabling Security Tools

Modify Registry

Processes:

frm_assemblerrutinernes.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0"	frm_assemblerrutinernes.exe

XpertRAT
XpertRAT is a remote access trojan with various capabilities.
rat xpertrat

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\M8S4K007-L4J3-T2X1-Y1I8-V2S3M6Y771N5 = "C:\\Users\\Admin\\AppData\\Roaming\\M8S4K007-L4J3-T2X1-Y1I8-V2S3M6Y771N5\\M8S4K007-L4J3-T2X1-Y1I8-V2S3M6Y771N5.exe"	iexplore.exe

Executes dropped EXE 3 IoCs

Processes:

frm_assemblerrutinernes.exefrm_assemblerrutinernes.exefrm_assemblerrutinernes.exe

pid process

1116 frm_assemblerrutinernes.exe
1996 frm_assemblerrutinernes.exe
1428 frm_assemblerrutinernes.exe

pid	process
1116	frm_assemblerrutinernes.exe
1996	frm_assemblerrutinernes.exe
1428	frm_assemblerrutinernes.exe

Loads dropped DLL 4 IoCs

Processes:

efa98ba251a3da83fa3443007da3f63ee7bec8000bfa20baa45a3be561e8327f.exefrm_assemblerrutinernes.exefrm_assemblerrutinernes.exe

pid	process
1792	efa98ba251a3da83fa3443007da3f63ee7bec8000bfa20baa45a3be561e8327f.exe
1792	efa98ba251a3da83fa3443007da3f63ee7bec8000bfa20baa45a3be561e8327f.exe
1116	frm_assemblerrutinernes.exe
1996	frm_assemblerrutinernes.exe

Windows security modification 2 TTPs 1 IoCs

Disabling Security Tools

Modify Registry

Processes:

frm_assemblerrutinernes.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0"	frm_assemblerrutinernes.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

iexplore.exefrm_assemblerrutinernes.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\M8S4K007-L4J3-T2X1-Y1I8-V2S3M6Y771N5 = "C:\\Users\\Admin\\AppData\\Roaming\\M8S4K007-L4J3-T2X1-Y1I8-V2S3M6Y771N5\\M8S4K007-L4J3-T2X1-Y1I8-V2S3M6Y771N5.exe"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	frm_assemblerrutinernes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\frm_Sals3 = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\frm_assemblerrutinernes.vbs\""	frm_assemblerrutinernes.exe
Key created	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\M8S4K007-L4J3-T2X1-Y1I8-V2S3M6Y771N5 = "C:\\Users\\Admin\\AppData\\Roaming\\M8S4K007-L4J3-T2X1-Y1I8-V2S3M6Y771N5\\M8S4K007-L4J3-T2X1-Y1I8-V2S3M6Y771N5.exe"	iexplore.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

System Information Discovery

T1082

Processes:

frm_assemblerrutinernes.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	frm_assemblerrutinernes.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

efa98ba251a3da83fa3443007da3f63ee7bec8000bfa20baa45a3be561e8327f.exefrm_assemblerrutinernes.exefrm_assemblerrutinernes.exefrm_assemblerrutinernes.exe

description	pid	process	target process
PID 1820 set thread context of 1792	1820	efa98ba251a3da83fa3443007da3f63ee7bec8000bfa20baa45a3be561e8327f.exe	efa98ba251a3da83fa3443007da3f63ee7bec8000bfa20baa45a3be561e8327f.exe
PID 1116 set thread context of 1996	1116	frm_assemblerrutinernes.exe	frm_assemblerrutinernes.exe
PID 1996 set thread context of 1428	1996	frm_assemblerrutinernes.exe	frm_assemblerrutinernes.exe
PID 1428 set thread context of 1516	1428	frm_assemblerrutinernes.exe	iexplore.exe

Drops file in Windows directory 4 IoCs

Processes:

efa98ba251a3da83fa3443007da3f63ee7bec8000bfa20baa45a3be561e8327f.exeefa98ba251a3da83fa3443007da3f63ee7bec8000bfa20baa45a3be561e8327f.exefrm_assemblerrutinernes.exefrm_assemblerrutinernes.exe

description	ioc	process
File opened for modification	C:\Windows\win.ini	efa98ba251a3da83fa3443007da3f63ee7bec8000bfa20baa45a3be561e8327f.exe
File opened for modification	C:\Windows\win.ini	efa98ba251a3da83fa3443007da3f63ee7bec8000bfa20baa45a3be561e8327f.exe
File opened for modification	C:\Windows\win.ini	frm_assemblerrutinernes.exe
File opened for modification	C:\Windows\win.ini	frm_assemblerrutinernes.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

frm_assemblerrutinernes.exe

pid process

1428 frm_assemblerrutinernes.exe
1428 frm_assemblerrutinernes.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

iexplore.exe

description pid process

Token: SeDebugPrivilege 1516 iexplore.exe

pid	process
1428	frm_assemblerrutinernes.exe
1428	frm_assemblerrutinernes.exe

description	pid	process
Token: SeDebugPrivilege	1516	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

efa98ba251a3da83fa3443007da3f63ee7bec8000bfa20baa45a3be561e8327f.exeefa98ba251a3da83fa3443007da3f63ee7bec8000bfa20baa45a3be561e8327f.exefrm_assemblerrutinernes.exefrm_assemblerrutinernes.exefrm_assemblerrutinernes.exeiexplore.exe

pid	process
1820	efa98ba251a3da83fa3443007da3f63ee7bec8000bfa20baa45a3be561e8327f.exe
1792	efa98ba251a3da83fa3443007da3f63ee7bec8000bfa20baa45a3be561e8327f.exe
1116	frm_assemblerrutinernes.exe
1996	frm_assemblerrutinernes.exe
1428	frm_assemblerrutinernes.exe
1516	iexplore.exe

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

description	pid	process	target process
PID 1820 wrote to memory of 1792	1820	efa98ba251a3da83fa3443007da3f63ee7bec8000bfa20baa45a3be561e8327f.exe	efa98ba251a3da83fa3443007da3f63ee7bec8000bfa20baa45a3be561e8327f.exe
PID 1820 wrote to memory of 1792	1820	efa98ba251a3da83fa3443007da3f63ee7bec8000bfa20baa45a3be561e8327f.exe	efa98ba251a3da83fa3443007da3f63ee7bec8000bfa20baa45a3be561e8327f.exe
PID 1820 wrote to memory of 1792	1820	efa98ba251a3da83fa3443007da3f63ee7bec8000bfa20baa45a3be561e8327f.exe	efa98ba251a3da83fa3443007da3f63ee7bec8000bfa20baa45a3be561e8327f.exe
PID 1820 wrote to memory of 1792	1820	efa98ba251a3da83fa3443007da3f63ee7bec8000bfa20baa45a3be561e8327f.exe	efa98ba251a3da83fa3443007da3f63ee7bec8000bfa20baa45a3be561e8327f.exe
PID 1792 wrote to memory of 1116	1792	efa98ba251a3da83fa3443007da3f63ee7bec8000bfa20baa45a3be561e8327f.exe	frm_assemblerrutinernes.exe
PID 1792 wrote to memory of 1116	1792	efa98ba251a3da83fa3443007da3f63ee7bec8000bfa20baa45a3be561e8327f.exe	frm_assemblerrutinernes.exe
PID 1792 wrote to memory of 1116	1792	efa98ba251a3da83fa3443007da3f63ee7bec8000bfa20baa45a3be561e8327f.exe	frm_assemblerrutinernes.exe
PID 1792 wrote to memory of 1116	1792	efa98ba251a3da83fa3443007da3f63ee7bec8000bfa20baa45a3be561e8327f.exe	frm_assemblerrutinernes.exe
PID 1116 wrote to memory of 1996	1116	frm_assemblerrutinernes.exe	frm_assemblerrutinernes.exe
PID 1116 wrote to memory of 1996	1116	frm_assemblerrutinernes.exe	frm_assemblerrutinernes.exe
PID 1116 wrote to memory of 1996	1116	frm_assemblerrutinernes.exe	frm_assemblerrutinernes.exe
PID 1116 wrote to memory of 1996	1116	frm_assemblerrutinernes.exe	frm_assemblerrutinernes.exe
PID 1996 wrote to memory of 1428	1996	frm_assemblerrutinernes.exe	frm_assemblerrutinernes.exe
PID 1996 wrote to memory of 1428	1996	frm_assemblerrutinernes.exe	frm_assemblerrutinernes.exe
PID 1996 wrote to memory of 1428	1996	frm_assemblerrutinernes.exe	frm_assemblerrutinernes.exe
PID 1996 wrote to memory of 1428	1996	frm_assemblerrutinernes.exe	frm_assemblerrutinernes.exe
PID 1996 wrote to memory of 1428	1996	frm_assemblerrutinernes.exe	frm_assemblerrutinernes.exe
PID 1996 wrote to memory of 1428	1996	frm_assemblerrutinernes.exe	frm_assemblerrutinernes.exe
PID 1996 wrote to memory of 1428	1996	frm_assemblerrutinernes.exe	frm_assemblerrutinernes.exe
PID 1996 wrote to memory of 1428	1996	frm_assemblerrutinernes.exe	frm_assemblerrutinernes.exe
PID 1996 wrote to memory of 1428	1996	frm_assemblerrutinernes.exe	frm_assemblerrutinernes.exe
PID 1996 wrote to memory of 1428	1996	frm_assemblerrutinernes.exe	frm_assemblerrutinernes.exe
PID 1428 wrote to memory of 1516	1428	frm_assemblerrutinernes.exe	iexplore.exe
PID 1428 wrote to memory of 1516	1428	frm_assemblerrutinernes.exe	iexplore.exe
PID 1428 wrote to memory of 1516	1428	frm_assemblerrutinernes.exe	iexplore.exe
PID 1428 wrote to memory of 1516	1428	frm_assemblerrutinernes.exe	iexplore.exe
PID 1428 wrote to memory of 1516	1428	frm_assemblerrutinernes.exe	iexplore.exe
PID 1428 wrote to memory of 1516	1428	frm_assemblerrutinernes.exe	iexplore.exe
PID 1428 wrote to memory of 1516	1428	frm_assemblerrutinernes.exe	iexplore.exe
PID 1428 wrote to memory of 1516	1428	frm_assemblerrutinernes.exe	iexplore.exe
PID 1428 wrote to memory of 1516	1428	frm_assemblerrutinernes.exe	iexplore.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

Processes:

frm_assemblerrutinernes.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	frm_assemblerrutinernes.exe

C:\Users\Admin\AppData\Local\Temp\efa98ba251a3da83fa3443007da3f63ee7bec8000bfa20baa45a3be561e8327f.exe
"C:\Users\Admin\AppData\Local\Temp\efa98ba251a3da83fa3443007da3f63ee7bec8000bfa20baa45a3be561e8327f.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820

C:\Users\Admin\AppData\Local\Temp\efa98ba251a3da83fa3443007da3f63ee7bec8000bfa20baa45a3be561e8327f.exe
"C:\Users\Admin\AppData\Local\Temp\efa98ba251a3da83fa3443007da3f63ee7bec8000bfa20baa45a3be561e8327f.exe"
2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792

C:\Users\Admin\AppData\Local\Temp\frm_assemblerrutinernes.exe
"C:\Users\Admin\AppData\Local\Temp\frm_assemblerrutinernes.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1116

C:\Users\Admin\AppData\Local\Temp\frm_assemblerrutinernes.exe
"C:\Users\Admin\AppData\Local\Temp\frm_assemblerrutinernes.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996

C:\Users\Admin\AppData\Local\Temp\frm_assemblerrutinernes.exe
"C:\Users\Admin\AppData\Local\Temp\frm_assemblerrutinernes.exe"
5⤵
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1428

C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Admin\AppData\Local\Temp\frm_assemblerrutinernes.exe
6⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1516

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry