xpertrat | 79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

Processes:

FIX.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	FIX.exe

Windows security bypass 2 TTPs 1 IoCs

Disabling Security Tools

Modify Registry

Processes:

FIX.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	FIX.exe

XpertRAT
XpertRAT is a remote access trojan with various capabilities.
rat xpertrat

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

iexplore.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\A440L3X3-W3L2-L8R1-T2B2-T227F2P4U7V3 = "C:\\Users\\Admin\\AppData\\Roaming\\A440L3X3-W3L2-L8R1-T2B2-T227F2P4U7V3\\A440L3X3-W3L2-L8R1-T2B2-T227F2P4U7V3.exe"	iexplore.exe

Executes dropped EXE 4 IoCs

Processes:

Black Inject.exeDOWS.exeFIX.exeFIX.exe

pid	Process
3244	Black Inject.exe
528	DOWS.exe
1760	FIX.exe
2796	FIX.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exeDOWS.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	DOWS.exe

Windows security modification 2 TTPs 1 IoCs

Disabling Security Tools

Modify Registry

Processes:

FIX.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	FIX.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

iexplore.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\A440L3X3-W3L2-L8R1-T2B2-T227F2P4U7V3 = "C:\\Users\\Admin\\AppData\\Roaming\\A440L3X3-W3L2-L8R1-T2B2-T227F2P4U7V3\\A440L3X3-W3L2-L8R1-T2B2-T227F2P4U7V3.exe"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\A440L3X3-W3L2-L8R1-T2B2-T227F2P4U7V3 = "C:\\Users\\Admin\\AppData\\Roaming\\A440L3X3-W3L2-L8R1-T2B2-T227F2P4U7V3\\A440L3X3-W3L2-L8R1-T2B2-T227F2P4U7V3.exe"	iexplore.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

System Information Discovery

T1082

Processes:

FIX.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	FIX.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

FIX.exeFIX.exe

description	pid	Process	procid_target
PID 1760 set thread context of 2796	1760	FIX.exe	91
PID 2796 set thread context of 4060	2796	FIX.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

iexplore.exe

description	pid	Process
Token: SeDebugPrivilege	4060	iexplore.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exeBlack Inject.exeFIX.exeFIX.exeiexplore.exe

pid	Process
4868	79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exe
3244	Black Inject.exe
1760	FIX.exe
2796	FIX.exe
4060	iexplore.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exeDOWS.exeFIX.exeFIX.exeiexplore.exe

description	pid	Process	procid_target
PID 4868 wrote to memory of 3244	4868	79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exe	81
PID 4868 wrote to memory of 3244	4868	79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exe	81
PID 4868 wrote to memory of 3244	4868	79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exe	81
PID 4868 wrote to memory of 528	4868	79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exe	82
PID 4868 wrote to memory of 528	4868	79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exe	82
PID 4868 wrote to memory of 528	4868	79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exe	82
PID 528 wrote to memory of 1760	528	DOWS.exe	83
PID 528 wrote to memory of 1760	528	DOWS.exe	83
PID 528 wrote to memory of 1760	528	DOWS.exe	83
PID 1760 wrote to memory of 2796	1760	FIX.exe	91
PID 1760 wrote to memory of 2796	1760	FIX.exe	91
PID 1760 wrote to memory of 2796	1760	FIX.exe	91
PID 1760 wrote to memory of 2796	1760	FIX.exe	91
PID 1760 wrote to memory of 2796	1760	FIX.exe	91
PID 1760 wrote to memory of 2796	1760	FIX.exe	91
PID 1760 wrote to memory of 2796	1760	FIX.exe	91
PID 1760 wrote to memory of 2796	1760	FIX.exe	91
PID 2796 wrote to memory of 4060	2796	FIX.exe	92
PID 2796 wrote to memory of 4060	2796	FIX.exe	92
PID 2796 wrote to memory of 4060	2796	FIX.exe	92
PID 2796 wrote to memory of 4060	2796	FIX.exe	92
PID 2796 wrote to memory of 4060	2796	FIX.exe	92
PID 2796 wrote to memory of 4060	2796	FIX.exe	92
PID 2796 wrote to memory of 4060	2796	FIX.exe	92
PID 2796 wrote to memory of 4060	2796	FIX.exe	92
PID 4060 wrote to memory of 5104	4060	iexplore.exe	93
PID 4060 wrote to memory of 5104	4060	iexplore.exe	93
PID 4060 wrote to memory of 5104	4060	iexplore.exe	93
PID 4060 wrote to memory of 5104	4060	iexplore.exe	93

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

Processes:

FIX.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	FIX.exe

C:\Users\Admin\AppData\Local\Temp\79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exe
"C:\Users\Admin\AppData\Local\Temp\79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Users\Admin\AppData\Local\Temp\Black Inject.exe
  "C:\Users\Admin\AppData\Local\Temp\Black Inject.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3244
- C:\Users\Admin\AppData\Local\Temp\DOWS.exe
  "C:\Users\Admin\AppData\Local\Temp\DOWS.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:528
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\FIX.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\FIX.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1760
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\FIX.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\FIX.exe"
      4⤵
      UAC bypass
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Checks whether UAC is enabled
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2796
    - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX0\FIX.exe
        5⤵
        Adds policy Run key to start application
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4060
      - C:\Windows\SysWOW64\notepad.exe
        
        notepad.exe
        6⤵
        
        PID:5104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry