xpertrat | 0330d3f58300a7cac8144664d3fb2ee031ddbc7d6ad532de12cd71ed535b7dac

General

Target

f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe
Size

752KB
MD5

09fefe8f2d0e20847f08ebd26e29741f
SHA1

235393276d1b017e89acf3c891056e2fbe759f2b
SHA256

f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b
SHA512

6276bdda653057ff61a1dd73c74f87aed96617df36289beb3e0d89a11c1c46f2f55d8a6e5ef551c1b129967c185bc74cddf981b3fc8d468c927c667bb30b10cd
SSDEEP

12288:6ymn0lWxMzIHREJVk/bq4izoW/m7Ar+oxpjijYtxJ2uw7qVLF7QRbiGMTYRQ:bm0lWxMiQW/O4ue7G+upl1wGVLF7XGMZ

Score

10^/10

xpertrat sales evasion persistence rat trojan

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

sales

C2

103.212.81.159:5134

Mutex

P0U4N118-N5L3-W331-B1K0-Y2V3O6B8B2Q6

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0"	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe

XpertRAT
XpertRAT is a remote access trojan with various capabilities.
rat xpertrat

XpertRAT Core payload 1 IoCs

resource	yara_rule
behavioral1/memory/604-77-0x0000000000400000-0x0000000000443000-memory.dmp	xpertrat

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\P0U4N118-N5L3-W331-B1K0-Y2V3O6B8B2Q6 = "C:\\Users\\Admin\\AppData\\Roaming\\P0U4N118-N5L3-W331-B1K0-Y2V3O6B8B2Q6\\P0U4N118-N5L3-W331-B1K0-Y2V3O6B8B2Q6.exe"	iexplore.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0"	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Run\P0U4N118-N5L3-W331-B1K0-Y2V3O6B8B2Q6 = "C:\\Users\\Admin\\AppData\\Roaming\\P0U4N118-N5L3-W331-B1K0-Y2V3O6B8B2Q6\\P0U4N118-N5L3-W331-B1K0-Y2V3O6B8B2Q6.exe"	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\P0U4N118-N5L3-W331-B1K0-Y2V3O6B8B2Q6 = "C:\\Users\\Admin\\AppData\\Roaming\\P0U4N118-N5L3-W331-B1K0-Y2V3O6B8B2Q6\\P0U4N118-N5L3-W331-B1K0-Y2V3O6B8B2Q6.exe"	iexplore.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1328 set thread context of 828	1328	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe	32
PID 828 set thread context of 604	828	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1488	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1328	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe
1328	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe
828	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe
468	powershell.exe
828	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1328	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe
Token: SeDebugPrivilege	604	iexplore.exe
Token: SeDebugPrivilege	468	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
828	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe
604	iexplore.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 468	1328	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe	28
PID 1328 wrote to memory of 468	1328	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe	28
PID 1328 wrote to memory of 468	1328	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe	28
PID 1328 wrote to memory of 468	1328	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe	28
PID 1328 wrote to memory of 1488	1328	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe	30
PID 1328 wrote to memory of 1488	1328	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe	30
PID 1328 wrote to memory of 1488	1328	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe	30
PID 1328 wrote to memory of 1488	1328	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe	30
PID 1328 wrote to memory of 828	1328	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe	32
PID 1328 wrote to memory of 828	1328	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe	32
PID 1328 wrote to memory of 828	1328	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe	32
PID 1328 wrote to memory of 828	1328	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe	32
PID 1328 wrote to memory of 828	1328	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe	32
PID 1328 wrote to memory of 828	1328	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe	32
PID 1328 wrote to memory of 828	1328	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe	32
PID 1328 wrote to memory of 828	1328	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe	32
PID 828 wrote to memory of 604	828	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe	33
PID 828 wrote to memory of 604	828	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe	33
PID 828 wrote to memory of 604	828	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe	33
PID 828 wrote to memory of 604	828	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe	33
PID 828 wrote to memory of 604	828	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe	33
PID 828 wrote to memory of 604	828	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe	33
PID 828 wrote to memory of 604	828	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe	33
PID 828 wrote to memory of 604	828	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe	33
PID 828 wrote to memory of 604	828	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe	33

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe

C:\Users\Admin\AppData\Local\Temp\f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe
"C:\Users\Admin\AppData\Local\Temp\f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tQcdUx.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:468
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tQcdUx" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA333.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1488
- C:\Users\Admin\AppData\Local\Temp\f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe
  "C:\Users\Admin\AppData\Local\Temp\f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe"
  2⤵
  - UAC bypass
  - Windows security bypass
  - Windows security modification
  - Checks whether UAC is enabled
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:828
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b.exe
    3⤵
    - Adds policy Run key to start application
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:604

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Bypass User Account Control

Scheduled Task

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpA333.tmp

Filesize
1KB

MD5
fc68c5935fcad9382096913fd0acc008

SHA1
c62f7589fe93b6a9ef3f35412e94f2538b16fe36

SHA256
6094a48686259ad47d641bf8d56ea1e6d2b5b08c9761ca666d036dbbfc77f565

SHA512
3b431b0c761cccdd341fd8d1195148afa1d873e68e061890ddcb3da8286fae90b220f5fc606c2d5f004591e59f9d030df616b55e899036500bbbd81ee729680f

Download Submit
C:\Users\Admin\AppData\Roaming\P0U4N118-N5L3-W331-B1K0-Y2V3O6B8B2Q6\P0U4N118-N5L3-W331-B1K0-Y2V3O6B8B2Q6.exe

Filesize
752KB

MD5
09fefe8f2d0e20847f08ebd26e29741f

SHA1
235393276d1b017e89acf3c891056e2fbe759f2b

SHA256
f74ab1efa874c19f32108d0719951e9b2a6ab0bb9f9b66c53145e75efec1684b

SHA512
6276bdda653057ff61a1dd73c74f87aed96617df36289beb3e0d89a11c1c46f2f55d8a6e5ef551c1b129967c185bc74cddf981b3fc8d468c927c667bb30b10cd

Download Submit
memory/604-77-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/828-72-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/828-70-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/828-85-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/828-78-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/828-71-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/828-68-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/828-69-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1328-67-0x0000000002260000-0x0000000002294000-memory.dmp

Filesize
208KB

Download
memory/1328-58-0x00000000004B0000-0x00000000004BC000-memory.dmp

Filesize
48KB

Download
memory/1328-54-0x0000000000D40000-0x0000000000E02000-memory.dmp

Filesize
776KB

Download
memory/1328-56-0x0000000000250000-0x0000000000262000-memory.dmp

Filesize
72KB

Download
memory/1328-57-0x0000000004FD0000-0x0000000005010000-memory.dmp

Filesize
256KB

Download
memory/1328-55-0x0000000004FD0000-0x0000000005010000-memory.dmp

Filesize
256KB

Download
memory/1328-59-0x00000000049C0000-0x0000000004A2C000-memory.dmp

Filesize
432KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads