Overview

overview

10

Static

static

3

be15093a40...3c.exe

windows7-x64

10

be15093a40...3c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-10-2023 00:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    be15093a407e5b70f5539df5eb1c18d0aedee626f6dc7e9db262c29bfe39ba3c.exe

  • Size

    604KB

  • MD5

    cb1ccbc5c88657e1f63a2cd3b1c240b6

  • SHA1

    f237f76e21cbe5edf11a33ba05265df25c665050

  • SHA256

    be15093a407e5b70f5539df5eb1c18d0aedee626f6dc7e9db262c29bfe39ba3c

  • SHA512

    0a08c6bb26268d1a902c9bbb28a583e364e565d745fa83a4bc3ef2d4ecd237a049f192467476bb0fd0f0c14addc8be4412481f8cb8e6a1a6dcec36d600d46298

  • SSDEEP

    12288:BYWAfDuHOXdZV8c5ZGdMc5aMWjrP8N3+Qk0Duy:BYWgTZScqpUP8NEA7

Score
10/10
xpertratstrigioevasionpersistencerattrojan

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

STRIGIO

C2

sandshoe.myfirewall.org:5344

Mutex

I8N3F0X7-G4E2-P2S0-T0D7-R1N2H5T660I4

Signatures

  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 1 IoCs
    evasiontrojan
  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat
  • XpertRAT Core payload 1 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
    persistence
  • Windows security modification 2 TTPs 1 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\be15093a407e5b70f5539df5eb1c18d0aedee626f6dc7e9db262c29bfe39ba3c.exe
    "C:\Users\Admin\AppData\Local\Temp\be15093a407e5b70f5539df5eb1c18d0aedee626f6dc7e9db262c29bfe39ba3c.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1456
    • C:\Users\Admin\AppData\Local\Temp\be15093a407e5b70f5539df5eb1c18d0aedee626f6dc7e9db262c29bfe39ba3c.exe
      "C:\Users\Admin\AppData\Local\Temp\be15093a407e5b70f5539df5eb1c18d0aedee626f6dc7e9db262c29bfe39ba3c.exe"
      2⤵
        PID:3892
      • C:\Users\Admin\AppData\Local\Temp\be15093a407e5b70f5539df5eb1c18d0aedee626f6dc7e9db262c29bfe39ba3c.exe
        "C:\Users\Admin\AppData\Local\Temp\be15093a407e5b70f5539df5eb1c18d0aedee626f6dc7e9db262c29bfe39ba3c.exe"
        2⤵
          PID:3976
        • C:\Users\Admin\AppData\Local\Temp\be15093a407e5b70f5539df5eb1c18d0aedee626f6dc7e9db262c29bfe39ba3c.exe
          "C:\Users\Admin\AppData\Local\Temp\be15093a407e5b70f5539df5eb1c18d0aedee626f6dc7e9db262c29bfe39ba3c.exe"
          2⤵
          • UAC bypass
          • Windows security bypass
          • Windows security modification
          • Checks whether UAC is enabled
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:4956
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            C:\Users\Admin\AppData\Local\Temp\be15093a407e5b70f5539df5eb1c18d0aedee626f6dc7e9db262c29bfe39ba3c.exe
            3⤵
            • Adds policy Run key to start application
            • Adds Run key to start application
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:4944

      Network

      MITRE ATT&CK Matrix ATT&CK v13

      Initial Access

      Execution

      Persistence

      Boot or Logon Autostart Execution

      2
      T1547

      Registry Run Keys / Startup Folder

      2
      T1547.001

      Privilege Escalation

      Abuse Elevation Control Mechanism

      1
      T1548

      Bypass User Account Control

      1
      T1548.002

      Boot or Logon Autostart Execution

      2
      T1547

      Registry Run Keys / Startup Folder

      2
      T1547.001

      Defense Evasion

      Abuse Elevation Control Mechanism

      1
      T1548

      Bypass User Account Control

      1
      T1548.002

      Impair Defenses

      3
      T1562

      Disable or Modify Tools

      3
      T1562.001

      Modify Registry

      6
      T1112

      Credential Access

      Discovery

      System Information Discovery

      1
      T1082

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Resource Development

      Reconnaissance

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1456-8-0x00000000743E0000-0x0000000074B90000-memory.dmp
        Filesize

        7.7MB

        Download
      • memory/1456-4-0x0000000004FC0000-0x0000000004FD0000-memory.dmp
        Filesize

        64KB

        Download
      • memory/1456-0-0x00000000743E0000-0x0000000074B90000-memory.dmp
        Filesize

        7.7MB

        Download
      • memory/1456-3-0x0000000004DB0000-0x0000000004E42000-memory.dmp
        Filesize

        584KB

        Download
      • memory/1456-9-0x0000000004FC0000-0x0000000004FD0000-memory.dmp
        Filesize

        64KB

        Download
      • memory/1456-5-0x0000000004D90000-0x0000000004D9A000-memory.dmp
        Filesize

        40KB

        Download
      • memory/1456-6-0x0000000005070000-0x000000000510C000-memory.dmp
        Filesize

        624KB

        Download
      • memory/1456-10-0x00000000051A0000-0x00000000051AA000-memory.dmp
        Filesize

        40KB

        Download
      • memory/1456-2-0x0000000005430000-0x00000000059D4000-memory.dmp
        Filesize

        5.6MB

        Download
      • memory/1456-1-0x0000000000310000-0x00000000003AA000-memory.dmp
        Filesize

        616KB

        Download
      • memory/1456-7-0x0000000005130000-0x0000000005148000-memory.dmp
        Filesize

        96KB

        Download
      • memory/1456-11-0x000000000A030000-0x000000000A09C000-memory.dmp
        Filesize

        432KB

        Download
      • memory/1456-18-0x00000000743E0000-0x0000000074B90000-memory.dmp
        Filesize

        7.7MB

        Download
      • memory/4944-19-0x0000000000400000-0x0000000000443000-memory.dmp
        Filesize

        268KB

        Download
      • memory/4956-15-0x0000000000400000-0x000000000042C000-memory.dmp
        Filesize

        176KB

        Download
      • memory/4956-12-0x0000000000400000-0x000000000042C000-memory.dmp
        Filesize

        176KB

        Download
      • memory/4956-26-0x0000000000400000-0x000000000042C000-memory.dmp
        Filesize

        176KB

        Download