Analysis

  • max time kernel
    140s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-10-2023 09:45

General

  • Target

    c24566c0745944cbc188bca73f43e78f9824a22f05089665e6e09f01294f5c46.exe

  • Size

    510KB

  • MD5

    2cb0027810b1ef32a2756804027c3436

  • SHA1

    56f8636adbf50d1265319f08d6872daff2b75815

  • SHA256

    c24566c0745944cbc188bca73f43e78f9824a22f05089665e6e09f01294f5c46

  • SHA512

    6d805f59561eb3dd70f8c74d16439c767b58f67dffe0104decf662616c302de04e8795e67ba287b1837062a6ef6379961c915c0f29e70a8bb8bbdc85dd26a09d

  • SSDEEP

    12288:B35yabQ2GGAR0rdDfrb8RQMiPMO6Wq0s13O4BfhjAA3m8h:p5yR/GARuhfruQR7vsFOkjAAjh

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

STRIGIO

C2

sandshoe.myfirewall.org:5344

Mutex

I8N3F0X7-G4E2-P2S0-T0D7-R1N2H5T660I4

Signatures

  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 1 IoCs
  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

  • XpertRAT Core payload 1 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c24566c0745944cbc188bca73f43e78f9824a22f05089665e6e09f01294f5c46.exe
    "C:\Users\Admin\AppData\Local\Temp\c24566c0745944cbc188bca73f43e78f9824a22f05089665e6e09f01294f5c46.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4728
    • C:\Users\Admin\AppData\Local\Temp\c24566c0745944cbc188bca73f43e78f9824a22f05089665e6e09f01294f5c46.exe
      "C:\Users\Admin\AppData\Local\Temp\c24566c0745944cbc188bca73f43e78f9824a22f05089665e6e09f01294f5c46.exe"
      2⤵
      • UAC bypass
      • Windows security bypass
      • Windows security modification
      • Checks whether UAC is enabled
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2440
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        C:\Users\Admin\AppData\Local\Temp\c24566c0745944cbc188bca73f43e78f9824a22f05089665e6e09f01294f5c46.exe
        3⤵
        • Adds policy Run key to start application
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:748

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

3
T1562

Disable or Modify Tools

3
T1562.001

Modify Registry

6
T1112

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/748-20-0x0000000000400000-0x0000000000443000-memory.dmp
    Filesize

    268KB

  • memory/2440-13-0x0000000000400000-0x000000000042C000-memory.dmp
    Filesize

    176KB

  • memory/2440-27-0x0000000000400000-0x000000000042C000-memory.dmp
    Filesize

    176KB

  • memory/2440-16-0x0000000000400000-0x000000000042C000-memory.dmp
    Filesize

    176KB

  • memory/4728-8-0x0000000074700000-0x0000000074EB0000-memory.dmp
    Filesize

    7.7MB

  • memory/4728-11-0x00000000050E0000-0x00000000050EC000-memory.dmp
    Filesize

    48KB

  • memory/4728-6-0x0000000005030000-0x00000000050CC000-memory.dmp
    Filesize

    624KB

  • memory/4728-7-0x0000000004E50000-0x0000000004E62000-memory.dmp
    Filesize

    72KB

  • memory/4728-0-0x0000000074700000-0x0000000074EB0000-memory.dmp
    Filesize

    7.7MB

  • memory/4728-9-0x0000000005110000-0x0000000005120000-memory.dmp
    Filesize

    64KB

  • memory/4728-10-0x0000000005010000-0x0000000005018000-memory.dmp
    Filesize

    32KB

  • memory/4728-5-0x0000000004E40000-0x0000000004E4A000-memory.dmp
    Filesize

    40KB

  • memory/4728-12-0x0000000005D00000-0x0000000005D6A000-memory.dmp
    Filesize

    424KB

  • memory/4728-4-0x0000000005110000-0x0000000005120000-memory.dmp
    Filesize

    64KB

  • memory/4728-3-0x0000000004EB0000-0x0000000004F42000-memory.dmp
    Filesize

    584KB

  • memory/4728-19-0x0000000074700000-0x0000000074EB0000-memory.dmp
    Filesize

    7.7MB

  • memory/4728-2-0x00000000053C0000-0x0000000005964000-memory.dmp
    Filesize

    5.6MB

  • memory/4728-1-0x00000000003B0000-0x0000000000436000-memory.dmp
    Filesize

    536KB