General
- Target F8FNTFN2.exe
- Size 172KB
- Sample250831-vrqc2sgr2y
- SHA256 8e27b90bf415c228981ea334467a3940f2ed9869ec9419552a483b55a036751d
Score
10/10
Malware Config
Extracted
Family
-
xpertrat
Version
-
3.0.10
Botnet
-
Test
C2
-
172.20.10.7:3333
Mutex
-
N3S8L5V2-L0C7-N6Q5-Y5I3-W6M7F112Y5H0
Targets
-
- Target F8FNTFN2.exe
- Size 172KB
- SHA256 8e27b90bf415c228981ea334467a3940f2ed9869ec9419552a483b55a036751d
Score10/10-
UAC bypass
-
Windows security bypass
-
XpertRAT
XpertRAT is a remote access trojan with various capabilities.
-
XpertRAT Core payload
-
Xpertrat family
-
Adds policy Run key to start application
-
Executes dropped EXE
-
Windows security modification
-
Adds Run key to start application
-
Checks whether UAC is enabled
-
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
6