General
- Target F8FNTFN2.exe
- Size 172KB
- Sample250831-vrqc2sgr2y
- SHA256 8e27b90bf415c228981ea334467a3940f2ed9869ec9419552a483b55a036751d
Score
10/10
Malware Config
Extracted
Family
-
xpertrat
Version
-
3.0.10
Botnet
-
Test
C2
-
172.20.10.7:3333
Mutex
-
N3S8L5V2-L0C7-N6Q5-Y5I3-W6M7F112Y5H0
Targets
-
- Target F8FNTFN2.exe
- Size 172KB
- SHA256 8e27b90bf415c228981ea334467a3940f2ed9869ec9419552a483b55a036751d
Score10/10UAC bypass
Windows security bypass
XpertRAT
XpertRAT is a remote access trojan with various capabilities.
XpertRAT Core payload
Xpertrat family
Adds policy Run key to start application
Executes dropped EXE
Windows security modification
Adds Run key to start application
Checks whether UAC is enabled
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
6