Analysis
-
max time kernel
60s -
max time network
157s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
30-06-2021 05:32
Static task
static1
Behavioral task
behavioral1
Sample
INQUIRY No. 063021 Materials for Al Wakra Pro.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
INQUIRY No. 063021 Materials for Al Wakra Pro.exe
Resource
win10v20210408
General
-
Target
INQUIRY No. 063021 Materials for Al Wakra Pro.exe
-
Size
1.3MB
-
MD5
a15915a25a5ec67af6e2e422acedaa68
-
SHA1
c48ccd1326ab3a1d15dec32b1617c2e65ee9d194
-
SHA256
d72da2af39e90713d465aff2de9c4991a2fe6125e06b67cd85cd67915a2c966e
-
SHA512
87bb58dfed4271fc985e2c4987478230b4ed588986749798ffe333ea885bca41f3aa8cf98a0b23bf6e53eaa7cce803e9b717ed5530c8dd5751ae0853005e3fdb
Malware Config
Extracted
xpertrat
3.0.10
OSCAR CLIENT
oski123.duckdns.org:1909
I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8
Signatures
-
XpertRAT Core Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/856-69-0x0000000000400000-0x0000000000443000-memory.dmp xpertrat behavioral1/memory/856-70-0x0000000000401364-mapping.dmp xpertrat -
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/860-79-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/860-80-0x0000000000411654-mapping.dmp MailPassView -
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/924-82-0x0000000000400000-0x0000000000459000-memory.dmp WebBrowserPassView behavioral1/memory/924-83-0x0000000000442F04-mapping.dmp WebBrowserPassView -
Nirsoft 7 IoCs
Processes:
resource yara_rule behavioral1/memory/1824-77-0x0000000000423BC0-mapping.dmp Nirsoft behavioral1/memory/860-79-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/860-80-0x0000000000411654-mapping.dmp Nirsoft behavioral1/memory/924-82-0x0000000000400000-0x0000000000459000-memory.dmp Nirsoft behavioral1/memory/924-83-0x0000000000442F04-mapping.dmp Nirsoft behavioral1/memory/1700-101-0x0000000000400000-0x0000000000415000-memory.dmp Nirsoft behavioral1/memory/1700-102-0x000000000040C2A8-mapping.dmp Nirsoft -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8 = "C:\\Users\\Admin\\AppData\\Roaming\\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8\\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8.exe" iexplore.exe -
Processes:
resource yara_rule behavioral1/memory/1824-76-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/748-92-0x0000000000400000-0x0000000000416000-memory.dmp upx -
Processes:
INQUIRY No. 063021 Materials for Al Wakra Pro.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" INQUIRY No. 063021 Materials for Al Wakra Pro.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8 = "C:\\Users\\Admin\\AppData\\Roaming\\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8\\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8 = "C:\\Users\\Admin\\AppData\\Roaming\\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8\\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8.exe" iexplore.exe -
Processes:
INQUIRY No. 063021 Materials for Al Wakra Pro.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" INQUIRY No. 063021 Materials for Al Wakra Pro.exe -
Suspicious use of SetThreadContext 13 IoCs
Processes:
INQUIRY No. 063021 Materials for Al Wakra Pro.exeINQUIRY No. 063021 Materials for Al Wakra Pro.exeiexplore.exedescription pid process target process PID 1852 set thread context of 520 1852 INQUIRY No. 063021 Materials for Al Wakra Pro.exe INQUIRY No. 063021 Materials for Al Wakra Pro.exe PID 520 set thread context of 856 520 INQUIRY No. 063021 Materials for Al Wakra Pro.exe iexplore.exe PID 856 set thread context of 1824 856 iexplore.exe iexplore.exe PID 856 set thread context of 860 856 iexplore.exe iexplore.exe PID 856 set thread context of 924 856 iexplore.exe iexplore.exe PID 856 set thread context of 1320 856 iexplore.exe iexplore.exe PID 856 set thread context of 1828 856 iexplore.exe iexplore.exe PID 856 set thread context of 1668 856 iexplore.exe iexplore.exe PID 856 set thread context of 748 856 iexplore.exe iexplore.exe PID 856 set thread context of 364 856 iexplore.exe iexplore.exe PID 856 set thread context of 1256 856 iexplore.exe iexplore.exe PID 856 set thread context of 1600 856 iexplore.exe iexplore.exe PID 856 set thread context of 1700 856 iexplore.exe iexplore.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
INQUIRY No. 063021 Materials for Al Wakra Pro.exepid process 520 INQUIRY No. 063021 Materials for Al Wakra Pro.exe 520 INQUIRY No. 063021 Materials for Al Wakra Pro.exe 520 INQUIRY No. 063021 Materials for Al Wakra Pro.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
iexplore.exeiexplore.exedescription pid process Token: SeDebugPrivilege 856 iexplore.exe Token: SeDebugPrivilege 1824 iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
INQUIRY No. 063021 Materials for Al Wakra Pro.exeiexplore.exepid process 520 INQUIRY No. 063021 Materials for Al Wakra Pro.exe 856 iexplore.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
INQUIRY No. 063021 Materials for Al Wakra Pro.exeINQUIRY No. 063021 Materials for Al Wakra Pro.exeiexplore.exedescription pid process target process PID 1852 wrote to memory of 520 1852 INQUIRY No. 063021 Materials for Al Wakra Pro.exe INQUIRY No. 063021 Materials for Al Wakra Pro.exe PID 1852 wrote to memory of 520 1852 INQUIRY No. 063021 Materials for Al Wakra Pro.exe INQUIRY No. 063021 Materials for Al Wakra Pro.exe PID 1852 wrote to memory of 520 1852 INQUIRY No. 063021 Materials for Al Wakra Pro.exe INQUIRY No. 063021 Materials for Al Wakra Pro.exe PID 1852 wrote to memory of 520 1852 INQUIRY No. 063021 Materials for Al Wakra Pro.exe INQUIRY No. 063021 Materials for Al Wakra Pro.exe PID 1852 wrote to memory of 520 1852 INQUIRY No. 063021 Materials for Al Wakra Pro.exe INQUIRY No. 063021 Materials for Al Wakra Pro.exe PID 1852 wrote to memory of 520 1852 INQUIRY No. 063021 Materials for Al Wakra Pro.exe INQUIRY No. 063021 Materials for Al Wakra Pro.exe PID 1852 wrote to memory of 520 1852 INQUIRY No. 063021 Materials for Al Wakra Pro.exe INQUIRY No. 063021 Materials for Al Wakra Pro.exe PID 1852 wrote to memory of 520 1852 INQUIRY No. 063021 Materials for Al Wakra Pro.exe INQUIRY No. 063021 Materials for Al Wakra Pro.exe PID 520 wrote to memory of 856 520 INQUIRY No. 063021 Materials for Al Wakra Pro.exe iexplore.exe PID 520 wrote to memory of 856 520 INQUIRY No. 063021 Materials for Al Wakra Pro.exe iexplore.exe PID 520 wrote to memory of 856 520 INQUIRY No. 063021 Materials for Al Wakra Pro.exe iexplore.exe PID 520 wrote to memory of 856 520 INQUIRY No. 063021 Materials for Al Wakra Pro.exe iexplore.exe PID 520 wrote to memory of 856 520 INQUIRY No. 063021 Materials for Al Wakra Pro.exe iexplore.exe PID 520 wrote to memory of 856 520 INQUIRY No. 063021 Materials for Al Wakra Pro.exe iexplore.exe PID 520 wrote to memory of 856 520 INQUIRY No. 063021 Materials for Al Wakra Pro.exe iexplore.exe PID 520 wrote to memory of 856 520 INQUIRY No. 063021 Materials for Al Wakra Pro.exe iexplore.exe PID 520 wrote to memory of 856 520 INQUIRY No. 063021 Materials for Al Wakra Pro.exe iexplore.exe PID 856 wrote to memory of 1824 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 1824 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 1824 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 1824 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 1824 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 1824 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 1824 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 1824 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 1824 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 860 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 860 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 860 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 860 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 860 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 860 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 860 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 860 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 860 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 860 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 924 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 924 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 924 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 924 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 924 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 924 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 924 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 924 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 924 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 924 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 1320 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 1320 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 1320 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 1320 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 1320 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 1320 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 1320 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 1320 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 1320 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 1828 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 1828 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 1828 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 1828 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 1828 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 1828 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 1828 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 1828 856 iexplore.exe iexplore.exe PID 856 wrote to memory of 1828 856 iexplore.exe iexplore.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
INQUIRY No. 063021 Materials for Al Wakra Pro.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" INQUIRY No. 063021 Materials for Al Wakra Pro.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\INQUIRY No. 063021 Materials for Al Wakra Pro.exe"C:\Users\Admin\AppData\Local\Temp\INQUIRY No. 063021 Materials for Al Wakra Pro.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\INQUIRY No. 063021 Materials for Al Wakra Pro.exe"C:\Users\Admin\AppData\Local\Temp\INQUIRY No. 063021 Materials for Al Wakra Pro.exe"2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\INQUIRY No. 063021 Materials for Al Wakra Pro.exe3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8\xuladdnpi0.txt"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8\xuladdnpi1.txt"4⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8\xuladdnpi2.txt"4⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8\xuladdnpi3.txt"4⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8\xuladdnpi3.txt"4⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8\xuladdnpi3.txt"4⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8\xuladdnpi3.txt"4⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8\xuladdnpi4.txt"4⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8\xuladdnpi4.txt"4⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8\xuladdnpi4.txt"4⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8\xuladdnpi4.txt"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8\xuladdnpi2.txtMD5
f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8\xuladdnpi4.txtMD5
f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
memory/364-96-0x000000000040C2A8-mapping.dmp
-
memory/520-66-0x00000000004010B8-mapping.dmp
-
memory/520-65-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/748-93-0x0000000000413750-mapping.dmp
-
memory/748-92-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/856-69-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/856-71-0x00000000006D0000-0x0000000000823000-memory.dmpFilesize
1.3MB
-
memory/856-75-0x0000000074F31000-0x0000000074F33000-memory.dmpFilesize
8KB
-
memory/856-70-0x0000000000401364-mapping.dmp
-
memory/860-79-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/860-80-0x0000000000411654-mapping.dmp
-
memory/924-83-0x0000000000442F04-mapping.dmp
-
memory/924-82-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/1256-98-0x000000000040C2A8-mapping.dmp
-
memory/1320-87-0x0000000000413750-mapping.dmp
-
memory/1600-100-0x000000000040C2A8-mapping.dmp
-
memory/1668-91-0x0000000000413750-mapping.dmp
-
memory/1700-101-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/1700-102-0x000000000040C2A8-mapping.dmp
-
memory/1824-76-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1824-77-0x0000000000423BC0-mapping.dmp
-
memory/1828-89-0x0000000000413750-mapping.dmp
-
memory/1852-59-0x0000000000C60000-0x0000000000C61000-memory.dmpFilesize
4KB
-
memory/1852-64-0x0000000000C10000-0x0000000000C50000-memory.dmpFilesize
256KB
-
memory/1852-63-0x0000000005480000-0x00000000054FB000-memory.dmpFilesize
492KB
-
memory/1852-62-0x0000000009FA0000-0x000000000BF9F000-memory.dmpFilesize
32.0MB
-
memory/1852-61-0x0000000004930000-0x0000000004931000-memory.dmpFilesize
4KB