Analysis
-
max time kernel
62s -
max time network
160s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
30-06-2021 05:32
Static task
static1
Behavioral task
behavioral1
Sample
INQUIRY No. 063021 Materials for Al Wakra Pro.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
INQUIRY No. 063021 Materials for Al Wakra Pro.exe
Resource
win10v20210408
General
-
Target
INQUIRY No. 063021 Materials for Al Wakra Pro.exe
-
Size
1.3MB
-
MD5
a15915a25a5ec67af6e2e422acedaa68
-
SHA1
c48ccd1326ab3a1d15dec32b1617c2e65ee9d194
-
SHA256
d72da2af39e90713d465aff2de9c4991a2fe6125e06b67cd85cd67915a2c966e
-
SHA512
87bb58dfed4271fc985e2c4987478230b4ed588986749798ffe333ea885bca41f3aa8cf98a0b23bf6e53eaa7cce803e9b717ed5530c8dd5751ae0853005e3fdb
Malware Config
Extracted
xpertrat
3.0.10
OSCAR CLIENT
oski123.duckdns.org:1909
I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8
Signatures
-
XpertRAT Core Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3724-132-0x0000000000400000-0x0000000000443000-memory.dmp xpertrat behavioral2/memory/3724-133-0x0000000000401364-mapping.dmp xpertrat -
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/3840-146-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/3840-147-0x0000000000411654-mapping.dmp MailPassView -
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/1240-150-0x0000000000400000-0x0000000000459000-memory.dmp WebBrowserPassView behavioral2/memory/1240-151-0x0000000000442F04-mapping.dmp WebBrowserPassView -
Nirsoft 6 IoCs
Processes:
resource yara_rule behavioral2/memory/3840-146-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/3840-147-0x0000000000411654-mapping.dmp Nirsoft behavioral2/memory/1240-150-0x0000000000400000-0x0000000000459000-memory.dmp Nirsoft behavioral2/memory/1240-151-0x0000000000442F04-mapping.dmp Nirsoft behavioral2/memory/2416-159-0x0000000000400000-0x0000000000415000-memory.dmp Nirsoft behavioral2/memory/2416-160-0x000000000040C2A8-mapping.dmp Nirsoft -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8 = "C:\\Users\\Admin\\AppData\\Roaming\\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8\\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8.exe" iexplore.exe -
Processes:
resource yara_rule behavioral2/memory/3732-142-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/1520-155-0x0000000000400000-0x0000000000416000-memory.dmp upx -
Processes:
INQUIRY No. 063021 Materials for Al Wakra Pro.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" INQUIRY No. 063021 Materials for Al Wakra Pro.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8 = "C:\\Users\\Admin\\AppData\\Roaming\\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8\\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8 = "C:\\Users\\Admin\\AppData\\Roaming\\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8\\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8.exe" iexplore.exe -
Processes:
INQUIRY No. 063021 Materials for Al Wakra Pro.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" INQUIRY No. 063021 Materials for Al Wakra Pro.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3728 3636 WerFault.exe iexplore.exe -
Suspicious use of SetThreadContext 8 IoCs
Processes:
INQUIRY No. 063021 Materials for Al Wakra Pro.exeINQUIRY No. 063021 Materials for Al Wakra Pro.exeiexplore.exedescription pid process target process PID 3128 set thread context of 2352 3128 INQUIRY No. 063021 Materials for Al Wakra Pro.exe INQUIRY No. 063021 Materials for Al Wakra Pro.exe PID 2352 set thread context of 3724 2352 INQUIRY No. 063021 Materials for Al Wakra Pro.exe iexplore.exe PID 3724 set thread context of 3636 3724 iexplore.exe iexplore.exe PID 3724 set thread context of 3732 3724 iexplore.exe iexplore.exe PID 3724 set thread context of 3840 3724 iexplore.exe iexplore.exe PID 3724 set thread context of 1240 3724 iexplore.exe iexplore.exe PID 3724 set thread context of 1520 3724 iexplore.exe iexplore.exe PID 3724 set thread context of 2416 3724 iexplore.exe iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
INQUIRY No. 063021 Materials for Al Wakra Pro.exeiexplore.exeiexplore.exepid process 2352 INQUIRY No. 063021 Materials for Al Wakra Pro.exe 2352 INQUIRY No. 063021 Materials for Al Wakra Pro.exe 2352 INQUIRY No. 063021 Materials for Al Wakra Pro.exe 2352 INQUIRY No. 063021 Materials for Al Wakra Pro.exe 3732 iexplore.exe 3732 iexplore.exe 1240 iexplore.exe 1240 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
iexplore.exeiexplore.exedescription pid process Token: SeDebugPrivilege 3724 iexplore.exe Token: SeDebugPrivilege 3732 iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
INQUIRY No. 063021 Materials for Al Wakra Pro.exeiexplore.exepid process 2352 INQUIRY No. 063021 Materials for Al Wakra Pro.exe 3724 iexplore.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
INQUIRY No. 063021 Materials for Al Wakra Pro.exeINQUIRY No. 063021 Materials for Al Wakra Pro.exeiexplore.exedescription pid process target process PID 3128 wrote to memory of 2352 3128 INQUIRY No. 063021 Materials for Al Wakra Pro.exe INQUIRY No. 063021 Materials for Al Wakra Pro.exe PID 3128 wrote to memory of 2352 3128 INQUIRY No. 063021 Materials for Al Wakra Pro.exe INQUIRY No. 063021 Materials for Al Wakra Pro.exe PID 3128 wrote to memory of 2352 3128 INQUIRY No. 063021 Materials for Al Wakra Pro.exe INQUIRY No. 063021 Materials for Al Wakra Pro.exe PID 3128 wrote to memory of 2352 3128 INQUIRY No. 063021 Materials for Al Wakra Pro.exe INQUIRY No. 063021 Materials for Al Wakra Pro.exe PID 3128 wrote to memory of 2352 3128 INQUIRY No. 063021 Materials for Al Wakra Pro.exe INQUIRY No. 063021 Materials for Al Wakra Pro.exe PID 3128 wrote to memory of 2352 3128 INQUIRY No. 063021 Materials for Al Wakra Pro.exe INQUIRY No. 063021 Materials for Al Wakra Pro.exe PID 3128 wrote to memory of 2352 3128 INQUIRY No. 063021 Materials for Al Wakra Pro.exe INQUIRY No. 063021 Materials for Al Wakra Pro.exe PID 2352 wrote to memory of 3724 2352 INQUIRY No. 063021 Materials for Al Wakra Pro.exe iexplore.exe PID 2352 wrote to memory of 3724 2352 INQUIRY No. 063021 Materials for Al Wakra Pro.exe iexplore.exe PID 2352 wrote to memory of 3724 2352 INQUIRY No. 063021 Materials for Al Wakra Pro.exe iexplore.exe PID 2352 wrote to memory of 3724 2352 INQUIRY No. 063021 Materials for Al Wakra Pro.exe iexplore.exe PID 2352 wrote to memory of 3724 2352 INQUIRY No. 063021 Materials for Al Wakra Pro.exe iexplore.exe PID 2352 wrote to memory of 3724 2352 INQUIRY No. 063021 Materials for Al Wakra Pro.exe iexplore.exe PID 2352 wrote to memory of 3724 2352 INQUIRY No. 063021 Materials for Al Wakra Pro.exe iexplore.exe PID 2352 wrote to memory of 3724 2352 INQUIRY No. 063021 Materials for Al Wakra Pro.exe iexplore.exe PID 3724 wrote to memory of 3636 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 3636 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 3636 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 3636 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 3636 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 3636 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 3636 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 3636 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 3732 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 3732 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 3732 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 3732 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 3732 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 3732 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 3732 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 3732 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 3840 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 3840 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 3840 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 3840 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 3840 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 3840 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 3840 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 3840 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 3840 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 1240 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 1240 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 1240 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 1240 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 1240 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 1240 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 1240 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 1240 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 1240 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 1520 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 1520 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 1520 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 1520 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 1520 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 1520 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 1520 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 1520 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 2416 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 2416 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 2416 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 2416 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 2416 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 2416 3724 iexplore.exe iexplore.exe PID 3724 wrote to memory of 2416 3724 iexplore.exe iexplore.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
INQUIRY No. 063021 Materials for Al Wakra Pro.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" INQUIRY No. 063021 Materials for Al Wakra Pro.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\INQUIRY No. 063021 Materials for Al Wakra Pro.exe"C:\Users\Admin\AppData\Local\Temp\INQUIRY No. 063021 Materials for Al Wakra Pro.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\INQUIRY No. 063021 Materials for Al Wakra Pro.exe"C:\Users\Admin\AppData\Local\Temp\INQUIRY No. 063021 Materials for Al Wakra Pro.exe"2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\INQUIRY No. 063021 Materials for Al Wakra Pro.exe3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8\vdrdjxxni0.txt"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 925⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8\vdrdjxxni0.txt"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8\vdrdjxxni1.txt"4⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8\vdrdjxxni2.txt"4⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8\vdrdjxxni3.txt"4⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8\vdrdjxxni4.txt"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8\vdrdjxxni2.txtMD5
f94dc819ca773f1e3cb27abbc9e7fa27
SHA19a7700efadc5ea09ab288544ef1e3cd876255086
SHA256a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA51272a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196
-
C:\Users\Admin\AppData\Roaming\I3N7G4R2-G886-I6M4-U4E2-R5H6B0U1T5C8\vdrdjxxni4.txtMD5
f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
memory/1240-151-0x0000000000442F04-mapping.dmp
-
memory/1240-150-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/1520-156-0x0000000000413750-mapping.dmp
-
memory/1520-155-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2352-127-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2352-129-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2352-128-0x00000000004010B8-mapping.dmp
-
memory/2416-160-0x000000000040C2A8-mapping.dmp
-
memory/2416-159-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/3128-123-0x0000000005680000-0x0000000005681000-memory.dmpFilesize
4KB
-
memory/3128-114-0x0000000000120000-0x0000000000121000-memory.dmpFilesize
4KB
-
memory/3128-125-0x000000000B930000-0x000000000B9AB000-memory.dmpFilesize
492KB
-
memory/3128-124-0x0000000009730000-0x000000000B72F000-memory.dmpFilesize
32.0MB
-
memory/3128-116-0x0000000004A70000-0x0000000004A71000-memory.dmpFilesize
4KB
-
memory/3128-117-0x0000000005090000-0x0000000005091000-memory.dmpFilesize
4KB
-
memory/3128-126-0x000000000B9B0000-0x000000000B9F0000-memory.dmpFilesize
256KB
-
memory/3128-118-0x0000000004C30000-0x0000000004C31000-memory.dmpFilesize
4KB
-
memory/3128-119-0x0000000004B90000-0x000000000508E000-memory.dmpFilesize
5.0MB
-
memory/3128-120-0x0000000004B10000-0x0000000004B11000-memory.dmpFilesize
4KB
-
memory/3128-121-0x0000000004DF0000-0x0000000004DF1000-memory.dmpFilesize
4KB
-
memory/3128-122-0x0000000004F00000-0x0000000004F01000-memory.dmpFilesize
4KB
-
memory/3636-141-0x0000000000423BC0-mapping.dmp
-
memory/3724-136-0x00000000036F0000-0x0000000003843000-memory.dmpFilesize
1.3MB
-
memory/3724-137-0x00000000036F1000-0x00000000037ED000-memory.dmpFilesize
1008KB
-
memory/3724-133-0x0000000000401364-mapping.dmp
-
memory/3724-132-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/3732-143-0x0000000000423BC0-mapping.dmp
-
memory/3732-142-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/3840-147-0x0000000000411654-mapping.dmp
-
memory/3840-146-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB