Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
12-07-2021 08:58
Static task
static1
Behavioral task
behavioral1
Sample
810436f7d29ced22beac8734da3acacf.exe
Resource
win7v20210410
0 signatures
0 seconds
General
-
Target
810436f7d29ced22beac8734da3acacf.exe
-
Size
772KB
-
MD5
810436f7d29ced22beac8734da3acacf
-
SHA1
d057887e566aa744eb8c82fc5ac05132ece9e218
-
SHA256
86214e9a4b21afd0a46c93ee39eb99b188e43cc773a15f632fe8bea3169ee0a5
-
SHA512
d1f97c990abe6eb28289d36d3c20a21e078bd5561d4765ca202be24a570a742cc37cd063195581e7b6ebd02705f453ee532b59239a6c06195856727339d3fbb7
Malware Config
Extracted
Family
xpertrat
Version
3.1.9
Botnet
BXK
C2
ioxg.ix.tc:4000
Mutex
R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6
Signatures
-
XpertRAT Core Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1008-71-0x0000000000400000-0x0000000000444000-memory.dmp xpertrat behavioral1/memory/1008-72-0x0000000000401364-mapping.dmp xpertrat -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6 = "C:\\Users\\Admin\\AppData\\Roaming\\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6\\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6.exe" iexplore.exe -
Processes:
810436f7d29ced22beac8734da3acacf.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" 810436f7d29ced22beac8734da3acacf.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6 = "C:\\Users\\Admin\\AppData\\Roaming\\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6\\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6 = "C:\\Users\\Admin\\AppData\\Roaming\\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6\\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6.exe" iexplore.exe -
Processes:
810436f7d29ced22beac8734da3acacf.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 810436f7d29ced22beac8734da3acacf.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
810436f7d29ced22beac8734da3acacf.exe810436f7d29ced22beac8734da3acacf.exedescription pid process target process PID 1420 set thread context of 1688 1420 810436f7d29ced22beac8734da3acacf.exe 810436f7d29ced22beac8734da3acacf.exe PID 1688 set thread context of 1008 1688 810436f7d29ced22beac8734da3acacf.exe iexplore.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
810436f7d29ced22beac8734da3acacf.exe810436f7d29ced22beac8734da3acacf.exepid process 1420 810436f7d29ced22beac8734da3acacf.exe 1420 810436f7d29ced22beac8734da3acacf.exe 1688 810436f7d29ced22beac8734da3acacf.exe 1688 810436f7d29ced22beac8734da3acacf.exe 1688 810436f7d29ced22beac8734da3acacf.exe 1688 810436f7d29ced22beac8734da3acacf.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
810436f7d29ced22beac8734da3acacf.exeiexplore.exedescription pid process Token: SeDebugPrivilege 1420 810436f7d29ced22beac8734da3acacf.exe Token: SeDebugPrivilege 1008 iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
810436f7d29ced22beac8734da3acacf.exeiexplore.exepid process 1688 810436f7d29ced22beac8734da3acacf.exe 1008 iexplore.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
810436f7d29ced22beac8734da3acacf.exe810436f7d29ced22beac8734da3acacf.exedescription pid process target process PID 1420 wrote to memory of 304 1420 810436f7d29ced22beac8734da3acacf.exe 810436f7d29ced22beac8734da3acacf.exe PID 1420 wrote to memory of 304 1420 810436f7d29ced22beac8734da3acacf.exe 810436f7d29ced22beac8734da3acacf.exe PID 1420 wrote to memory of 304 1420 810436f7d29ced22beac8734da3acacf.exe 810436f7d29ced22beac8734da3acacf.exe PID 1420 wrote to memory of 304 1420 810436f7d29ced22beac8734da3acacf.exe 810436f7d29ced22beac8734da3acacf.exe PID 1420 wrote to memory of 1688 1420 810436f7d29ced22beac8734da3acacf.exe 810436f7d29ced22beac8734da3acacf.exe PID 1420 wrote to memory of 1688 1420 810436f7d29ced22beac8734da3acacf.exe 810436f7d29ced22beac8734da3acacf.exe PID 1420 wrote to memory of 1688 1420 810436f7d29ced22beac8734da3acacf.exe 810436f7d29ced22beac8734da3acacf.exe PID 1420 wrote to memory of 1688 1420 810436f7d29ced22beac8734da3acacf.exe 810436f7d29ced22beac8734da3acacf.exe PID 1420 wrote to memory of 1688 1420 810436f7d29ced22beac8734da3acacf.exe 810436f7d29ced22beac8734da3acacf.exe PID 1420 wrote to memory of 1688 1420 810436f7d29ced22beac8734da3acacf.exe 810436f7d29ced22beac8734da3acacf.exe PID 1420 wrote to memory of 1688 1420 810436f7d29ced22beac8734da3acacf.exe 810436f7d29ced22beac8734da3acacf.exe PID 1420 wrote to memory of 1688 1420 810436f7d29ced22beac8734da3acacf.exe 810436f7d29ced22beac8734da3acacf.exe PID 1688 wrote to memory of 1008 1688 810436f7d29ced22beac8734da3acacf.exe iexplore.exe PID 1688 wrote to memory of 1008 1688 810436f7d29ced22beac8734da3acacf.exe iexplore.exe PID 1688 wrote to memory of 1008 1688 810436f7d29ced22beac8734da3acacf.exe iexplore.exe PID 1688 wrote to memory of 1008 1688 810436f7d29ced22beac8734da3acacf.exe iexplore.exe PID 1688 wrote to memory of 1008 1688 810436f7d29ced22beac8734da3acacf.exe iexplore.exe PID 1688 wrote to memory of 1008 1688 810436f7d29ced22beac8734da3acacf.exe iexplore.exe PID 1688 wrote to memory of 1008 1688 810436f7d29ced22beac8734da3acacf.exe iexplore.exe PID 1688 wrote to memory of 1008 1688 810436f7d29ced22beac8734da3acacf.exe iexplore.exe PID 1688 wrote to memory of 1008 1688 810436f7d29ced22beac8734da3acacf.exe iexplore.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
810436f7d29ced22beac8734da3acacf.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 810436f7d29ced22beac8734da3acacf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\810436f7d29ced22beac8734da3acacf.exe"C:\Users\Admin\AppData\Local\Temp\810436f7d29ced22beac8734da3acacf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\810436f7d29ced22beac8734da3acacf.exe"{path}"2⤵PID:304
-
C:\Users\Admin\AppData\Local\Temp\810436f7d29ced22beac8734da3acacf.exe"{path}"2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1688 -
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\810436f7d29ced22beac8734da3acacf.exe3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1008