Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
12-07-2021 08:58
Static task
static1
Behavioral task
behavioral1
Sample
810436f7d29ced22beac8734da3acacf.exe
Resource
win7v20210410
0 signatures
0 seconds
General
-
Target
810436f7d29ced22beac8734da3acacf.exe
-
Size
772KB
-
MD5
810436f7d29ced22beac8734da3acacf
-
SHA1
d057887e566aa744eb8c82fc5ac05132ece9e218
-
SHA256
86214e9a4b21afd0a46c93ee39eb99b188e43cc773a15f632fe8bea3169ee0a5
-
SHA512
d1f97c990abe6eb28289d36d3c20a21e078bd5561d4765ca202be24a570a742cc37cd063195581e7b6ebd02705f453ee532b59239a6c06195856727339d3fbb7
Malware Config
Extracted
Family
xpertrat
Version
3.1.9
Botnet
BXK
C2
ioxg.ix.tc:4000
Mutex
R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6
Signatures
-
XpertRAT Core Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3148-128-0x0000000000400000-0x0000000000444000-memory.dmp xpertrat behavioral2/memory/3148-129-0x0000000000401364-mapping.dmp xpertrat -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6 = "C:\\Users\\Admin\\AppData\\Roaming\\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6\\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6.exe" iexplore.exe -
Processes:
810436f7d29ced22beac8734da3acacf.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" 810436f7d29ced22beac8734da3acacf.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6 = "C:\\Users\\Admin\\AppData\\Roaming\\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6\\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6 = "C:\\Users\\Admin\\AppData\\Roaming\\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6\\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6.exe" iexplore.exe -
Processes:
810436f7d29ced22beac8734da3acacf.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 810436f7d29ced22beac8734da3acacf.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
810436f7d29ced22beac8734da3acacf.exe810436f7d29ced22beac8734da3acacf.exedescription pid process target process PID 772 set thread context of 4004 772 810436f7d29ced22beac8734da3acacf.exe 810436f7d29ced22beac8734da3acacf.exe PID 4004 set thread context of 3148 4004 810436f7d29ced22beac8734da3acacf.exe iexplore.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
810436f7d29ced22beac8734da3acacf.exepid process 4004 810436f7d29ced22beac8734da3acacf.exe 4004 810436f7d29ced22beac8734da3acacf.exe 4004 810436f7d29ced22beac8734da3acacf.exe 4004 810436f7d29ced22beac8734da3acacf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
iexplore.exedescription pid process Token: SeDebugPrivilege 3148 iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
810436f7d29ced22beac8734da3acacf.exeiexplore.exepid process 4004 810436f7d29ced22beac8734da3acacf.exe 3148 iexplore.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
810436f7d29ced22beac8734da3acacf.exe810436f7d29ced22beac8734da3acacf.exedescription pid process target process PID 772 wrote to memory of 4004 772 810436f7d29ced22beac8734da3acacf.exe 810436f7d29ced22beac8734da3acacf.exe PID 772 wrote to memory of 4004 772 810436f7d29ced22beac8734da3acacf.exe 810436f7d29ced22beac8734da3acacf.exe PID 772 wrote to memory of 4004 772 810436f7d29ced22beac8734da3acacf.exe 810436f7d29ced22beac8734da3acacf.exe PID 772 wrote to memory of 4004 772 810436f7d29ced22beac8734da3acacf.exe 810436f7d29ced22beac8734da3acacf.exe PID 772 wrote to memory of 4004 772 810436f7d29ced22beac8734da3acacf.exe 810436f7d29ced22beac8734da3acacf.exe PID 772 wrote to memory of 4004 772 810436f7d29ced22beac8734da3acacf.exe 810436f7d29ced22beac8734da3acacf.exe PID 772 wrote to memory of 4004 772 810436f7d29ced22beac8734da3acacf.exe 810436f7d29ced22beac8734da3acacf.exe PID 4004 wrote to memory of 3148 4004 810436f7d29ced22beac8734da3acacf.exe iexplore.exe PID 4004 wrote to memory of 3148 4004 810436f7d29ced22beac8734da3acacf.exe iexplore.exe PID 4004 wrote to memory of 3148 4004 810436f7d29ced22beac8734da3acacf.exe iexplore.exe PID 4004 wrote to memory of 3148 4004 810436f7d29ced22beac8734da3acacf.exe iexplore.exe PID 4004 wrote to memory of 3148 4004 810436f7d29ced22beac8734da3acacf.exe iexplore.exe PID 4004 wrote to memory of 3148 4004 810436f7d29ced22beac8734da3acacf.exe iexplore.exe PID 4004 wrote to memory of 3148 4004 810436f7d29ced22beac8734da3acacf.exe iexplore.exe PID 4004 wrote to memory of 3148 4004 810436f7d29ced22beac8734da3acacf.exe iexplore.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
810436f7d29ced22beac8734da3acacf.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 810436f7d29ced22beac8734da3acacf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\810436f7d29ced22beac8734da3acacf.exe"C:\Users\Admin\AppData\Local\Temp\810436f7d29ced22beac8734da3acacf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\810436f7d29ced22beac8734da3acacf.exe"{path}"2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4004 -
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\810436f7d29ced22beac8734da3acacf.exe3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3148