Analysis

  • max time kernel
    12s
  • max time network
    184s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    13-07-2021 08:54

General

  • Target

    ee759b97c88356e23b04afa427c6cb94.exe

  • Size

    172KB

  • MD5

    ee759b97c88356e23b04afa427c6cb94

  • SHA1

    439eba6c162e5512533ada4576de9f0e32def9d7

  • SHA256

    5c1fec4300276bd8bd042cf24f256de87350ad32a456578da4eb364de9f3fbfc

  • SHA512

    0447961f3ecfdfb5369cdd6f7bbc8d3455dcc8eaece606c85b9774f9c7981f26fea32133ea1c5214bbf73caea8c936257a1b349d2e7cee171f508ad1d4f050a0

Malware Config

Extracted

Family

xpertrat

Version

3.1.9

Botnet

BXK

C2

ioxg.ix.tc:4000

Mutex

R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6

Signatures

  • UAC bypass 3 TTPs
  • Windows security bypass 2 TTPs
  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

  • XpertRAT Core Payload 2 IoCs
  • NirSoft MailPassView 2 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 2 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 6 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ee759b97c88356e23b04afa427c6cb94.exe
    "C:\Users\Admin\AppData\Local\Temp\ee759b97c88356e23b04afa427c6cb94.exe"
    1⤵
    • Windows security modification
    • Checks whether UAC is enabled
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1644
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      C:\Users\Admin\AppData\Local\Temp\ee759b97c88356e23b04afa427c6cb94.exe
      2⤵
      • Adds policy Run key to start application
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1248
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        /stext "C:\Users\Admin\AppData\Roaming\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6\vkbnpyjdl0.txt"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1608
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        /stext "C:\Users\Admin\AppData\Roaming\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6\vkbnpyjdl1.txt"
        3⤵
          PID:1684
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          /stext "C:\Users\Admin\AppData\Roaming\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6\vkbnpyjdl2.txt"
          3⤵
            PID:764
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            /stext "C:\Users\Admin\AppData\Roaming\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6\vkbnpyjdl3.txt"
            3⤵
              PID:1736
            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
              /stext "C:\Users\Admin\AppData\Roaming\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6\vkbnpyjdl4.txt"
              3⤵
                PID:1544

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6\vkbnpyjdl2.txt

            MD5

            f3b25701fe362ec84616a93a45ce9998

            SHA1

            d62636d8caec13f04e28442a0a6fa1afeb024bbb

            SHA256

            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

            SHA512

            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

          • C:\Users\Admin\AppData\Roaming\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6\vkbnpyjdl4.txt

            MD5

            f3b25701fe362ec84616a93a45ce9998

            SHA1

            d62636d8caec13f04e28442a0a6fa1afeb024bbb

            SHA256

            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

            SHA512

            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

          • memory/764-75-0x0000000000442F04-mapping.dmp

          • memory/764-74-0x0000000000400000-0x0000000000459000-memory.dmp

            Filesize

            356KB

          • memory/1248-62-0x0000000000400000-0x0000000000444000-memory.dmp

            Filesize

            272KB

          • memory/1248-63-0x0000000000401364-mapping.dmp

          • memory/1248-64-0x0000000000730000-0x0000000000883000-memory.dmp

            Filesize

            1.3MB

          • memory/1544-82-0x000000000040C2A8-mapping.dmp

          • memory/1544-81-0x0000000000400000-0x0000000000415000-memory.dmp

            Filesize

            84KB

          • memory/1608-68-0x0000000000400000-0x0000000000426000-memory.dmp

            Filesize

            152KB

          • memory/1608-69-0x0000000000423BC0-mapping.dmp

          • memory/1644-59-0x00000000766D1000-0x00000000766D3000-memory.dmp

            Filesize

            8KB

          • memory/1684-72-0x0000000000411654-mapping.dmp

          • memory/1684-71-0x0000000000400000-0x000000000041B000-memory.dmp

            Filesize

            108KB

          • memory/1736-78-0x0000000000400000-0x0000000000416000-memory.dmp

            Filesize

            88KB

          • memory/1736-79-0x0000000000413750-mapping.dmp