Analysis
-
max time kernel
19s -
max time network
124s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
13-07-2021 08:54
Static task
static1
Behavioral task
behavioral1
Sample
ee759b97c88356e23b04afa427c6cb94.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
ee759b97c88356e23b04afa427c6cb94.exe
-
Size
172KB
-
MD5
ee759b97c88356e23b04afa427c6cb94
-
SHA1
439eba6c162e5512533ada4576de9f0e32def9d7
-
SHA256
5c1fec4300276bd8bd042cf24f256de87350ad32a456578da4eb364de9f3fbfc
-
SHA512
0447961f3ecfdfb5369cdd6f7bbc8d3455dcc8eaece606c85b9774f9c7981f26fea32133ea1c5214bbf73caea8c936257a1b349d2e7cee171f508ad1d4f050a0
Malware Config
Extracted
Family
xpertrat
Version
3.1.9
Botnet
BXK
C2
ioxg.ix.tc:4000
Mutex
R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6
Signatures
-
XpertRAT Core Payload 2 IoCs
resource yara_rule behavioral2/memory/3676-118-0x0000000000400000-0x0000000000444000-memory.dmp xpertrat behavioral2/memory/3676-119-0x0000000000401364-mapping.dmp xpertrat -
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/3940-133-0x0000000000411654-mapping.dmp MailPassView behavioral2/memory/3940-132-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/memory/1832-136-0x0000000000400000-0x0000000000459000-memory.dmp WebBrowserPassView behavioral2/memory/1832-137-0x0000000000442F04-mapping.dmp WebBrowserPassView -
Nirsoft 6 IoCs
resource yara_rule behavioral2/memory/3940-133-0x0000000000411654-mapping.dmp Nirsoft behavioral2/memory/3940-132-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/1832-136-0x0000000000400000-0x0000000000459000-memory.dmp Nirsoft behavioral2/memory/1832-137-0x0000000000442F04-mapping.dmp Nirsoft behavioral2/memory/744-147-0x0000000000400000-0x0000000000415000-memory.dmp Nirsoft behavioral2/memory/744-148-0x000000000040C2A8-mapping.dmp Nirsoft -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6 = "C:\\Users\\Admin\\AppData\\Roaming\\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6\\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6.exe" iexplore.exe -
resource yara_rule behavioral2/memory/740-126-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/3184-141-0x0000000000400000-0x0000000000416000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" ee759b97c88356e23b04afa427c6cb94.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6 = "C:\\Users\\Admin\\AppData\\Roaming\\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6\\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6 = "C:\\Users\\Admin\\AppData\\Roaming\\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6\\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6.exe" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ee759b97c88356e23b04afa427c6cb94.exe -
Program crash 3 IoCs
pid pid_target Process procid_target 4024 3192 WerFault.exe 75 3956 3936 WerFault.exe 83 2428 544 WerFault.exe 88 -
Suspicious use of SetThreadContext 9 IoCs
description pid Process procid_target PID 652 set thread context of 3192 652 ee759b97c88356e23b04afa427c6cb94.exe 75 PID 652 set thread context of 3676 652 ee759b97c88356e23b04afa427c6cb94.exe 80 PID 3676 set thread context of 740 3676 iexplore.exe 82 PID 3676 set thread context of 3936 3676 iexplore.exe 83 PID 3676 set thread context of 3940 3676 iexplore.exe 85 PID 3676 set thread context of 1832 3676 iexplore.exe 86 PID 3676 set thread context of 3184 3676 iexplore.exe 87 PID 3676 set thread context of 544 3676 iexplore.exe 88 PID 3676 set thread context of 744 3676 iexplore.exe 90 -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 652 ee759b97c88356e23b04afa427c6cb94.exe 652 ee759b97c88356e23b04afa427c6cb94.exe 652 ee759b97c88356e23b04afa427c6cb94.exe 652 ee759b97c88356e23b04afa427c6cb94.exe 652 ee759b97c88356e23b04afa427c6cb94.exe 652 ee759b97c88356e23b04afa427c6cb94.exe 740 iexplore.exe 740 iexplore.exe 1832 iexplore.exe 1832 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3676 iexplore.exe Token: SeDebugPrivilege 740 iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 652 ee759b97c88356e23b04afa427c6cb94.exe 3676 iexplore.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 652 wrote to memory of 3192 652 ee759b97c88356e23b04afa427c6cb94.exe 75 PID 652 wrote to memory of 3192 652 ee759b97c88356e23b04afa427c6cb94.exe 75 PID 652 wrote to memory of 3192 652 ee759b97c88356e23b04afa427c6cb94.exe 75 PID 652 wrote to memory of 3192 652 ee759b97c88356e23b04afa427c6cb94.exe 75 PID 652 wrote to memory of 3192 652 ee759b97c88356e23b04afa427c6cb94.exe 75 PID 652 wrote to memory of 3192 652 ee759b97c88356e23b04afa427c6cb94.exe 75 PID 652 wrote to memory of 3192 652 ee759b97c88356e23b04afa427c6cb94.exe 75 PID 652 wrote to memory of 3192 652 ee759b97c88356e23b04afa427c6cb94.exe 75 PID 652 wrote to memory of 3676 652 ee759b97c88356e23b04afa427c6cb94.exe 80 PID 652 wrote to memory of 3676 652 ee759b97c88356e23b04afa427c6cb94.exe 80 PID 652 wrote to memory of 3676 652 ee759b97c88356e23b04afa427c6cb94.exe 80 PID 652 wrote to memory of 3676 652 ee759b97c88356e23b04afa427c6cb94.exe 80 PID 652 wrote to memory of 3676 652 ee759b97c88356e23b04afa427c6cb94.exe 80 PID 652 wrote to memory of 3676 652 ee759b97c88356e23b04afa427c6cb94.exe 80 PID 652 wrote to memory of 3676 652 ee759b97c88356e23b04afa427c6cb94.exe 80 PID 652 wrote to memory of 3676 652 ee759b97c88356e23b04afa427c6cb94.exe 80 PID 3676 wrote to memory of 740 3676 iexplore.exe 82 PID 3676 wrote to memory of 740 3676 iexplore.exe 82 PID 3676 wrote to memory of 740 3676 iexplore.exe 82 PID 3676 wrote to memory of 740 3676 iexplore.exe 82 PID 3676 wrote to memory of 740 3676 iexplore.exe 82 PID 3676 wrote to memory of 740 3676 iexplore.exe 82 PID 3676 wrote to memory of 740 3676 iexplore.exe 82 PID 3676 wrote to memory of 740 3676 iexplore.exe 82 PID 3676 wrote to memory of 3936 3676 iexplore.exe 83 PID 3676 wrote to memory of 3936 3676 iexplore.exe 83 PID 3676 wrote to memory of 3936 3676 iexplore.exe 83 PID 3676 wrote to memory of 3936 3676 iexplore.exe 83 PID 3676 wrote to memory of 3936 3676 iexplore.exe 83 PID 3676 wrote to memory of 3936 3676 iexplore.exe 83 PID 3676 wrote to memory of 3936 3676 iexplore.exe 83 PID 3676 wrote to memory of 3936 3676 iexplore.exe 83 PID 3676 wrote to memory of 3936 3676 iexplore.exe 83 PID 3676 wrote to memory of 3940 3676 iexplore.exe 85 PID 3676 wrote to memory of 3940 3676 iexplore.exe 85 PID 3676 wrote to memory of 3940 3676 iexplore.exe 85 PID 3676 wrote to memory of 3940 3676 iexplore.exe 85 PID 3676 wrote to memory of 3940 3676 iexplore.exe 85 PID 3676 wrote to memory of 3940 3676 iexplore.exe 85 PID 3676 wrote to memory of 3940 3676 iexplore.exe 85 PID 3676 wrote to memory of 3940 3676 iexplore.exe 85 PID 3676 wrote to memory of 3940 3676 iexplore.exe 85 PID 3676 wrote to memory of 1832 3676 iexplore.exe 86 PID 3676 wrote to memory of 1832 3676 iexplore.exe 86 PID 3676 wrote to memory of 1832 3676 iexplore.exe 86 PID 3676 wrote to memory of 1832 3676 iexplore.exe 86 PID 3676 wrote to memory of 1832 3676 iexplore.exe 86 PID 3676 wrote to memory of 1832 3676 iexplore.exe 86 PID 3676 wrote to memory of 1832 3676 iexplore.exe 86 PID 3676 wrote to memory of 1832 3676 iexplore.exe 86 PID 3676 wrote to memory of 1832 3676 iexplore.exe 86 PID 3676 wrote to memory of 3184 3676 iexplore.exe 87 PID 3676 wrote to memory of 3184 3676 iexplore.exe 87 PID 3676 wrote to memory of 3184 3676 iexplore.exe 87 PID 3676 wrote to memory of 3184 3676 iexplore.exe 87 PID 3676 wrote to memory of 3184 3676 iexplore.exe 87 PID 3676 wrote to memory of 3184 3676 iexplore.exe 87 PID 3676 wrote to memory of 3184 3676 iexplore.exe 87 PID 3676 wrote to memory of 3184 3676 iexplore.exe 87 PID 3676 wrote to memory of 544 3676 iexplore.exe 88 PID 3676 wrote to memory of 544 3676 iexplore.exe 88 PID 3676 wrote to memory of 544 3676 iexplore.exe 88 PID 3676 wrote to memory of 544 3676 iexplore.exe 88 PID 3676 wrote to memory of 544 3676 iexplore.exe 88 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ee759b97c88356e23b04afa427c6cb94.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee759b97c88356e23b04afa427c6cb94.exe"C:\Users\Admin\AppData\Local\Temp\ee759b97c88356e23b04afa427c6cb94.exe"1⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:652 -
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\ee759b97c88356e23b04afa427c6cb94.exe2⤵PID:3192
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 923⤵
- Program crash
PID:4024
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\ee759b97c88356e23b04afa427c6cb94.exe2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6\ceidsucbh0.txt"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:740
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6\ceidsucbh1.txt"3⤵PID:3936
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 924⤵
- Program crash
PID:3956
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6\ceidsucbh1.txt"3⤵PID:3940
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6\ceidsucbh2.txt"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1832
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6\ceidsucbh3.txt"3⤵PID:3184
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6\ceidsucbh4.txt"3⤵PID:544
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 544 -s 924⤵
- Program crash
PID:2428
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6\ceidsucbh4.txt"3⤵PID:744
-
-