Analysis

  • max time kernel
    45s
  • max time network
    140s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    13-07-2021 12:58

General

  • Target

    704ce624d4906a3cf343562b90249b58.exe

  • Size

    759KB

  • MD5

    704ce624d4906a3cf343562b90249b58

  • SHA1

    c007c6fb7c85795c2cdf5b2171392dedf72a5c9e

  • SHA256

    59d18f1afca7fa22d68455d412c29949993c21edfb3658091bdad62093e0f818

  • SHA512

    d3c285ce095cb72dc4fb7de298bc59235ed727bb99fbe0c0eea7f4aea53b4270d707ae164866dc18eef268375b3f683e7506f3582210b59d0e1fdf6aac8e1f08

Malware Config

Extracted

Family

xpertrat

Version

3.1.9

Botnet

BXK

C2

ioxg.ix.tc:4000

Mutex

R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6

Signatures

  • UAC bypass 3 TTPs
  • Windows security bypass 2 TTPs
  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

  • XpertRAT Core Payload 2 IoCs
  • NirSoft MailPassView 2 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 2 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 6 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of SetThreadContext 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\704ce624d4906a3cf343562b90249b58.exe
    "C:\Users\Admin\AppData\Local\Temp\704ce624d4906a3cf343562b90249b58.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4012
    • C:\Users\Admin\AppData\Local\Temp\704ce624d4906a3cf343562b90249b58.exe
      C:\Users\Admin\AppData\Local\Temp\704ce624d4906a3cf343562b90249b58.exe
      2⤵
        PID:3632
      • C:\Users\Admin\AppData\Local\Temp\704ce624d4906a3cf343562b90249b58.exe
        C:\Users\Admin\AppData\Local\Temp\704ce624d4906a3cf343562b90249b58.exe
        2⤵
          PID:1676
        • C:\Users\Admin\AppData\Local\Temp\704ce624d4906a3cf343562b90249b58.exe
          C:\Users\Admin\AppData\Local\Temp\704ce624d4906a3cf343562b90249b58.exe
          2⤵
          • Windows security modification
          • Checks whether UAC is enabled
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:3564
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            C:\Users\Admin\AppData\Local\Temp\704ce624d4906a3cf343562b90249b58.exe
            3⤵
            • Adds policy Run key to start application
            • Adds Run key to start application
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1140
            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
              /stext "C:\Users\Admin\AppData\Roaming\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6\ijbcijfki0.txt"
              4⤵
                PID:3960
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 92
                  5⤵
                  • Program crash
                  PID:2096
              • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                /stext "C:\Users\Admin\AppData\Roaming\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6\ijbcijfki0.txt"
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1796
              • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                /stext "C:\Users\Admin\AppData\Roaming\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6\ijbcijfki1.txt"
                4⤵
                  PID:2736
                • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                  /stext "C:\Users\Admin\AppData\Roaming\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6\ijbcijfki2.txt"
                  4⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2740
                • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                  /stext "C:\Users\Admin\AppData\Roaming\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6\ijbcijfki3.txt"
                  4⤵
                    PID:2680
                  • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                    /stext "C:\Users\Admin\AppData\Roaming\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6\ijbcijfki4.txt"
                    4⤵
                      PID:3224

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Roaming\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6\ijbcijfki2.txt

                MD5

                f94dc819ca773f1e3cb27abbc9e7fa27

                SHA1

                9a7700efadc5ea09ab288544ef1e3cd876255086

                SHA256

                a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92

                SHA512

                72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196

              • C:\Users\Admin\AppData\Roaming\R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6\ijbcijfki4.txt

                MD5

                f3b25701fe362ec84616a93a45ce9998

                SHA1

                d62636d8caec13f04e28442a0a6fa1afeb024bbb

                SHA256

                b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                SHA512

                98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

              • memory/1140-133-0x0000000000401364-mapping.dmp

              • memory/1140-138-0x00000000034C1000-0x00000000035BD000-memory.dmp

                Filesize

                1008KB

              • memory/1140-137-0x00000000034C0000-0x0000000003613000-memory.dmp

                Filesize

                1.3MB

              • memory/1140-132-0x0000000000400000-0x0000000000444000-memory.dmp

                Filesize

                272KB

              • memory/1796-144-0x0000000000423BC0-mapping.dmp

              • memory/1796-143-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

              • memory/2680-156-0x0000000000400000-0x0000000000416000-memory.dmp

                Filesize

                88KB

              • memory/2680-157-0x0000000000413750-mapping.dmp

              • memory/2736-147-0x0000000000400000-0x000000000041B000-memory.dmp

                Filesize

                108KB

              • memory/2736-148-0x0000000000411654-mapping.dmp

              • memory/2740-151-0x0000000000400000-0x0000000000459000-memory.dmp

                Filesize

                356KB

              • memory/2740-152-0x0000000000442F04-mapping.dmp

              • memory/3224-161-0x000000000040C2A8-mapping.dmp

              • memory/3224-160-0x0000000000400000-0x0000000000415000-memory.dmp

                Filesize

                84KB

              • memory/3564-135-0x0000000000400000-0x000000000042C000-memory.dmp

                Filesize

                176KB

              • memory/3564-129-0x00000000004010B8-mapping.dmp

              • memory/3564-128-0x0000000000400000-0x000000000042C000-memory.dmp

                Filesize

                176KB

              • memory/3960-142-0x0000000000423BC0-mapping.dmp

              • memory/4012-114-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

                Filesize

                4KB

              • memory/4012-120-0x0000000005D10000-0x0000000005D6F000-memory.dmp

                Filesize

                380KB

              • memory/4012-121-0x0000000007540000-0x0000000007541000-memory.dmp

                Filesize

                4KB

              • memory/4012-119-0x0000000005AC0000-0x0000000005FBE000-memory.dmp

                Filesize

                5.0MB

              • memory/4012-118-0x0000000003480000-0x0000000003481000-memory.dmp

                Filesize

                4KB

              • memory/4012-117-0x0000000005960000-0x0000000005961000-memory.dmp

                Filesize

                4KB

              • memory/4012-122-0x00000000075C0000-0x00000000075C1000-memory.dmp

                Filesize

                4KB

              • memory/4012-127-0x0000000007ED0000-0x0000000007F37000-memory.dmp

                Filesize

                412KB

              • memory/4012-116-0x0000000005FC0000-0x0000000005FC1000-memory.dmp

                Filesize

                4KB