Extracted

Extracted

• • Target
    Inq PO-000202120741.doc
  • Size 535KB
  • SHA256 29327d8089389d96e7ae1abcbd7c300ab587c59fa5841b748ef47e279d0c526b
  • MD5 4ef6b1fa16f352e1969080579b832ee3
  • SHA1 d4b85b188ad50ef69c1a238b979a1db7f0d4970d
  • SHA512 85bb5bde53e6df3b759377ec1920a01281ca0f36bd477335759fdb5b043575628e7be11a960c0ff04188c2a17d4c51b9c43a6efeaf21b505a48c65311af026a3
  • MD5 SHA1 SHA512

  Score

  10^/10

  xpertrattestevasionpersistencerattrojan

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat

  • XpertRAT Core Payload

  • Adds policy Run key to start application

    persistence

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2