Extracted

Extracted

• • Target

    Payment_Swift 20210930.doc

  • Size

    271KB

  • MD5

    28baa3fb9c80b7604bbc81962e5414b3

  • SHA1

    6b61e6dc6eeeab42d9665659e3bc353bb913716d

  • SHA256

    39c889d91c4bc0fe97e2c565d3a0e103372ba15f988872d049b9277473a87e24

  • SHA512

    cb6cbe0e8be6e36dabd18613857f34b1b30871667fa594151d367c789765c277ed23fc882c4f11dca3ffdeae82aa71dad395a0210003643e7f796dc16db3d2a1

  Score

  10^/10

  xpertrattestevasionpersistencerattrojan

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat

  • XpertRAT Core Payload

  • Adds policy Run key to start application

    persistence

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2