Overview

overview

10

Static

static

INVNOVPAY3...00.exe

windows7_x64

10

INVNOVPAY3...00.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    INVNOVPAY30002021001199554Pay5443545632211000.exe

  • Size

    1.7MB

  • Sample

    211201-jxrbraaggn

  • MD5

    b139dd38b0aaa785c555310ac2b1c3fd

  • SHA1

    5873995badb3843e97bf6cfe87bcd283c30fb393

  • SHA256

    ac0f87add6a605e555dc559282160c2ef708ca2fecc0799442c361c2f37f6828

  • SHA512

    ea5d759be0547822763607133d3c43ae44fa9f5a5b55ea3ff4456b37152a5243e9911162debb6422473ef0e81c4d33bb0ca7d4c4a978d600beccfa7850c23ecf

Score
10/10
xpertratcollectionevasionpersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      INVNOVPAY30002021001199554Pay5443545632211000.exe

    • Size

      1.7MB

    • MD5

      b139dd38b0aaa785c555310ac2b1c3fd

    • SHA1

      5873995badb3843e97bf6cfe87bcd283c30fb393

    • SHA256

      ac0f87add6a605e555dc559282160c2ef708ca2fecc0799442c361c2f37f6828

    • SHA512

      ea5d759be0547822763607133d3c43ae44fa9f5a5b55ea3ff4456b37152a5243e9911162debb6422473ef0e81c4d33bb0ca7d4c4a978d600beccfa7850c23ecf

    Score
    10/10
    xpertratcollectionevasionpersistenceratsuricatatrojan

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • XpertRAT

      XpertRAT is a remote access trojan with various capabilities.

      ratxpertrat

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata

    • Adds policy Run key to start application

      persistence

    • Downloads MZ/PE file

    • Windows security modification

      evasiontrojan

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Program crash

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

3
T1089

Modify Registry

6
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks