Analysis

  • max time kernel
    4294179s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20220311-en
  • submitted
    14-04-2022 12:44

General

  • Target

    SecuriteInfo.com.BackDoor.SpyBotNET.25.23558.exe

  • Size

    667KB

  • MD5

    1ba1f5a8783628e45caad235c8f640cf

  • SHA1

    b41e98059945ddb010d3b50e5d0c83ecdde79716

  • SHA256

    3ec377ffc5814c66d3417104617bc3a048448ef400c360480efc036c425afb95

  • SHA512

    75c8de68fad66ec3bc8bc8c4887ee561c4e8e8af3e41021213bad8ea06947f379adca14bd3c2fb3ca17f4ac4a17f6bcf5a4cc630fe9979b40b2f0a60efc2b4a9

Malware Config

Signatures

  • UAC bypass 3 TTPs
  • Windows security bypass 2 TTPs
  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.SpyBotNET.25.23558.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.SpyBotNET.25.23558.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1888
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.SpyBotNET.25.23558.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.SpyBotNET.25.23558.exe"
      2⤵
        PID:1456
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.SpyBotNET.25.23558.exe
        "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.SpyBotNET.25.23558.exe"
        2⤵
        • Windows security modification
        • Checks whether UAC is enabled
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:876
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.SpyBotNET.25.23558.exe
          3⤵
          • Adds policy Run key to start application
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1996
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            /stext "C:\Users\Admin\AppData\Roaming\Q4V8N5Y3-O0F7-P7T5-U113-K7R6L4T0H6H6\tenyxeehj0.txt"
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:308
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            /stext "C:\Users\Admin\AppData\Roaming\Q4V8N5Y3-O0F7-P7T5-U113-K7R6L4T0H6H6\tenyxeehj1.txt"
            4⤵
            • Accesses Microsoft Outlook accounts
            PID:432
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            /stext "C:\Users\Admin\AppData\Roaming\Q4V8N5Y3-O0F7-P7T5-U113-K7R6L4T0H6H6\tenyxeehj2.txt"
            4⤵
              PID:1556
            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
              /stext "C:\Users\Admin\AppData\Roaming\Q4V8N5Y3-O0F7-P7T5-U113-K7R6L4T0H6H6\tenyxeehj3.txt"
              4⤵
                PID:1328
              • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                /stext "C:\Users\Admin\AppData\Roaming\Q4V8N5Y3-O0F7-P7T5-U113-K7R6L4T0H6H6\tenyxeehj4.txt"
                4⤵
                  PID:1656

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Persistence

          Registry Run Keys / Startup Folder

          2
          T1060

          Privilege Escalation

          Bypass User Account Control

          1
          T1088

          Defense Evasion

          Bypass User Account Control

          1
          T1088

          Disabling Security Tools

          3
          T1089

          Modify Registry

          6
          T1112

          Discovery

          System Information Discovery

          1
          T1082

          Collection

          Email Collection

          1
          T1114

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\Q4V8N5Y3-O0F7-P7T5-U113-K7R6L4T0H6H6\tenyxeehj2.txt
            Filesize

            2B

            MD5

            f3b25701fe362ec84616a93a45ce9998

            SHA1

            d62636d8caec13f04e28442a0a6fa1afeb024bbb

            SHA256

            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

            SHA512

            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

          • C:\Users\Admin\AppData\Roaming\Q4V8N5Y3-O0F7-P7T5-U113-K7R6L4T0H6H6\tenyxeehj4.txt
            Filesize

            2B

            MD5

            f3b25701fe362ec84616a93a45ce9998

            SHA1

            d62636d8caec13f04e28442a0a6fa1afeb024bbb

            SHA256

            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

            SHA512

            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

          • memory/876-58-0x0000000000400000-0x000000000042C000-memory.dmp
            Filesize

            176KB

          • memory/876-59-0x0000000000400000-0x000000000042C000-memory.dmp
            Filesize

            176KB

          • memory/876-61-0x0000000000400000-0x000000000042C000-memory.dmp
            Filesize

            176KB

          • memory/876-63-0x0000000000400000-0x000000000042C000-memory.dmp
            Filesize

            176KB

          • memory/876-64-0x00000000004010B8-mapping.dmp
          • memory/876-69-0x0000000000400000-0x000000000042C000-memory.dmp
            Filesize

            176KB

          • memory/1888-54-0x0000000000A10000-0x0000000000ABE000-memory.dmp
            Filesize

            696KB

          • memory/1888-55-0x0000000000590000-0x00000000005A6000-memory.dmp
            Filesize

            88KB

          • memory/1888-56-0x00000000051C0000-0x0000000005232000-memory.dmp
            Filesize

            456KB

          • memory/1888-57-0x0000000001F50000-0x0000000001F82000-memory.dmp
            Filesize

            200KB