Analysis

  • max time kernel
    4294183s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20220311-en
  • submitted
    14-04-2022 16:40

General

  • Target

    SecuriteInfo.com.BackDoor.SpyBotNET.25.4997.exe

  • Size

    687KB

  • MD5

    dd7de3e242afd0dbd6166879237df822

  • SHA1

    3a4fb913f82082633f6130f12c28fa10b53db91e

  • SHA256

    5f55d8c4830b28a08183d87428064f6a641f7c95ffe373cafe1ecb8b36043d99

  • SHA512

    2c853287bddd0156f486ec8e7f36ee8d4a1f2e47b43c9a4f126e980546ce4359de7f7c1bfd2db1133cdfa5b99e64587b9e1f85898fc1eb95ac3d7b4161a181dc

Malware Config

Signatures

  • UAC bypass 3 TTPs
  • Windows security bypass 2 TTPs
  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.SpyBotNET.25.4997.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.SpyBotNET.25.4997.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.SpyBotNET.25.4997.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.SpyBotNET.25.4997.exe"
      2⤵
      • Windows security modification
      • Checks whether UAC is enabled
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:828
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.SpyBotNET.25.4997.exe
        3⤵
        • Adds policy Run key to start application
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:432
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          /stext "C:\Users\Admin\AppData\Roaming\Q4V8N5Y3-O0F7-P7T5-U113-K7R6L4T0H6H6\exelfagee0.txt"
          4⤵
            PID:1448
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            /stext "C:\Users\Admin\AppData\Roaming\Q4V8N5Y3-O0F7-P7T5-U113-K7R6L4T0H6H6\exelfagee0.txt"
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:600
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            /stext "C:\Users\Admin\AppData\Roaming\Q4V8N5Y3-O0F7-P7T5-U113-K7R6L4T0H6H6\exelfagee1.txt"
            4⤵
            • Accesses Microsoft Outlook accounts
            PID:1812
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            /stext "C:\Users\Admin\AppData\Roaming\Q4V8N5Y3-O0F7-P7T5-U113-K7R6L4T0H6H6\exelfagee2.txt"
            4⤵
              PID:1800
            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
              /stext "C:\Users\Admin\AppData\Roaming\Q4V8N5Y3-O0F7-P7T5-U113-K7R6L4T0H6H6\exelfagee3.txt"
              4⤵
                PID:1580
              • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                /stext "C:\Users\Admin\AppData\Roaming\Q4V8N5Y3-O0F7-P7T5-U113-K7R6L4T0H6H6\exelfagee4.txt"
                4⤵
                  PID:1832
                • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                  /stext "C:\Users\Admin\AppData\Roaming\Q4V8N5Y3-O0F7-P7T5-U113-K7R6L4T0H6H6\exelfagee4.txt"
                  4⤵
                    PID:1936

            Network

            MITRE ATT&CK Matrix ATT&CK v6

            Persistence

            Registry Run Keys / Startup Folder

            2
            T1060

            Privilege Escalation

            Bypass User Account Control

            1
            T1088

            Defense Evasion

            Bypass User Account Control

            1
            T1088

            Disabling Security Tools

            3
            T1089

            Modify Registry

            6
            T1112

            Discovery

            System Information Discovery

            1
            T1082

            Collection

            Email Collection

            1
            T1114

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Roaming\Q4V8N5Y3-O0F7-P7T5-U113-K7R6L4T0H6H6\exelfagee2.txt
              Filesize

              2B

              MD5

              f3b25701fe362ec84616a93a45ce9998

              SHA1

              d62636d8caec13f04e28442a0a6fa1afeb024bbb

              SHA256

              b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

              SHA512

              98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

            • C:\Users\Admin\AppData\Roaming\Q4V8N5Y3-O0F7-P7T5-U113-K7R6L4T0H6H6\exelfagee4.txt
              Filesize

              2B

              MD5

              f3b25701fe362ec84616a93a45ce9998

              SHA1

              d62636d8caec13f04e28442a0a6fa1afeb024bbb

              SHA256

              b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

              SHA512

              98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

            • memory/828-58-0x0000000000400000-0x000000000042C000-memory.dmp
              Filesize

              176KB

            • memory/828-59-0x0000000000400000-0x000000000042C000-memory.dmp
              Filesize

              176KB

            • memory/828-61-0x0000000000400000-0x000000000042C000-memory.dmp
              Filesize

              176KB

            • memory/828-63-0x0000000000400000-0x000000000042C000-memory.dmp
              Filesize

              176KB

            • memory/828-64-0x00000000004010B8-mapping.dmp
            • memory/828-69-0x0000000000400000-0x000000000042C000-memory.dmp
              Filesize

              176KB

            • memory/2032-54-0x00000000000C0000-0x0000000000172000-memory.dmp
              Filesize

              712KB

            • memory/2032-55-0x00000000005B0000-0x00000000005C6000-memory.dmp
              Filesize

              88KB

            • memory/2032-56-0x0000000004FE0000-0x0000000005054000-memory.dmp
              Filesize

              464KB

            • memory/2032-57-0x0000000002000000-0x0000000002032000-memory.dmp
              Filesize

              200KB