Analysis

  • max time kernel
    60s
  • max time network
    167s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    08-05-2022 22:07

General

  • Target

    11_07_2020 PO_INVOICE #3309247.exe

  • Size

    172KB

  • MD5

    ed21990ff9e29addfd9252f1ba0b30d4

  • SHA1

    1f34df7a5cd551dcb5ec24227fbd1a985cbbe4ef

  • SHA256

    8963180e8b2e7e51c5abd716e7a562ad010f663c41a38015ad2566231a7da9af

  • SHA512

    c22f99e61f7b823f412f5c5ad5173096c38aab57833ab2ac61a5a38b173cc97b154a7b90d0d94fa6844eb8c371057429ba22a63533fcf4487e3eb19c0291dc06

Malware Config

Signatures

  • UAC bypass 3 TTPs
  • Windows security bypass 2 TTPs
  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\11_07_2020 PO_INVOICE #3309247.exe
    "C:\Users\Admin\AppData\Local\Temp\11_07_2020 PO_INVOICE #3309247.exe"
    1⤵
    • Windows security modification
    • Checks whether UAC is enabled
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:988
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      C:\Users\Admin\AppData\Local\Temp\11_07_2020 PO_INVOICE #3309247.exe
      2⤵
        PID:1652
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        C:\Users\Admin\AppData\Local\Temp\11_07_2020 PO_INVOICE #3309247.exe
        2⤵
        • Adds policy Run key to start application
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1588
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          /stext "C:\Users\Admin\AppData\Roaming\K8Q3I007-I4H2-R2V0-W0G8-T1Q3K5W771L5\kfdxnycwp0.txt"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:964
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          /stext "C:\Users\Admin\AppData\Roaming\K8Q3I007-I4H2-R2V0-W0G8-T1Q3K5W771L5\kfdxnycwp1.txt"
          3⤵
          • Accesses Microsoft Outlook accounts
          PID:240
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          /stext "C:\Users\Admin\AppData\Roaming\K8Q3I007-I4H2-R2V0-W0G8-T1Q3K5W771L5\kfdxnycwp2.txt"
          3⤵
            PID:888
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            /stext "C:\Users\Admin\AppData\Roaming\K8Q3I007-I4H2-R2V0-W0G8-T1Q3K5W771L5\kfdxnycwp3.txt"
            3⤵
              PID:1060
            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
              /stext "C:\Users\Admin\AppData\Roaming\K8Q3I007-I4H2-R2V0-W0G8-T1Q3K5W771L5\kfdxnycwp4.txt"
              3⤵
                PID:432

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Persistence

          Registry Run Keys / Startup Folder

          2
          T1060

          Privilege Escalation

          Bypass User Account Control

          1
          T1088

          Defense Evasion

          Bypass User Account Control

          1
          T1088

          Disabling Security Tools

          3
          T1089

          Modify Registry

          6
          T1112

          Discovery

          System Information Discovery

          1
          T1082

          Collection

          Email Collection

          1
          T1114

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\K8Q3I007-I4H2-R2V0-W0G8-T1Q3K5W771L5\kfdxnycwp2.txt
            Filesize

            2B

            MD5

            f3b25701fe362ec84616a93a45ce9998

            SHA1

            d62636d8caec13f04e28442a0a6fa1afeb024bbb

            SHA256

            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

            SHA512

            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

          • C:\Users\Admin\AppData\Roaming\K8Q3I007-I4H2-R2V0-W0G8-T1Q3K5W771L5\kfdxnycwp4.txt
            Filesize

            2B

            MD5

            f3b25701fe362ec84616a93a45ce9998

            SHA1

            d62636d8caec13f04e28442a0a6fa1afeb024bbb

            SHA256

            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

            SHA512

            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

          • memory/988-54-0x00000000759F1000-0x00000000759F3000-memory.dmp
            Filesize

            8KB