Overview

overview

10

Static

static

10

11-10-2020...HN.exe

windows7_x64

10

11-10-2020...HN.exe

windows10-2004_x64

10

11_07_2020...47.exe

windows7_x64

10

11_07_2020...47.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    164s
  • max time network
    180s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    08-05-2022 22:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    11_07_2020 PO_INVOICE #3309247.exe

  • Size

    172KB

  • MD5

    ed21990ff9e29addfd9252f1ba0b30d4

  • SHA1

    1f34df7a5cd551dcb5ec24227fbd1a985cbbe4ef

  • SHA256

    8963180e8b2e7e51c5abd716e7a562ad010f663c41a38015ad2566231a7da9af

  • SHA512

    c22f99e61f7b823f412f5c5ad5173096c38aab57833ab2ac61a5a38b173cc97b154a7b90d0d94fa6844eb8c371057429ba22a63533fcf4487e3eb19c0291dc06

Score
10/10
xpertratcollectionevasionpersistencerattrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs
    evasiontrojan
  • Windows security bypass 2 TTPs
    evasiontrojan
  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat
  • Adds policy Run key to start application 2 TTPs 2 IoCs
    persistence
  • Windows security modification 2 TTPs 1 IoCs
    evasiontrojan
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Program crash 2 IoCs
  • Suspicious use of SetThreadContext 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\11_07_2020 PO_INVOICE #3309247.exe
    "C:\Users\Admin\AppData\Local\Temp\11_07_2020 PO_INVOICE #3309247.exe"
    1⤵
    • Windows security modification
    • Checks whether UAC is enabled
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2272
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      C:\Users\Admin\AppData\Local\Temp\11_07_2020 PO_INVOICE #3309247.exe
      2⤵
        PID:2216
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 84
          3⤵
          • Program crash
          PID:2348
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        C:\Users\Admin\AppData\Local\Temp\11_07_2020 PO_INVOICE #3309247.exe
        2⤵
        • Adds policy Run key to start application
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2204
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          /stext "C:\Users\Admin\AppData\Roaming\K8Q3I007-I4H2-R2V0-W0G8-T1Q3K5W771L5\jftfcuwlc0.txt"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4600
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          /stext "C:\Users\Admin\AppData\Roaming\K8Q3I007-I4H2-R2V0-W0G8-T1Q3K5W771L5\jftfcuwlc1.txt"
          3⤵
          • Accesses Microsoft Outlook accounts
          PID:3564
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          /stext "C:\Users\Admin\AppData\Roaming\K8Q3I007-I4H2-R2V0-W0G8-T1Q3K5W771L5\jftfcuwlc2.txt"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4520
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          /stext "C:\Users\Admin\AppData\Roaming\K8Q3I007-I4H2-R2V0-W0G8-T1Q3K5W771L5\jftfcuwlc3.txt"
          3⤵
            PID:312
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            /stext "C:\Users\Admin\AppData\Roaming\K8Q3I007-I4H2-R2V0-W0G8-T1Q3K5W771L5\jftfcuwlc3.txt"
            3⤵
              PID:4496
            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
              /stext "C:\Users\Admin\AppData\Roaming\K8Q3I007-I4H2-R2V0-W0G8-T1Q3K5W771L5\jftfcuwlc4.txt"
              3⤵
                PID:1116
            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
              C:\Users\Admin\AppData\Local\Temp\11_07_2020 PO_INVOICE #3309247.exe
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:4532
            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
              C:\Users\Admin\AppData\Local\Temp\11_07_2020 PO_INVOICE #3309247.exe
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:4800
            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
              C:\Users\Admin\AppData\Local\Temp\11_07_2020 PO_INVOICE #3309247.exe
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:3632
            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
              C:\Users\Admin\AppData\Local\Temp\11_07_2020 PO_INVOICE #3309247.exe
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:4760
            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
              C:\Users\Admin\AppData\Local\Temp\11_07_2020 PO_INVOICE #3309247.exe
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:4508
            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
              C:\Users\Admin\AppData\Local\Temp\11_07_2020 PO_INVOICE #3309247.exe
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:4592
            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
              C:\Users\Admin\AppData\Local\Temp\11_07_2020 PO_INVOICE #3309247.exe
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:3148
            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
              C:\Users\Admin\AppData\Local\Temp\11_07_2020 PO_INVOICE #3309247.exe
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:4628
            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
              C:\Users\Admin\AppData\Local\Temp\11_07_2020 PO_INVOICE #3309247.exe
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:4928
            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
              C:\Users\Admin\AppData\Local\Temp\11_07_2020 PO_INVOICE #3309247.exe
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:3448
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2216 -ip 2216
            1⤵
              PID:1476
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4496 -ip 4496
              1⤵
                PID:4956
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 84
                1⤵
                • Program crash
                PID:4460

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Initial Access

              Execution

              Persistence

              Registry Run Keys / Startup Folder

              2
              T1060

              Privilege Escalation

              Bypass User Account Control

              1
              T1088

              Defense Evasion

              Bypass User Account Control

              1
              T1088

              Disabling Security Tools

              3
              T1089

              Modify Registry

              6
              T1112

              Credential Access

              Discovery

              System Information Discovery

              1
              T1082

              Lateral Movement

              Collection

              Email Collection

              1
              T1114

              Exfiltration

              Command and Control

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Roaming\K8Q3I007-I4H2-R2V0-W0G8-T1Q3K5W771L5\jftfcuwlc2.txt
                Filesize

                3KB

                MD5

                f94dc819ca773f1e3cb27abbc9e7fa27

                SHA1

                9a7700efadc5ea09ab288544ef1e3cd876255086

                SHA256

                a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92

                SHA512

                72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196

                Download Submit
              • C:\Users\Admin\AppData\Roaming\K8Q3I007-I4H2-R2V0-W0G8-T1Q3K5W771L5\jftfcuwlc4.txt
                Filesize

                2B

                MD5

                f3b25701fe362ec84616a93a45ce9998

                SHA1

                d62636d8caec13f04e28442a0a6fa1afeb024bbb

                SHA256

                b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                SHA512

                98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                Download Submit