Analysis
-
max time kernel
149s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
31-07-2022 05:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
Resource
win7-20220715-en
windows7-x64
17 signatures
150 seconds
General
-
Target
a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe
-
Size
1.2MB
-
MD5
d58b1c2f540268bd9dd920455568d45f
-
SHA1
58fa23062ee8e44912be9712eed62fbe753289fd
-
SHA256
a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf
-
SHA512
f36c1bbf62b091647151751896b98c3edffbfc711c12f02db6ef588c5a4661d1f1c3b9a1615fb3405eb9298d06d4dade3ba3286291ff11b5fc980d2f1e4519c8
Malware Config
Extracted
Family
xpertrat
Version
3.0.10
Botnet
Hauk902
C2
expertworldwithout.gleeze.com:4444
Mutex
R2Q3F8F6-L8M2-T1G2-O4Y1-C3N4I3V1R3O0
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" svchost.exe -
XpertRAT Core payload 5 IoCs
resource yara_rule behavioral1/memory/1792-61-0x0000000000400000-0x0000000000443000-memory.dmp xpertrat behavioral1/memory/1792-62-0x0000000000401364-mapping.dmp xpertrat behavioral1/memory/1792-64-0x0000000000400000-0x0000000000443000-memory.dmp xpertrat behavioral1/memory/1792-68-0x0000000000400000-0x0000000000443000-memory.dmp xpertrat behavioral1/memory/1792-71-0x0000000000400000-0x0000000000443000-memory.dmp xpertrat -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scp.lnk a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe -
Loads dropped DLL 1 IoCs
pid Process 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x000b000000012325-55.dat autoit_exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\ut svchost.exe File opened for modification C:\Windows\SysWOW64\R2Q3F8F6-L8M2-T1G2-O4Y1-C3N4I3V1R3O0 svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1996 set thread context of 1484 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 27 PID 1484 set thread context of 1792 1484 svchost.exe 28 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1484 svchost.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1484 svchost.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1792 svchost.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1484 svchost.exe 1792 svchost.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1996 wrote to memory of 1484 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 27 PID 1996 wrote to memory of 1484 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 27 PID 1996 wrote to memory of 1484 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 27 PID 1996 wrote to memory of 1484 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 27 PID 1996 wrote to memory of 1484 1996 a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe 27 PID 1484 wrote to memory of 1792 1484 svchost.exe 28 PID 1484 wrote to memory of 1792 1484 svchost.exe 28 PID 1484 wrote to memory of 1792 1484 svchost.exe 28 PID 1484 wrote to memory of 1792 1484 svchost.exe 28 PID 1484 wrote to memory of 1792 1484 svchost.exe 28 PID 1484 wrote to memory of 1792 1484 svchost.exe 28 PID 1484 wrote to memory of 1792 1484 svchost.exe 28 PID 1484 wrote to memory of 1792 1484 svchost.exe 28 PID 1484 wrote to memory of 1792 1484 svchost.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe"C:\Users\Admin\AppData\Local\Temp\a9909b284f46a9193235f980fecd71e69a6c0d7fbac8e8879f73d11e3816dacf.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- UAC bypass
- Windows security bypass
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1792
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5f591ae538e02688695e52f9001d3c7a0
SHA1ec7b5b90ec90c4aefba0992705f8fef4871ebcf2
SHA2562f65ab1ea6a17423a3a30cc93d7a078ed8cae9ecf4b2d8d8c696134dbf925c3c
SHA512efbc2bd25877dad56a3a8a621540bc6da0d7676838437d3e8c6e71e1500ad6b1ed39342a58898d4bddc0d728e27261b3dc6eaad1409a517d97deb38ef6fdd947