Analysis

  • max time kernel
    140s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-09-2022 06:51

General

  • Target

    bjZB.exe

  • Size

    1.4MB

  • MD5

    ee79da4d89dff4f76a822bb60e3a4d05

  • SHA1

    830160df0323cbb49bb2fc17ada3a244fcf632d4

  • SHA256

    baa66f0786ba08ec0dc82d145bce5bc43e31a8beddd34b6cad96b24c9adb1c5f

  • SHA512

    3a6069d6754a04d4514d22a2563af04b5acdcef0a08f3a2e58e412aaa651155d4b0efe0a36edf520e9c6dcb05e80650d50e6e55192d4a87610f5e1f91d16442f

  • SSDEEP

    24576:10LOa5+siQP+CfZ5Az6aFwgR64Bs/TrIyAPm:19TQPlh5AXR64m7cy

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 1 IoCs
  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Program crash 2 IoCs
  • Suspicious use of SetThreadContext 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bjZB.exe
    "C:\Users\Admin\AppData\Local\Temp\bjZB.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3744
    • C:\Users\Admin\AppData\Local\Temp\bjZB.exe
      "C:\Users\Admin\AppData\Local\Temp\bjZB.exe"
      2⤵
      • UAC bypass
      • Windows security bypass
      • Windows security modification
      • Checks whether UAC is enabled
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4844
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        C:\Users\Admin\AppData\Local\Temp\bjZB.exe
        3⤵
        • Adds policy Run key to start application
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1388
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          /stext "C:\Users\Admin\AppData\Roaming\V1B5T2F0-T6S4-E5P1-P7G0-X443Q1A6T3M3\qbfttzuac0.txt"
          4⤵
            PID:3760
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 84
              5⤵
              • Program crash
              PID:2568
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            /stext "C:\Users\Admin\AppData\Roaming\V1B5T2F0-T6S4-E5P1-P7G0-X443Q1A6T3M3\qbfttzuac0.txt"
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1564
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            /stext "C:\Users\Admin\AppData\Roaming\V1B5T2F0-T6S4-E5P1-P7G0-X443Q1A6T3M3\qbfttzuac1.txt"
            4⤵
              PID:1936
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 84
                5⤵
                • Program crash
                PID:3128
            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
              /stext "C:\Users\Admin\AppData\Roaming\V1B5T2F0-T6S4-E5P1-P7G0-X443Q1A6T3M3\qbfttzuac1.txt"
              4⤵
              • Accesses Microsoft Outlook accounts
              PID:1464
            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
              /stext "C:\Users\Admin\AppData\Roaming\V1B5T2F0-T6S4-E5P1-P7G0-X443Q1A6T3M3\qbfttzuac2.txt"
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:2092
            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
              /stext "C:\Users\Admin\AppData\Roaming\V1B5T2F0-T6S4-E5P1-P7G0-X443Q1A6T3M3\qbfttzuac3.txt"
              4⤵
                PID:4776
              • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                /stext "C:\Users\Admin\AppData\Roaming\V1B5T2F0-T6S4-E5P1-P7G0-X443Q1A6T3M3\qbfttzuac4.txt"
                4⤵
                  PID:2832
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3760 -ip 3760
            1⤵
              PID:1020
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1936 -ip 1936
              1⤵
                PID:3868

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Persistence

              Registry Run Keys / Startup Folder

              2
              T1060

              Privilege Escalation

              Bypass User Account Control

              1
              T1088

              Defense Evasion

              Bypass User Account Control

              1
              T1088

              Disabling Security Tools

              3
              T1089

              Modify Registry

              6
              T1112

              Discovery

              System Information Discovery

              1
              T1082

              Collection

              Email Collection

              1
              T1114

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Roaming\V1B5T2F0-T6S4-E5P1-P7G0-X443Q1A6T3M3\qbfttzuac2.txt
                Filesize

                3KB

                MD5

                f94dc819ca773f1e3cb27abbc9e7fa27

                SHA1

                9a7700efadc5ea09ab288544ef1e3cd876255086

                SHA256

                a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92

                SHA512

                72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196

              • C:\Users\Admin\AppData\Roaming\V1B5T2F0-T6S4-E5P1-P7G0-X443Q1A6T3M3\qbfttzuac4.txt
                Filesize

                2B

                MD5

                f3b25701fe362ec84616a93a45ce9998

                SHA1

                d62636d8caec13f04e28442a0a6fa1afeb024bbb

                SHA256

                b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                SHA512

                98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

              • memory/3744-138-0x0000000009C70000-0x0000000009CD6000-memory.dmp
                Filesize

                408KB

              • memory/3744-135-0x00000000077D0000-0x00000000077DA000-memory.dmp
                Filesize

                40KB

              • memory/3744-136-0x0000000008180000-0x0000000008326000-memory.dmp
                Filesize

                1.6MB

              • memory/3744-137-0x0000000009BD0000-0x0000000009C6C000-memory.dmp
                Filesize

                624KB

              • memory/3744-132-0x0000000000730000-0x00000000008A2000-memory.dmp
                Filesize

                1.4MB

              • memory/3744-134-0x0000000007720000-0x00000000077B2000-memory.dmp
                Filesize

                584KB

              • memory/3744-133-0x0000000007BD0000-0x0000000008174000-memory.dmp
                Filesize

                5.6MB

              • memory/4844-139-0x0000000000000000-mapping.dmp
              • memory/4844-140-0x0000000000400000-0x000000000042C000-memory.dmp
                Filesize

                176KB

              • memory/4844-142-0x0000000000400000-0x000000000042C000-memory.dmp
                Filesize

                176KB

              • memory/4844-145-0x0000000000400000-0x000000000042C000-memory.dmp
                Filesize

                176KB

              • memory/4844-146-0x0000000000400000-0x000000000042C000-memory.dmp
                Filesize

                176KB