Analysis
-
max time kernel
142s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
08-02-2024 13:21
Static task
static1
Behavioral task
behavioral1
Sample
Új megrendelés - 00905173088 CPTL árajánlat - egyenként 100.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Új megrendelés - 00905173088 CPTL árajánlat - egyenként 100.exe
Resource
win10v2004-20231215-en
General
-
Target
Új megrendelés - 00905173088 CPTL árajánlat - egyenként 100.exe
-
Size
110KB
-
MD5
e18a8e37b5d2cfaec89222fd74c88081
-
SHA1
19a794cb433dc4445e33becc7c2ce7d211baefa6
-
SHA256
31ec85607b59877f42e791a2ac23d8c8c95edc8bad7fc0939a90a3807f445c6d
-
SHA512
287358b925ff7a6e214ea29612461c94fbc12eb145a8ed3cfc8a7400151a6fe7ebc399d6ae0ad22d31dd8b9e2082668957a30baca807502cf1a78beb33b5c2c8
-
SSDEEP
1536:Kx+EiewYluxHtThsiP34bbCaFJqIc5fpD7/xL:KrvyRhsiffaKIc5hDF
Malware Config
Extracted
xpertrat
3.0.10
BLAZE
twart.myfirewall.org:5344
A6G228Q5-H8G1-F1T6-U4K6-C1J007E2X0Y8
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" calc.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" calc.exe -
XpertRAT Core payload 1 IoCs
resource yara_rule behavioral2/memory/2292-16-0x0000000000400000-0x0000000000443000-memory.dmp xpertrat -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/2232-28-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/memory/3048-31-0x0000000000400000-0x0000000000459000-memory.dmp WebBrowserPassView -
Nirsoft 3 IoCs
resource yara_rule behavioral2/memory/2232-28-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/3048-31-0x0000000000400000-0x0000000000459000-memory.dmp Nirsoft behavioral2/memory/1516-39-0x0000000000400000-0x0000000000415000-memory.dmp Nirsoft -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\A6G228Q5-H8G1-F1T6-U4K6-C1J007E2X0Y8 = "C:\\Users\\Admin\\AppData\\Roaming\\A6G228Q5-H8G1-F1T6-U4K6-C1J007E2X0Y8\\A6G228Q5-H8G1-F1T6-U4K6-C1J007E2X0Y8.exe" iexplore.exe -
resource yara_rule behavioral2/memory/1140-27-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/2980-38-0x0000000000400000-0x0000000000416000-memory.dmp upx -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts iexplore.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\A6G228Q5-H8G1-F1T6-U4K6-C1J007E2X0Y8 = "C:\\Users\\Admin\\AppData\\Roaming\\A6G228Q5-H8G1-F1T6-U4K6-C1J007E2X0Y8\\A6G228Q5-H8G1-F1T6-U4K6-C1J007E2X0Y8.exe" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\A6G228Q5-H8G1-F1T6-U4K6-C1J007E2X0Y8 = "C:\\Users\\Admin\\AppData\\Roaming\\A6G228Q5-H8G1-F1T6-U4K6-C1J007E2X0Y8\\A6G228Q5-H8G1-F1T6-U4K6-C1J007E2X0Y8.exe" iexplore.exe -
Program crash 3 IoCs
pid pid_target Process procid_target 4048 1992 WerFault.exe 86 2636 2232 WerFault.exe 91 1236 1324 WerFault.exe 96 -
Suspicious use of SetThreadContext 10 IoCs
description pid Process procid_target PID 3504 set thread context of 1500 3504 Új megrendelés - 00905173088 CPTL árajánlat - egyenként 100.exe 84 PID 1500 set thread context of 2292 1500 calc.exe 85 PID 2292 set thread context of 1992 2292 iexplore.exe 86 PID 2292 set thread context of 1140 2292 iexplore.exe 90 PID 2292 set thread context of 2232 2292 iexplore.exe 91 PID 2292 set thread context of 2696 2292 iexplore.exe 94 PID 2292 set thread context of 3048 2292 iexplore.exe 95 PID 2292 set thread context of 1324 2292 iexplore.exe 96 PID 2292 set thread context of 2980 2292 iexplore.exe 99 PID 2292 set thread context of 1516 2292 iexplore.exe 100 -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1500 calc.exe 1500 calc.exe 1140 iexplore.exe 1140 iexplore.exe 1500 calc.exe 1500 calc.exe 3048 iexplore.exe 3048 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2292 iexplore.exe Token: SeDebugPrivilege 1140 iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1500 calc.exe 2292 iexplore.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3504 wrote to memory of 1500 3504 Új megrendelés - 00905173088 CPTL árajánlat - egyenként 100.exe 84 PID 3504 wrote to memory of 1500 3504 Új megrendelés - 00905173088 CPTL árajánlat - egyenként 100.exe 84 PID 3504 wrote to memory of 1500 3504 Új megrendelés - 00905173088 CPTL árajánlat - egyenként 100.exe 84 PID 3504 wrote to memory of 1500 3504 Új megrendelés - 00905173088 CPTL árajánlat - egyenként 100.exe 84 PID 3504 wrote to memory of 1500 3504 Új megrendelés - 00905173088 CPTL árajánlat - egyenként 100.exe 84 PID 3504 wrote to memory of 1500 3504 Új megrendelés - 00905173088 CPTL árajánlat - egyenként 100.exe 84 PID 3504 wrote to memory of 1500 3504 Új megrendelés - 00905173088 CPTL árajánlat - egyenként 100.exe 84 PID 1500 wrote to memory of 2292 1500 calc.exe 85 PID 1500 wrote to memory of 2292 1500 calc.exe 85 PID 1500 wrote to memory of 2292 1500 calc.exe 85 PID 1500 wrote to memory of 2292 1500 calc.exe 85 PID 1500 wrote to memory of 2292 1500 calc.exe 85 PID 1500 wrote to memory of 2292 1500 calc.exe 85 PID 1500 wrote to memory of 2292 1500 calc.exe 85 PID 1500 wrote to memory of 2292 1500 calc.exe 85 PID 2292 wrote to memory of 1992 2292 iexplore.exe 86 PID 2292 wrote to memory of 1992 2292 iexplore.exe 86 PID 2292 wrote to memory of 1992 2292 iexplore.exe 86 PID 2292 wrote to memory of 1992 2292 iexplore.exe 86 PID 2292 wrote to memory of 1992 2292 iexplore.exe 86 PID 2292 wrote to memory of 1992 2292 iexplore.exe 86 PID 2292 wrote to memory of 1992 2292 iexplore.exe 86 PID 2292 wrote to memory of 1992 2292 iexplore.exe 86 PID 2292 wrote to memory of 1140 2292 iexplore.exe 90 PID 2292 wrote to memory of 1140 2292 iexplore.exe 90 PID 2292 wrote to memory of 1140 2292 iexplore.exe 90 PID 2292 wrote to memory of 1140 2292 iexplore.exe 90 PID 2292 wrote to memory of 1140 2292 iexplore.exe 90 PID 2292 wrote to memory of 1140 2292 iexplore.exe 90 PID 2292 wrote to memory of 1140 2292 iexplore.exe 90 PID 2292 wrote to memory of 1140 2292 iexplore.exe 90 PID 2292 wrote to memory of 2232 2292 iexplore.exe 91 PID 2292 wrote to memory of 2232 2292 iexplore.exe 91 PID 2292 wrote to memory of 2232 2292 iexplore.exe 91 PID 2292 wrote to memory of 2232 2292 iexplore.exe 91 PID 2292 wrote to memory of 2232 2292 iexplore.exe 91 PID 2292 wrote to memory of 2232 2292 iexplore.exe 91 PID 2292 wrote to memory of 2232 2292 iexplore.exe 91 PID 2292 wrote to memory of 2232 2292 iexplore.exe 91 PID 2292 wrote to memory of 2232 2292 iexplore.exe 91 PID 2292 wrote to memory of 2696 2292 iexplore.exe 94 PID 2292 wrote to memory of 2696 2292 iexplore.exe 94 PID 2292 wrote to memory of 2696 2292 iexplore.exe 94 PID 2292 wrote to memory of 2696 2292 iexplore.exe 94 PID 2292 wrote to memory of 2696 2292 iexplore.exe 94 PID 2292 wrote to memory of 2696 2292 iexplore.exe 94 PID 2292 wrote to memory of 2696 2292 iexplore.exe 94 PID 2292 wrote to memory of 2696 2292 iexplore.exe 94 PID 2292 wrote to memory of 2696 2292 iexplore.exe 94 PID 2292 wrote to memory of 3048 2292 iexplore.exe 95 PID 2292 wrote to memory of 3048 2292 iexplore.exe 95 PID 2292 wrote to memory of 3048 2292 iexplore.exe 95 PID 2292 wrote to memory of 3048 2292 iexplore.exe 95 PID 2292 wrote to memory of 3048 2292 iexplore.exe 95 PID 2292 wrote to memory of 3048 2292 iexplore.exe 95 PID 2292 wrote to memory of 3048 2292 iexplore.exe 95 PID 2292 wrote to memory of 3048 2292 iexplore.exe 95 PID 2292 wrote to memory of 3048 2292 iexplore.exe 95 PID 2292 wrote to memory of 1324 2292 iexplore.exe 96 PID 2292 wrote to memory of 1324 2292 iexplore.exe 96 PID 2292 wrote to memory of 1324 2292 iexplore.exe 96 PID 2292 wrote to memory of 1324 2292 iexplore.exe 96 PID 2292 wrote to memory of 1324 2292 iexplore.exe 96 PID 2292 wrote to memory of 1324 2292 iexplore.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\Új megrendelés - 00905173088 CPTL árajánlat - egyenként 100.exe"C:\Users\Admin\AppData\Local\Temp\Új megrendelés - 00905173088 CPTL árajánlat - egyenként 100.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\SysWOW64\calc.exe"C:\Windows\SYSWOW64\calc.exe"2⤵
- UAC bypass
- Windows security bypass
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Windows\SysWOW64\calc.exe3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\A6G228Q5-H8G1-F1T6-U4K6-C1J007E2X0Y8\ykgkuwaup0.txt"4⤵PID:1992
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 845⤵
- Program crash
PID:4048
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\A6G228Q5-H8G1-F1T6-U4K6-C1J007E2X0Y8\ykgkuwaup0.txt"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1140
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\A6G228Q5-H8G1-F1T6-U4K6-C1J007E2X0Y8\ykgkuwaup1.txt"4⤵PID:2232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 1565⤵
- Program crash
PID:2636
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\A6G228Q5-H8G1-F1T6-U4K6-C1J007E2X0Y8\ykgkuwaup1.txt"4⤵
- Accesses Microsoft Outlook accounts
PID:2696
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\A6G228Q5-H8G1-F1T6-U4K6-C1J007E2X0Y8\ykgkuwaup2.txt"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:3048
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\A6G228Q5-H8G1-F1T6-U4K6-C1J007E2X0Y8\ykgkuwaup3.txt"4⤵PID:1324
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 845⤵
- Program crash
PID:1236
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\A6G228Q5-H8G1-F1T6-U4K6-C1J007E2X0Y8\ykgkuwaup3.txt"4⤵PID:2980
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\A6G228Q5-H8G1-F1T6-U4K6-C1J007E2X0Y8\ykgkuwaup4.txt"4⤵PID:1516
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1992 -ip 19921⤵PID:2348
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2232 -ip 22321⤵PID:2908
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1324 -ip 13241⤵PID:3088
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5f94dc819ca773f1e3cb27abbc9e7fa27
SHA19a7700efadc5ea09ab288544ef1e3cd876255086
SHA256a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA51272a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84