Overview

overview

10

Static

static

3

6962527d9a...18.exe

windows7-x64

10

6962527d9a...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    136s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/05/2024, 02:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    6962527d9ac313319bd2b87cd12ab32c_JaffaCakes118.exe
  • Size 1.1MB
  • Sample240523-cgx12aaa34
  • SHA256 e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xpertratkaffyvirusevasionpersistencerattrojan

Malware Config

Extracted

Family

  • xpertrat

Version

  • 3.0.10

Botnet

  • kaffyvirus

C2

  • 84.38.134.115:1234

Mutex

  • B2H6Y3K0-Y7X5-B5F3-N3W1-K4A558N0M337

Signatures

  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 1 IoCs
    evasiontrojan
  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat
  • XpertRAT Core payload 1 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\6962527d9ac313319bd2b87cd12ab32c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6962527d9ac313319bd2b87cd12ab32c_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4432
    • C:\Users\Admin\AppData\Local\Temp\6962527d9ac313319bd2b87cd12ab32c_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\6962527d9ac313319bd2b87cd12ab32c_JaffaCakes118.exe"
      2⤵
      • Checks computer location settings
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4280
      • C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exe
        "C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2900
        • C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exe
          "C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3712
          • C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exe
            "C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exe"
            5⤵
            • UAC bypass
            • Windows security bypass
            • Executes dropped EXE
            • Windows security modification
            • Checks whether UAC is enabled
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:928
            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
              C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exe
              6⤵
              • Adds policy Run key to start application
              • Adds Run key to start application
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:5044

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        frm_QANATS.exe
        • Path C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exe
        • Size 1.1MB
        • SHA256 4fde57eb8070711e8e30fe34ab1a1bf785f40a38d2fcb6468c2266f9b6e4cd2e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        win.ini
        • Path C:\Windows\win.ini
        • Size 123B
        • SHA256 6e2b70dfccabf3cc651545676a3a566c9cfae03f15f772886646abce1da35b46
        • MD5 SHA1 SHA512
        Submit Download

        memory/928-37-0x0000000000400000-0x000000000042C000-memory.dmp
        Download

        memory/928-39-0x0000000000400000-0x000000000042C000-memory.dmp
        Download

        memory/928-49-0x0000000000400000-0x000000000042C000-memory.dmp
        Download

        memory/4280-14-0x0000000000560000-0x0000000000660000-memory.dmp
        Download

        memory/4280-15-0x0000000002D20000-0x0000000002E20000-memory.dmp
        Download

        memory/4432-3-0x0000000000700000-0x0000000000800000-memory.dmp
        Download

        memory/4432-5-0x0000000002D40000-0x0000000002E40000-memory.dmp
        Download

        memory/4432-6-0x0000000077A61000-0x0000000077B81000-memory.dmp
        Download

        memory/4432-51-0x0000000077A61000-0x0000000077B81000-memory.dmp
        Download

        memory/5044-42-0x0000000000400000-0x0000000000443000-memory.dmp
        Download