Analysis
- max time kernel
150s - max time network
118s - platform
windows7_x64 - resource
win7 - submitted
02/07/2020, 07:19
Static task
static1
Behavioral task
behavioral1
Sample
Xenos new order.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Xenos new order.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target Xenos new order.exe
- Size 353KB
- Sample200702-rtetxdtvn6
- SHA256 d4943254bdebb92508362f26bd91da77d2aaecbcd73f086b917055c704a993a5
- MD5 c860722d07e03cb4693e85f408515319
- SHA1 79017084cdd25f211aba8f156f4b49dbe1603e4f
- SHA512 545bd18725dbfe5c733fdc30ca14a3ef009a782ae3cb36724743a3f2208f9b4a7bf5c58e5080156cf6b657b8b11954e97efe08daaed1e2bff2e19e5fdff0fd3b
- MD5 SHA1 SHA512
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 796 Xenos new order.exe 796 Xenos new order.exe 536 ipconfig.exe 536 ipconfig.exe 536 ipconfig.exe 536 ipconfig.exe 536 ipconfig.exe 536 ipconfig.exe 536 ipconfig.exe 536 ipconfig.exe 536 ipconfig.exe 536 ipconfig.exe 536 ipconfig.exe 536 ipconfig.exe 536 ipconfig.exe 536 ipconfig.exe 536 ipconfig.exe 536 ipconfig.exe 536 ipconfig.exe 536 ipconfig.exe 536 ipconfig.exe 536 ipconfig.exe 536 ipconfig.exe 536 ipconfig.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 796 Xenos new order.exe Token: SeDebugPrivilege 536 ipconfig.exe - Deletes itself 1 IoCs
pid Process 1668 cmd.exe - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1336 Explorer.EXE 1336 Explorer.EXE 1336 Explorer.EXE 1336 Explorer.EXE - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1484 schtasks.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 900 wrote to memory of 1484 900 Xenos new order.exe 24 PID 900 wrote to memory of 1484 900 Xenos new order.exe 24 PID 900 wrote to memory of 1484 900 Xenos new order.exe 24 PID 900 wrote to memory of 1484 900 Xenos new order.exe 24 PID 900 wrote to memory of 796 900 Xenos new order.exe 26 PID 900 wrote to memory of 796 900 Xenos new order.exe 26 PID 900 wrote to memory of 796 900 Xenos new order.exe 26 PID 900 wrote to memory of 796 900 Xenos new order.exe 26 PID 900 wrote to memory of 796 900 Xenos new order.exe 26 PID 900 wrote to memory of 796 900 Xenos new order.exe 26 PID 900 wrote to memory of 796 900 Xenos new order.exe 26 PID 1336 wrote to memory of 536 1336 Explorer.EXE 27 PID 1336 wrote to memory of 536 1336 Explorer.EXE 27 PID 1336 wrote to memory of 536 1336 Explorer.EXE 27 PID 1336 wrote to memory of 536 1336 Explorer.EXE 27 PID 536 wrote to memory of 1668 536 ipconfig.exe 28 PID 536 wrote to memory of 1668 536 ipconfig.exe 28 PID 536 wrote to memory of 1668 536 ipconfig.exe 28 PID 536 wrote to memory of 1668 536 ipconfig.exe 28 - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 900 set thread context of 796 900 Xenos new order.exe 26 PID 796 set thread context of 1336 796 Xenos new order.exe 20 PID 536 set thread context of 1336 536 ipconfig.exe 20 - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 796 Xenos new order.exe 796 Xenos new order.exe 796 Xenos new order.exe 536 ipconfig.exe 536 ipconfig.exe - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1336 Explorer.EXE 1336 Explorer.EXE 1336 Explorer.EXE 1336 Explorer.EXE 1336 Explorer.EXE -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
- Checks whether UAC is enabled
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\Xenos new order.exe"C:\Users\Admin\AppData\Local\Temp\Xenos new order.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:900 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ikKQWkhwOsN" /XML "C:\Users\Admin\AppData\Local\Temp\tmp930B.tmp"3⤵
- Creates scheduled task(s)
PID:1484
-
-
C:\Users\Admin\AppData\Local\Temp\Xenos new order.exe"{path}"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:796
-
-
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:536 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Xenos new order.exe"3⤵
- Deletes itself
PID:1668
-
-