Analysis
- max time kernel
148s - max time network
146s - platform
windows10_x64 - resource
win10v200430 - submitted
02/07/2020, 07:19
Static task
static1
Behavioral task
behavioral1
Sample
Xenos new order.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Xenos new order.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target Xenos new order.exe
- Size 353KB
- Sample200702-rtetxdtvn6
- SHA256 d4943254bdebb92508362f26bd91da77d2aaecbcd73f086b917055c704a993a5
- MD5 c860722d07e03cb4693e85f408515319
- SHA1 79017084cdd25f211aba8f156f4b49dbe1603e4f
- SHA512 545bd18725dbfe5c733fdc30ca14a3ef009a782ae3cb36724743a3f2208f9b4a7bf5c58e5080156cf6b657b8b11954e97efe08daaed1e2bff2e19e5fdff0fd3b
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3944 set thread context of 2728 3944 Xenos new order.exe 74 PID 2728 set thread context of 2988 2728 Xenos new order.exe 56 PID 3440 set thread context of 2988 3440 cscript.exe 56 - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 2728 Xenos new order.exe Token: SeDebugPrivilege 3440 cscript.exe Token: SeShutdownPrivilege 2988 Explorer.EXE Token: SeCreatePagefilePrivilege 2988 Explorer.EXE Token: SeShutdownPrivilege 2988 Explorer.EXE Token: SeCreatePagefilePrivilege 2988 Explorer.EXE Token: SeShutdownPrivilege 2988 Explorer.EXE Token: SeCreatePagefilePrivilege 2988 Explorer.EXE Token: SeShutdownPrivilege 2988 Explorer.EXE Token: SeCreatePagefilePrivilege 2988 Explorer.EXE - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 2728 Xenos new order.exe 2728 Xenos new order.exe 2728 Xenos new order.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2092 schtasks.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Gjpn\taskhostzlsdlps0.exe cscript.exe -
description ioc Process Key created \Registry\User\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cscript.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3944 wrote to memory of 2092 3944 Xenos new order.exe 72 PID 3944 wrote to memory of 2092 3944 Xenos new order.exe 72 PID 3944 wrote to memory of 2092 3944 Xenos new order.exe 72 PID 3944 wrote to memory of 2728 3944 Xenos new order.exe 74 PID 3944 wrote to memory of 2728 3944 Xenos new order.exe 74 PID 3944 wrote to memory of 2728 3944 Xenos new order.exe 74 PID 3944 wrote to memory of 2728 3944 Xenos new order.exe 74 PID 3944 wrote to memory of 2728 3944 Xenos new order.exe 74 PID 3944 wrote to memory of 2728 3944 Xenos new order.exe 74 PID 2988 wrote to memory of 3440 2988 Explorer.EXE 75 PID 2988 wrote to memory of 3440 2988 Explorer.EXE 75 PID 2988 wrote to memory of 3440 2988 Explorer.EXE 75 PID 3440 wrote to memory of 3872 3440 cscript.exe 76 PID 3440 wrote to memory of 3872 3440 cscript.exe 76 PID 3440 wrote to memory of 3872 3440 cscript.exe 76 PID 3440 wrote to memory of 3824 3440 cscript.exe 78 PID 3440 wrote to memory of 3824 3440 cscript.exe 78 PID 3440 wrote to memory of 3824 3440 cscript.exe 78 PID 3440 wrote to memory of 3512 3440 cscript.exe 80 PID 3440 wrote to memory of 3512 3440 cscript.exe 80 PID 3440 wrote to memory of 3512 3440 cscript.exe 80 - Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run cscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0Z7DDPT0VV_ = "C:\\Program Files (x86)\\Gjpn\\taskhostzlsdlps0.exe" cscript.exe - Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 2728 Xenos new order.exe 2728 Xenos new order.exe 2728 Xenos new order.exe 2728 Xenos new order.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe 3440 cscript.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\Xenos new order.exe"C:\Users\Admin\AppData\Local\Temp\Xenos new order.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ikKQWkhwOsN" /XML "C:\Users\Admin\AppData\Local\Temp\tmp454C.tmp"3⤵
- Creates scheduled task(s)
PID:2092
-
-
C:\Users\Admin\AppData\Local\Temp\Xenos new order.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
PID:2728
-
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Adds Run entry to start application
- Suspicious behavior: EnumeratesProcesses
PID:3440 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Xenos new order.exe"3⤵PID:3872
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3824
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:3512
-
-