Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15-03-2024 22:12
Behavioral task
behavioral1
Sample
DLLRestoration_V2.exe
Resource
win7-20240221-en
General
-
Target
DLLRestoration_V2.exe
-
Size
45KB
-
MD5
38b365866e8a51056647e64c32bcd64e
-
SHA1
894e0286e2e21dc448eb916ffa8e2bbfaf068355
-
SHA256
58286c66f3f0a8333f52c72eeddca15a7622ba072aee9b9957e5ba6214ecdf02
-
SHA512
92ce606aa6ac5ed3c3569fdbf3496317cab2a3d13cf339dc63b51b0f511f2d7e29855c4d7bcb32c3227d9ffabec5f9a471e89338b2ac448c9756470439c140ca
-
SSDEEP
768:5dhO/poiiUcjlJInyJH9Xqk5nWEZ5SbTDaeWI7CPW5l:3w+jjgnyH9XqcnW85SbTXWId
Malware Config
Extracted
xenorat
192.168.86.56
Xeno_rat_nd8912d
-
delay
5000
-
install_path
appdata
-
port
4444
-
startup_name
FortniteRuntime.exe
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation DLLRestoration_V2.exe -
Executes dropped EXE 1 IoCs
pid Process 1564 DLLRestoration_V2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 428 schtasks.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3212 wrote to memory of 1564 3212 DLLRestoration_V2.exe 92 PID 3212 wrote to memory of 1564 3212 DLLRestoration_V2.exe 92 PID 3212 wrote to memory of 1564 3212 DLLRestoration_V2.exe 92 PID 1564 wrote to memory of 428 1564 DLLRestoration_V2.exe 95 PID 1564 wrote to memory of 428 1564 DLLRestoration_V2.exe 95 PID 1564 wrote to memory of 428 1564 DLLRestoration_V2.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\DLLRestoration_V2.exe"C:\Users\Admin\AppData\Local\Temp\DLLRestoration_V2.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Roaming\XenoManager\DLLRestoration_V2.exe"C:\Users\Admin\AppData\Roaming\XenoManager\DLLRestoration_V2.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "FortniteRuntime.exe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7F03.tmp" /F3⤵
- Creates scheduled task(s)
PID:428
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54cf4503dfc2237d62eade38bc45963d5
SHA15587f68085e30a7ca893b75855df95a2f2018154
SHA256e1be0c18b4d44c0a15205f19fa1a84e39efbdacdc68563458c3b63a730a8b540
SHA5123f8cb093f419bd492c8695231572f7688747898aa4362824d36d958b1157476cb481c8f08a899a473c565ee25a6582fd533697aa66037138985b477685afd7a7
-
Filesize
45KB
MD538b365866e8a51056647e64c32bcd64e
SHA1894e0286e2e21dc448eb916ffa8e2bbfaf068355
SHA25658286c66f3f0a8333f52c72eeddca15a7622ba072aee9b9957e5ba6214ecdf02
SHA51292ce606aa6ac5ed3c3569fdbf3496317cab2a3d13cf339dc63b51b0f511f2d7e29855c4d7bcb32c3227d9ffabec5f9a471e89338b2ac448c9756470439c140ca