Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2024 04:18
Behavioral task
behavioral1
Sample
Zeno.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
Zeno.exe
-
Size
45KB
-
MD5
2d24883f3fb3ff9ea58f372da291070a
-
SHA1
d2fdd563387cfaaabaa681297a49f26a7ce43d0f
-
SHA256
8fd932b34f74af94e07d3b2ed14b8a3630a30f3c19ebe987fead0e63ae2a4a9b
-
SHA512
6ee0cbe3da9d2d88ce3269c56009217408ea6e73641f4b691b17a2903a2532347ce3666439ece77f7d868d3daa5028133dfd27f4a4beb6024e97e5ac5c32279e
-
SSDEEP
768:SdhO/poiiUcjlJIn/sWH9Xqk5nWEZ5SbTDauuI7CPW5h:0w+jjgnPH9XqcnW85SbTDuIp
Malware Config
Extracted
Family
xenorat
C2
127.0.0.1
Mutex
XenoLauncher
Attributes
-
delay
5000
-
install_path
temp
-
port
4444
-
startup_name
Discord
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation Zeno.exe -
Executes dropped EXE 1 IoCs
pid Process 720 Zeno.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2708 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5352 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 5352 taskmgr.exe Token: SeSystemProfilePrivilege 5352 taskmgr.exe Token: SeCreateGlobalPrivilege 5352 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe 5352 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1548 wrote to memory of 720 1548 Zeno.exe 98 PID 1548 wrote to memory of 720 1548 Zeno.exe 98 PID 1548 wrote to memory of 720 1548 Zeno.exe 98 PID 720 wrote to memory of 2708 720 Zeno.exe 100 PID 720 wrote to memory of 2708 720 Zeno.exe 100 PID 720 wrote to memory of 2708 720 Zeno.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\Zeno.exe"C:\Users\Admin\AppData\Local\Temp\Zeno.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\XenoManager\Zeno.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\Zeno.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "Discord" /XML "C:\Users\Admin\AppData\Local\Temp\tmp150A.tmp" /F3⤵
- Creates scheduled task(s)
PID:2708
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5352
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:81⤵PID:5640
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD52d24883f3fb3ff9ea58f372da291070a
SHA1d2fdd563387cfaaabaa681297a49f26a7ce43d0f
SHA2568fd932b34f74af94e07d3b2ed14b8a3630a30f3c19ebe987fead0e63ae2a4a9b
SHA5126ee0cbe3da9d2d88ce3269c56009217408ea6e73641f4b691b17a2903a2532347ce3666439ece77f7d868d3daa5028133dfd27f4a4beb6024e97e5ac5c32279e
-
Filesize
1KB
MD5152c9c9c556d3ac021e88ca5ac9e988b
SHA18566be5c00d3aed9606fcf1f352a16ea5fbb3ad5
SHA256dc6e9c610ff9837366a73f15e9ab1333fd46f86fc7d3da47339eaf8ed18c11b8
SHA512a9310a94c7b72323aa4053db5f39595cfdb0279da6b08adc0f6214cd182290101a6df7159c60b7ec018b6aa8f8ced499be563ed98b4fe006466b41054dddd757