Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2024 09:28
Behavioral task
behavioral1
Sample
0x000700000002327c-112.exe
Resource
win7-20240220-en
General
-
Target
0x000700000002327c-112.exe
-
Size
45KB
-
MD5
838b98ebbd662c0f4e5cc5cbcafa2cfa
-
SHA1
58ff94e92c2548f87a9284a0ac5cea0d472309e0
-
SHA256
5649336f36c1479f2b2a499a7555743579c4d0ec64ffdaf41c8d8090ae94964a
-
SHA512
a4505475953c0bb5614bc0468defdc550401e758230d8b9c65332aed2f07a7f31ba968d462718a6bf2de825903d84203946e8c085edceb6148fae88b1a48233c
-
SSDEEP
768:ZdhO/poiiUcjlJInyHqH9Xqk5nWEZ5SbTDadWI7CPW5Q:Xw+jjgnVH9XqcnW85SbTEWI4
Malware Config
Extracted
xenorat
puredgb.duckdns.org
Xeno_rat_nd8912d
-
delay
5000
-
install_path
appdata
-
port
4444
-
startup_name
Fobus.exe
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0x000700000002327c-112.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation 0x000700000002327c-112.exe -
Executes dropped EXE 1 IoCs
Processes:
0x000700000002327c-112.exepid process 4680 0x000700000002327c-112.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0x000700000002327c-112.exepid process 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe 4680 0x000700000002327c-112.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
0x000700000002327c-112.exedescription pid process Token: SeDebugPrivilege 4680 0x000700000002327c-112.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
0x000700000002327c-112.exepid process 4680 0x000700000002327c-112.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
0x000700000002327c-112.exe0x000700000002327c-112.exedescription pid process target process PID 3212 wrote to memory of 4680 3212 0x000700000002327c-112.exe 0x000700000002327c-112.exe PID 3212 wrote to memory of 4680 3212 0x000700000002327c-112.exe 0x000700000002327c-112.exe PID 3212 wrote to memory of 4680 3212 0x000700000002327c-112.exe 0x000700000002327c-112.exe PID 4680 wrote to memory of 3176 4680 0x000700000002327c-112.exe schtasks.exe PID 4680 wrote to memory of 3176 4680 0x000700000002327c-112.exe schtasks.exe PID 4680 wrote to memory of 3176 4680 0x000700000002327c-112.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0x000700000002327c-112.exe"C:\Users\Admin\AppData\Local\Temp\0x000700000002327c-112.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Roaming\XenoManager\0x000700000002327c-112.exe"C:\Users\Admin\AppData\Roaming\XenoManager\0x000700000002327c-112.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "Fobus.exe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4A19.tmp" /F3⤵
- Creates scheduled task(s)
PID:3176
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4A19.tmpFilesize
1KB
MD58a6874238bd731c08d8b6ccc32efd9db
SHA16995531c5fecf8a03a165b1538e7106838e0dfc6
SHA256d866249249d6df920205d3ca40001211eef0f7d76a305a0950d7cb44fa8046b3
SHA512faa34c78f921884484922cd6cebbcda213dc1cc1dd0f6c70a922f0934008a0370d76fd1959f14956e777477e828cffc857850406e28b692a7cf955fa98d44aba
-
C:\Users\Admin\AppData\Roaming\XenoManager\0x000700000002327c-112.exeFilesize
45KB
MD5838b98ebbd662c0f4e5cc5cbcafa2cfa
SHA158ff94e92c2548f87a9284a0ac5cea0d472309e0
SHA2565649336f36c1479f2b2a499a7555743579c4d0ec64ffdaf41c8d8090ae94964a
SHA512a4505475953c0bb5614bc0468defdc550401e758230d8b9c65332aed2f07a7f31ba968d462718a6bf2de825903d84203946e8c085edceb6148fae88b1a48233c
-
memory/3212-1-0x0000000074B80000-0x0000000075330000-memory.dmpFilesize
7.7MB
-
memory/3212-0-0x00000000004C0000-0x00000000004D2000-memory.dmpFilesize
72KB
-
memory/3212-15-0x0000000074B80000-0x0000000075330000-memory.dmpFilesize
7.7MB
-
memory/4680-14-0x0000000074B80000-0x0000000075330000-memory.dmpFilesize
7.7MB
-
memory/4680-16-0x0000000004F00000-0x0000000004F10000-memory.dmpFilesize
64KB
-
memory/4680-19-0x0000000005A20000-0x0000000005A86000-memory.dmpFilesize
408KB
-
memory/4680-20-0x00000000059D0000-0x00000000059DC000-memory.dmpFilesize
48KB
-
memory/4680-21-0x00000000063C0000-0x0000000006964000-memory.dmpFilesize
5.6MB
-
memory/4680-22-0x0000000005EF0000-0x0000000005F82000-memory.dmpFilesize
584KB
-
memory/4680-23-0x0000000006080000-0x000000000608A000-memory.dmpFilesize
40KB
-
memory/4680-24-0x0000000074B80000-0x0000000075330000-memory.dmpFilesize
7.7MB
-
memory/4680-25-0x0000000004F00000-0x0000000004F10000-memory.dmpFilesize
64KB