Analysis
-
max time kernel
38s -
max time network
29s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
-
submitted
24-04-2024 21:16
Errors
General
-
Target
EchoLogger.exe
-
Size
5.6MB
-
MD5
0b1f4455971b59cd0943b78ac80d1f95
-
SHA1
54da81385d5d67bfb925ddd7b5dbf2bae923cce5
-
SHA256
80b98aa859cff943bece9831f7de94656292ff5147db30a9e315ee30553425c2
-
SHA512
5805d67ab91d32d203433a299943bfde35a65945ebb7861b770c4a00a9adfd3938c6c347e7a1eb120de9240edd2452a0b8d1af9664ff0d6f50cbb4e5ed042c5f
-
SSDEEP
98304:Y9r1U+si7I0QgV8uPYo/FrjoYPLCr2P5+yvNAyAkkYgGquVIia2kJb8WG9sE68gB:aSUIsV8uASFrjjW0+aAukqZ24zgRm2u2
Malware Config
Extracted
xenorat
jctestwindows.airdns.org
Xeno_rat_nd8912d
-
delay
5000
-
install_path
appdata
-
port
45010
-
startup_name
ErrorManager
Signatures
-
Detect ZGRat V1 34 IoCs
-
XenorRat
XenorRat is a remote access trojan written in C#.
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Executes dropped EXE 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious behavior: LoadsDriver 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\EchoLogger.exe"C:\Users\Admin\AppData\Local\Temp\EchoLogger.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHcAcwBwACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHYAawB2ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG0AYgBlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHUAcgB5ACMAPgA="2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe"C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe"C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\WindowsSubsystem.exe"C:\Users\Admin\AppData\Local\Temp\WindowsSubsystem.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XenoManager\WindowsSubsystem.exe"C:\Users\Admin\AppData\Roaming\XenoManager\WindowsSubsystem.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "ErrorManager" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCD72.tmp" /F4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
191KB
MD5e004a568b841c74855f1a8a5d43096c7
SHA1b90fd74593ae9b5a48cb165b6d7602507e1aeca4
SHA256d49013d6be0f0e727c0b53bce1d3fed00656c7a2836ceef0a9d4cb816a5878db
SHA512402dd4d4c57fb6f5c7a531b7210a897dfe41d68df99ae4d605944f6e5b2cecaafa3fe27562fe45e7e216a7c9e29e63139d4382310b41f04a35ad56115fbed2af
-
Filesize
5.0MB
MD5e222309197c5e633aa8e294ba4bdcd29
SHA152b3f89a3d2262bf603628093f6d1e71d9cc3820
SHA256047a7ca1b8848c1c0e3c0fcc6ece056390760b24580f27f6966b86b0c2a1042b
SHA5129eb37686e0cee9ec18d12a4edd37c8334d26650c74eae5b30231c2b0db1628d52848123c9348c3da306ec950b827ec0a56cdf43ee325a9e280022c68193d8503
-
Filesize
43KB
MD56b44f7785d4ce45ede1b02681227d987
SHA1444d76fb81d4fbeb9c1a2011d2de8f2b8ff0084a
SHA2562c85b511ff201346d1e6c2ab300445ad263ed40192c1748ec10fa02f6aa05186
SHA51283f96b49bf619aa8fd89a7fb7be282d7a06e6ae0dd8f42ef8ad9e1832a889d9dc3b8920989cea5fbecfec63dd894f49d5ad1d2d25894de7b523add0539d1de55
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD50cd3da1799bc79141a8e8b219f395b48
SHA153d117d84f3ba1066b59720965e25a84792439a5
SHA2568bb355c414170a13cc47f16128844bac5089e9c845f7d07d4d098579b7c152d6
SHA512686ef43213a06ba50e3b78c1f84782cbc2e8a87f97c297addf8bea5d78346420fd143dd7d4aa7f95a7827c2db4fd27c15cfec44fef6e700351cff887afc8e536
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
104KB
-
Filesize
6.5MB
-
Filesize
7.7MB
-
Filesize
84KB
-
Filesize
56KB
-
Filesize
68KB
-
Filesize
64KB
-
Filesize
600KB
-
Filesize
40KB
-
Filesize
304KB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
104KB
-
Filesize
6.2MB
-
Filesize
216KB
-
Filesize
656KB
-
Filesize
408KB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
208KB
-
Filesize
32KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
216KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
64KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
7.7MB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
432KB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
7.7MB