Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
08-05-2024 15:27
Static task
static1
Behavioral task
behavioral1
Sample
Comprobante.exe
Resource
win7-20240419-en
General
-
Target
Comprobante.exe
-
Size
180KB
-
MD5
a5825c821946808fb1f3b22645fbfd9d
-
SHA1
d0906a55b742bd11e29c2bf6a87dfe3a6dbd547e
-
SHA256
a340745a55997188efd34c9d83c186de3b899c3b98d05982f327f142deafe790
-
SHA512
a377a82e2f14909f69958874fd62eec318fd67e266415aa8b6a088c230e7d3fa1833cb8d94dcf660a7c5d6e60817369d10a5694f4577f65b30315a9f91f93043
-
SSDEEP
3072:+h9LvhVRMQ8at9vMJdr5QckDMV3HycZg8dZuFyjwUZpVTdlRI:tFaj8mMxHy9yQyjwUZpVTdLI
Malware Config
Extracted
xenorat
dns.requimacofradian.site
Xeno_rat_nd8828g
-
delay
60000
-
install_path
appdata
-
port
1253
-
startup_name
dic
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Comprobante.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Comprobante.exe -
Executes dropped EXE 4 IoCs
Processes:
Comprobante.exeComprobante.exeComprobante.exeComprobante.exepid process 3120 Comprobante.exe 1720 Comprobante.exe 2560 Comprobante.exe 2152 Comprobante.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 6 IoCs
Processes:
Comprobante.exeComprobante.exedescription pid process target process PID 1824 set thread context of 2936 1824 Comprobante.exe Comprobante.exe PID 1824 set thread context of 1752 1824 Comprobante.exe Comprobante.exe PID 1824 set thread context of 5040 1824 Comprobante.exe Comprobante.exe PID 3120 set thread context of 1720 3120 Comprobante.exe Comprobante.exe PID 3120 set thread context of 2560 3120 Comprobante.exe Comprobante.exe PID 3120 set thread context of 2152 3120 Comprobante.exe Comprobante.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Comprobante.exepid process 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe 5040 Comprobante.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Comprobante.exeComprobante.exeComprobante.exedescription pid process Token: SeDebugPrivilege 1824 Comprobante.exe Token: SeDebugPrivilege 3120 Comprobante.exe Token: SeDebugPrivilege 5040 Comprobante.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
Comprobante.exeComprobante.exeComprobante.exeComprobante.exedescription pid process target process PID 1824 wrote to memory of 2936 1824 Comprobante.exe Comprobante.exe PID 1824 wrote to memory of 2936 1824 Comprobante.exe Comprobante.exe PID 1824 wrote to memory of 2936 1824 Comprobante.exe Comprobante.exe PID 1824 wrote to memory of 2936 1824 Comprobante.exe Comprobante.exe PID 1824 wrote to memory of 2936 1824 Comprobante.exe Comprobante.exe PID 1824 wrote to memory of 2936 1824 Comprobante.exe Comprobante.exe PID 1824 wrote to memory of 2936 1824 Comprobante.exe Comprobante.exe PID 1824 wrote to memory of 2936 1824 Comprobante.exe Comprobante.exe PID 1824 wrote to memory of 1752 1824 Comprobante.exe Comprobante.exe PID 1824 wrote to memory of 1752 1824 Comprobante.exe Comprobante.exe PID 1824 wrote to memory of 1752 1824 Comprobante.exe Comprobante.exe PID 1824 wrote to memory of 1752 1824 Comprobante.exe Comprobante.exe PID 1824 wrote to memory of 1752 1824 Comprobante.exe Comprobante.exe PID 1824 wrote to memory of 1752 1824 Comprobante.exe Comprobante.exe PID 1824 wrote to memory of 1752 1824 Comprobante.exe Comprobante.exe PID 1824 wrote to memory of 1752 1824 Comprobante.exe Comprobante.exe PID 1824 wrote to memory of 5040 1824 Comprobante.exe Comprobante.exe PID 1824 wrote to memory of 5040 1824 Comprobante.exe Comprobante.exe PID 1824 wrote to memory of 5040 1824 Comprobante.exe Comprobante.exe PID 1824 wrote to memory of 5040 1824 Comprobante.exe Comprobante.exe PID 1824 wrote to memory of 5040 1824 Comprobante.exe Comprobante.exe PID 1824 wrote to memory of 5040 1824 Comprobante.exe Comprobante.exe PID 1824 wrote to memory of 5040 1824 Comprobante.exe Comprobante.exe PID 1824 wrote to memory of 5040 1824 Comprobante.exe Comprobante.exe PID 1752 wrote to memory of 3120 1752 Comprobante.exe Comprobante.exe PID 1752 wrote to memory of 3120 1752 Comprobante.exe Comprobante.exe PID 1752 wrote to memory of 3120 1752 Comprobante.exe Comprobante.exe PID 3120 wrote to memory of 1720 3120 Comprobante.exe Comprobante.exe PID 3120 wrote to memory of 1720 3120 Comprobante.exe Comprobante.exe PID 3120 wrote to memory of 1720 3120 Comprobante.exe Comprobante.exe PID 3120 wrote to memory of 1720 3120 Comprobante.exe Comprobante.exe PID 3120 wrote to memory of 1720 3120 Comprobante.exe Comprobante.exe PID 3120 wrote to memory of 1720 3120 Comprobante.exe Comprobante.exe PID 3120 wrote to memory of 1720 3120 Comprobante.exe Comprobante.exe PID 3120 wrote to memory of 1720 3120 Comprobante.exe Comprobante.exe PID 3120 wrote to memory of 2560 3120 Comprobante.exe Comprobante.exe PID 3120 wrote to memory of 2560 3120 Comprobante.exe Comprobante.exe PID 3120 wrote to memory of 2560 3120 Comprobante.exe Comprobante.exe PID 3120 wrote to memory of 2560 3120 Comprobante.exe Comprobante.exe PID 3120 wrote to memory of 2560 3120 Comprobante.exe Comprobante.exe PID 3120 wrote to memory of 2560 3120 Comprobante.exe Comprobante.exe PID 3120 wrote to memory of 2560 3120 Comprobante.exe Comprobante.exe PID 3120 wrote to memory of 2560 3120 Comprobante.exe Comprobante.exe PID 3120 wrote to memory of 2152 3120 Comprobante.exe Comprobante.exe PID 3120 wrote to memory of 2152 3120 Comprobante.exe Comprobante.exe PID 3120 wrote to memory of 2152 3120 Comprobante.exe Comprobante.exe PID 3120 wrote to memory of 2152 3120 Comprobante.exe Comprobante.exe PID 3120 wrote to memory of 2152 3120 Comprobante.exe Comprobante.exe PID 3120 wrote to memory of 2152 3120 Comprobante.exe Comprobante.exe PID 3120 wrote to memory of 2152 3120 Comprobante.exe Comprobante.exe PID 3120 wrote to memory of 2152 3120 Comprobante.exe Comprobante.exe PID 5040 wrote to memory of 1560 5040 Comprobante.exe schtasks.exe PID 5040 wrote to memory of 1560 5040 Comprobante.exe schtasks.exe PID 5040 wrote to memory of 1560 5040 Comprobante.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Comprobante.exe"C:\Users\Admin\AppData\Local\Temp\Comprobante.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\Comprobante.exeC:\Users\Admin\AppData\Local\Temp\Comprobante.exe2⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\Comprobante.exeC:\Users\Admin\AppData\Local\Temp\Comprobante.exe2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Roaming\XenoManager\Comprobante.exe"C:\Users\Admin\AppData\Roaming\XenoManager\Comprobante.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Roaming\XenoManager\Comprobante.exeC:\Users\Admin\AppData\Roaming\XenoManager\Comprobante.exe4⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Roaming\XenoManager\Comprobante.exeC:\Users\Admin\AppData\Roaming\XenoManager\Comprobante.exe4⤵
- Executes dropped EXE
PID:2560 -
C:\Users\Admin\AppData\Roaming\XenoManager\Comprobante.exeC:\Users\Admin\AppData\Roaming\XenoManager\Comprobante.exe4⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\Comprobante.exeC:\Users\Admin\AppData\Local\Temp\Comprobante.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "dic" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2C6A.tmp" /F3⤵
- Creates scheduled task(s)
PID:1560
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Comprobante.exe.logFilesize
522B
MD50f39d6b9afc039d81ff31f65cbf76826
SHA18356d04fe7bba2695d59b6caf5c59f58f3e1a6d8
SHA256ea16b63ffd431ebf658b903710b6b3a9b8a2eb6814eee3a53b707a342780315d
SHA5125bad54adb2e32717ef6275f49e2f101dd7e2011c9be14a32e5c29051e8a3f608cbd0b44ac4855ab21e790cb7a5d84c5f69de087074fd01b35259d34d07f5aaf9
-
C:\Users\Admin\AppData\Local\Temp\tmp2C6A.tmpFilesize
1KB
MD58bebc590162576dee61b15d4b1a8e92f
SHA19c6e52f7a46d097a842837a8ea6ba21027f42535
SHA2564c5a48fd2b642faeef01fad4ff1ef01e8e4c63c6d87997a04e46489b3dbb466c
SHA51264a143fe89a53bc349f6624c169231a7673bd7798abf74b30fdc89ebd0f4b95859173e06b18a402ad72eea5ca2f6408c396f0be4a60b0dfc15f32cbd4fe6ec6a
-
C:\Users\Admin\AppData\Roaming\XenoManager\Comprobante.exeFilesize
180KB
MD5a5825c821946808fb1f3b22645fbfd9d
SHA1d0906a55b742bd11e29c2bf6a87dfe3a6dbd547e
SHA256a340745a55997188efd34c9d83c186de3b899c3b98d05982f327f142deafe790
SHA512a377a82e2f14909f69958874fd62eec318fd67e266415aa8b6a088c230e7d3fa1833cb8d94dcf660a7c5d6e60817369d10a5694f4577f65b30315a9f91f93043
-
memory/1752-29-0x0000000074F40000-0x00000000756F0000-memory.dmpFilesize
7.7MB
-
memory/1752-14-0x0000000074F40000-0x00000000756F0000-memory.dmpFilesize
7.7MB
-
memory/1824-1-0x00000000004F0000-0x0000000000526000-memory.dmpFilesize
216KB
-
memory/1824-2-0x0000000004E20000-0x0000000004E44000-memory.dmpFilesize
144KB
-
memory/1824-3-0x0000000004F50000-0x0000000004FEC000-memory.dmpFilesize
624KB
-
memory/1824-4-0x0000000074F40000-0x00000000756F0000-memory.dmpFilesize
7.7MB
-
memory/1824-0-0x0000000074F4E000-0x0000000074F4F000-memory.dmpFilesize
4KB
-
memory/1824-15-0x0000000074F40000-0x00000000756F0000-memory.dmpFilesize
7.7MB
-
memory/2936-10-0x0000000074F40000-0x00000000756F0000-memory.dmpFilesize
7.7MB
-
memory/2936-13-0x0000000074F40000-0x00000000756F0000-memory.dmpFilesize
7.7MB
-
memory/2936-5-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3120-30-0x0000000000A70000-0x0000000000A94000-memory.dmpFilesize
144KB
-
memory/5040-18-0x0000000074F40000-0x00000000756F0000-memory.dmpFilesize
7.7MB
-
memory/5040-38-0x0000000074F40000-0x00000000756F0000-memory.dmpFilesize
7.7MB
-
memory/5040-16-0x0000000074F40000-0x00000000756F0000-memory.dmpFilesize
7.7MB
-
memory/5040-41-0x00000000060E0000-0x0000000006146000-memory.dmpFilesize
408KB
-
memory/5040-42-0x0000000006350000-0x000000000644A000-memory.dmpFilesize
1000KB
-
memory/5040-43-0x0000000006620000-0x00000000067E2000-memory.dmpFilesize
1.8MB
-
memory/5040-44-0x00000000064D0000-0x0000000006546000-memory.dmpFilesize
472KB
-
memory/5040-45-0x0000000006550000-0x00000000065A0000-memory.dmpFilesize
320KB
-
memory/5040-46-0x0000000006D20000-0x000000000724C000-memory.dmpFilesize
5.2MB
-
memory/5040-47-0x00000000068F0000-0x000000000690E000-memory.dmpFilesize
120KB