Analysis
-
max time kernel
40s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13-05-2024 15:03
Behavioral task
behavioral1
Sample
stub2.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
stub2.exe
Resource
win7-20240508-en
Errors
General
-
Target
stub2.exe
-
Size
45KB
-
MD5
375395b1fb6017ba3c4af4f1317ef7c3
-
SHA1
109e31925a757348ca517eb69cb129d1b471d16e
-
SHA256
8de191bee3f6ca50411f20a46b2bd1170d4a7a012bdbed151f2854dd7f1afdc8
-
SHA512
bbfcf92f9570660e16d1d93f714368822ee5823eb8314ac102568b7f10fcbaa4033aa786a4bc329cbfd64b7e9b8a91f56cb472eff78882eade0306c8b65d3bf0
-
SSDEEP
768:9dhO/poiiUcjlJInfYH9Xqk5nWEZ5SbTDa1uI7CPW5s:zw+jjgnwH9XqcnW85SbTIuI0
Malware Config
Extracted
xenorat
himekosworld-37849.portmap.host
Xeno_rat_nd8912d
-
delay
5000
-
install_path
temp
-
port
37849
-
startup_name
nothingset
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
stub2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation stub2.exe -
Executes dropped EXE 1 IoCs
Processes:
stub2.exepid process 4844 stub2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 36 IoCs
Processes:
stub2.exepid process 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe 4844 stub2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
stub2.exedescription pid process Token: SeDebugPrivilege 4844 stub2.exe Token: SeShutdownPrivilege 4844 stub2.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
stub2.exedescription pid process target process PID 2652 wrote to memory of 4844 2652 stub2.exe stub2.exe PID 2652 wrote to memory of 4844 2652 stub2.exe stub2.exe PID 2652 wrote to memory of 4844 2652 stub2.exe stub2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\stub2.exe"C:\Users\Admin\AppData\Local\Temp\stub2.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\stub2.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\stub2.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\stub2.exe.logFilesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\stub2.exeFilesize
45KB
MD5375395b1fb6017ba3c4af4f1317ef7c3
SHA1109e31925a757348ca517eb69cb129d1b471d16e
SHA2568de191bee3f6ca50411f20a46b2bd1170d4a7a012bdbed151f2854dd7f1afdc8
SHA512bbfcf92f9570660e16d1d93f714368822ee5823eb8314ac102568b7f10fcbaa4033aa786a4bc329cbfd64b7e9b8a91f56cb472eff78882eade0306c8b65d3bf0
-
memory/2652-0-0x0000000074A2E000-0x0000000074A2F000-memory.dmpFilesize
4KB
-
memory/2652-1-0x0000000000E30000-0x0000000000E42000-memory.dmpFilesize
72KB
-
memory/4844-15-0x0000000074A20000-0x00000000751D0000-memory.dmpFilesize
7.7MB
-
memory/4844-16-0x0000000005DB0000-0x0000000005E16000-memory.dmpFilesize
408KB
-
memory/4844-17-0x0000000074A20000-0x00000000751D0000-memory.dmpFilesize
7.7MB
-
memory/4844-18-0x0000000074A20000-0x00000000751D0000-memory.dmpFilesize
7.7MB
-
memory/4844-19-0x0000000006020000-0x000000000602A000-memory.dmpFilesize
40KB
-
memory/4844-20-0x00000000065F0000-0x0000000006B94000-memory.dmpFilesize
5.6MB