Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
13-05-2024 18:39
Behavioral task
behavioral1
Sample
12.exe
Resource
win7-20240215-en
General
-
Target
12.exe
-
Size
45KB
-
MD5
e495926b851b044d702e8ca3792e8997
-
SHA1
8998457297aa42ca53ff2c5118b3721b184108ec
-
SHA256
c79572263f72b42dc7e7fef376c32b3cc33cf5f543373e7896d5e81cef0911ff
-
SHA512
09bb2a11f639dd1ecb51c71117d6fbad736e70a6ce92e1316cf92a6a8288dc0ef1364d14cbb050fdb39725f3154d5dc425392249c43476eec1d06879942c815a
-
SSDEEP
768:BdhO/poiiUcjlJInwr6BH9Xqk5nWEZ5SbTDaUuI7CPW5Q:/w+jjgndH9XqcnW85SbThuI4
Malware Config
Extracted
xenorat
7.tcp.eu.ngrok.io
radnom123_34X41
-
delay
5000
-
install_path
appdata
-
port
19280
-
startup_name
window system
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
12.exepid process 3060 12.exe -
Loads dropped DLL 1 IoCs
Processes:
12.exepid process 2352 12.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
12.exepid process 3060 12.exe 3060 12.exe 3060 12.exe 3060 12.exe 3060 12.exe 3060 12.exe 3060 12.exe 3060 12.exe 3060 12.exe 3060 12.exe 3060 12.exe 3060 12.exe 3060 12.exe 3060 12.exe 3060 12.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
12.exedescription pid process Token: SeDebugPrivilege 3060 12.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
12.exe12.execmd.exedescription pid process target process PID 2352 wrote to memory of 3060 2352 12.exe 12.exe PID 2352 wrote to memory of 3060 2352 12.exe 12.exe PID 2352 wrote to memory of 3060 2352 12.exe 12.exe PID 2352 wrote to memory of 3060 2352 12.exe 12.exe PID 3060 wrote to memory of 2548 3060 12.exe schtasks.exe PID 3060 wrote to memory of 2548 3060 12.exe schtasks.exe PID 3060 wrote to memory of 2548 3060 12.exe schtasks.exe PID 3060 wrote to memory of 2548 3060 12.exe schtasks.exe PID 3060 wrote to memory of 1940 3060 12.exe schtasks.exe PID 3060 wrote to memory of 1940 3060 12.exe schtasks.exe PID 3060 wrote to memory of 1940 3060 12.exe schtasks.exe PID 3060 wrote to memory of 1940 3060 12.exe schtasks.exe PID 3060 wrote to memory of 2424 3060 12.exe schtasks.exe PID 3060 wrote to memory of 2424 3060 12.exe schtasks.exe PID 3060 wrote to memory of 2424 3060 12.exe schtasks.exe PID 3060 wrote to memory of 2424 3060 12.exe schtasks.exe PID 3060 wrote to memory of 2500 3060 12.exe cmd.exe PID 3060 wrote to memory of 2500 3060 12.exe cmd.exe PID 3060 wrote to memory of 2500 3060 12.exe cmd.exe PID 3060 wrote to memory of 2500 3060 12.exe cmd.exe PID 2500 wrote to memory of 2472 2500 cmd.exe choice.exe PID 2500 wrote to memory of 2472 2500 cmd.exe choice.exe PID 2500 wrote to memory of 2472 2500 cmd.exe choice.exe PID 2500 wrote to memory of 2472 2500 cmd.exe choice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\12.exe"C:\Users\Admin\AppData\Local\Temp\12.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Roaming\XenoManager\12.exe"C:\Users\Admin\AppData\Roaming\XenoManager\12.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "window system" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2665.tmp" /F3⤵
- Creates scheduled task(s)
PID:2548 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /query /v /fo csv3⤵PID:1940
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /delete /tn "\window system" /f3⤵PID:2424
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\XenoManager\12.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 34⤵PID:2472
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp2665.tmpFilesize
1KB
MD5bad6890e2faac7e06d93f5020ce4ba18
SHA10b47d1629d1ec0dcda62f7fabf4485b7625e4bf9
SHA256a6be7e1850527f0bf2629be8850563fc8cd2b1cd1b51805663fc6cd8ec5f5ba4
SHA5125707f632396da4bb9282f49145c19479fcfce24aed6657d3bf12109b0785757f68d31055091a48ab82ea08ea8692a3899be6cb2f10101dc6d384634e12ca6665
-
\Users\Admin\AppData\Roaming\XenoManager\12.exeFilesize
45KB
MD5e495926b851b044d702e8ca3792e8997
SHA18998457297aa42ca53ff2c5118b3721b184108ec
SHA256c79572263f72b42dc7e7fef376c32b3cc33cf5f543373e7896d5e81cef0911ff
SHA51209bb2a11f639dd1ecb51c71117d6fbad736e70a6ce92e1316cf92a6a8288dc0ef1364d14cbb050fdb39725f3154d5dc425392249c43476eec1d06879942c815a
-
memory/2352-0-0x0000000074A7E000-0x0000000074A7F000-memory.dmpFilesize
4KB
-
memory/2352-1-0x0000000001250000-0x0000000001262000-memory.dmpFilesize
72KB
-
memory/3060-9-0x0000000000320000-0x0000000000332000-memory.dmpFilesize
72KB
-
memory/3060-10-0x0000000074A70000-0x000000007515E000-memory.dmpFilesize
6.9MB
-
memory/3060-13-0x0000000074A70000-0x000000007515E000-memory.dmpFilesize
6.9MB
-
memory/3060-14-0x0000000074A70000-0x000000007515E000-memory.dmpFilesize
6.9MB