Analysis
-
max time kernel
93s -
max time network
96s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
13-05-2024 18:55
General
-
Target
123.exe
-
Size
45KB
-
MD5
fd3fa42906bc5b6a8c5e797431d3e9f1
-
SHA1
8f21e90966b9682640ae12d89b7485f18fc960c5
-
SHA256
8a9c7963d74a81dbbdd82f50e0ef9014777474c9ff55bc26bbf64681bb571cfb
-
SHA512
b04e17457c28d791717751626f3e88872fc4c4792e6da90d8e008817afc6c3b7ef8bd2afc09ecd0c951d74f8d2922d1eaa190ae3c3d166dd6cf93338c70947a1
-
SSDEEP
768:BdhO/poiiUcjlJInLr6BH9Xqk5nWEZ5SbTDaUuI7CPW5Q:/w+jjgncH9XqcnW85SbThuI4
Malware Config
Extracted
xenorat
7.tcp.eu.ngrok.io
radnom123_34X41
-
delay
5000
-
install_path
appdata
-
port
10543
-
startup_name
window system
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
123.exepid process 1828 123.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
123.exepid process 1828 123.exe 1828 123.exe 1828 123.exe 1828 123.exe 1828 123.exe 1828 123.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
123.exedescription pid process Token: SeDebugPrivilege 1828 123.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
123.exe123.execmd.exedescription pid process target process PID 2360 wrote to memory of 1828 2360 123.exe 123.exe PID 2360 wrote to memory of 1828 2360 123.exe 123.exe PID 2360 wrote to memory of 1828 2360 123.exe 123.exe PID 1828 wrote to memory of 3164 1828 123.exe schtasks.exe PID 1828 wrote to memory of 3164 1828 123.exe schtasks.exe PID 1828 wrote to memory of 3164 1828 123.exe schtasks.exe PID 1828 wrote to memory of 3748 1828 123.exe schtasks.exe PID 1828 wrote to memory of 3748 1828 123.exe schtasks.exe PID 1828 wrote to memory of 3748 1828 123.exe schtasks.exe PID 1828 wrote to memory of 2512 1828 123.exe schtasks.exe PID 1828 wrote to memory of 2512 1828 123.exe schtasks.exe PID 1828 wrote to memory of 2512 1828 123.exe schtasks.exe PID 1828 wrote to memory of 4504 1828 123.exe cmd.exe PID 1828 wrote to memory of 4504 1828 123.exe cmd.exe PID 1828 wrote to memory of 4504 1828 123.exe cmd.exe PID 4504 wrote to memory of 4648 4504 cmd.exe choice.exe PID 4504 wrote to memory of 4648 4504 cmd.exe choice.exe PID 4504 wrote to memory of 4648 4504 cmd.exe choice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\123.exe"C:\Users\Admin\AppData\Local\Temp\123.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Roaming\XenoManager\123.exe"C:\Users\Admin\AppData\Roaming\XenoManager\123.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "window system" /XML "C:\Users\Admin\AppData\Local\Temp\tmp65BF.tmp" /F3⤵
- Creates scheduled task(s)
PID:3164 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /query /v /fo csv3⤵PID:3748
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /delete /tn "\window system" /f3⤵PID:2512
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\XenoManager\123.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 34⤵PID:4648
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\123.exe.logFilesize
226B
MD51294de804ea5400409324a82fdc7ec59
SHA19a39506bc6cadf99c1f2129265b610c69d1518f7
SHA256494398ec6108c68573c366c96aae23d35e7f9bdbb440a4aab96e86fcad5871d0
SHA512033905cc5b4d0c0ffab2138da47e3223765146fa751c9f84b199284b653a04874c32a23aae577d2e06ce6c6b34fec62331b5fc928e3baf68dc53263ecdfa10c1
-
C:\Users\Admin\AppData\Local\Temp\tmp65BF.tmpFilesize
1KB
MD574d4a60bb87373dae68e73729ecad74e
SHA17bbe087ed0d44ab8f1f084bb6fbc715989872698
SHA256761cb3030ad78449fb0d6bac90141472a2ece57a2290f53cc4b146fe79b98f95
SHA512f283adb42ace934691dbed115ca6adf88e1550b3b07e798409e73c72031d245a64d5879d6259a424daeedeea26a5a3583377e9c677d42c488b0ab6f879b8e08d
-
C:\Users\Admin\AppData\Roaming\XenoManager\123.exeFilesize
45KB
MD5fd3fa42906bc5b6a8c5e797431d3e9f1
SHA18f21e90966b9682640ae12d89b7485f18fc960c5
SHA2568a9c7963d74a81dbbdd82f50e0ef9014777474c9ff55bc26bbf64681bb571cfb
SHA512b04e17457c28d791717751626f3e88872fc4c4792e6da90d8e008817afc6c3b7ef8bd2afc09ecd0c951d74f8d2922d1eaa190ae3c3d166dd6cf93338c70947a1
-
memory/1828-15-0x0000000074C10000-0x00000000753C1000-memory.dmpFilesize
7.7MB
-
memory/1828-18-0x0000000005700000-0x0000000005766000-memory.dmpFilesize
408KB
-
memory/1828-19-0x0000000074C10000-0x00000000753C1000-memory.dmpFilesize
7.7MB
-
memory/2360-0-0x0000000074C1E000-0x0000000074C1F000-memory.dmpFilesize
4KB
-
memory/2360-1-0x0000000000F00000-0x0000000000F12000-memory.dmpFilesize
72KB