Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
14-05-2024 07:39
Static task
static1
Behavioral task
behavioral1
Sample
Dekont-Mayis.exe
Resource
win7-20240221-en
General
-
Target
Dekont-Mayis.exe
-
Size
242KB
-
MD5
4d4b2c3f80721a17b1933d01e0f889a8
-
SHA1
67222941b34301014e8e0208cefa97b86074ab67
-
SHA256
a8a1713fd42448f33024b5631652ccaff80906a0b34060041f574b874b116d18
-
SHA512
1b726882ed48a1a9b2ea9eca7e2da3c2eee7b4145f5ab012fa993a1f3f935e2cf469c7dbcf44ba771732b7a6a4ec58e8ab141dd90b23fb8b7db4bc0d68588d12
-
SSDEEP
6144:tkG0/qHJg+XoB9B6vP6560aZMNddbD3CmOA6d5CiN5pmwdRI:G/qHm+4B9B6X6s0aZMNrvcd5CiN5pmw
Malware Config
Extracted
xenorat
dns.dobiamfollollc.online
Solid_rat_nd8889g
-
delay
61000
-
install_path
appdata
-
port
1283
-
startup_name
bns
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Dekont-Mayis.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation Dekont-Mayis.exe -
Executes dropped EXE 4 IoCs
Processes:
Dekont-Mayis.exeDekont-Mayis.exeDekont-Mayis.exeDekont-Mayis.exepid process 1548 Dekont-Mayis.exe 872 Dekont-Mayis.exe 4656 Dekont-Mayis.exe 3772 Dekont-Mayis.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
Dekont-Mayis.exeDekont-Mayis.exedescription pid process target process PID 528 set thread context of 3240 528 Dekont-Mayis.exe Dekont-Mayis.exe PID 528 set thread context of 3812 528 Dekont-Mayis.exe Dekont-Mayis.exe PID 528 set thread context of 5064 528 Dekont-Mayis.exe Dekont-Mayis.exe PID 1548 set thread context of 872 1548 Dekont-Mayis.exe Dekont-Mayis.exe PID 1548 set thread context of 4656 1548 Dekont-Mayis.exe Dekont-Mayis.exe PID 1548 set thread context of 3772 1548 Dekont-Mayis.exe Dekont-Mayis.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Dekont-Mayis.exeDekont-Mayis.exedescription pid process Token: SeDebugPrivilege 528 Dekont-Mayis.exe Token: SeDebugPrivilege 1548 Dekont-Mayis.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
Dekont-Mayis.exeDekont-Mayis.exeDekont-Mayis.exeDekont-Mayis.exedescription pid process target process PID 528 wrote to memory of 3240 528 Dekont-Mayis.exe Dekont-Mayis.exe PID 528 wrote to memory of 3240 528 Dekont-Mayis.exe Dekont-Mayis.exe PID 528 wrote to memory of 3240 528 Dekont-Mayis.exe Dekont-Mayis.exe PID 528 wrote to memory of 3240 528 Dekont-Mayis.exe Dekont-Mayis.exe PID 528 wrote to memory of 3240 528 Dekont-Mayis.exe Dekont-Mayis.exe PID 528 wrote to memory of 3240 528 Dekont-Mayis.exe Dekont-Mayis.exe PID 528 wrote to memory of 3240 528 Dekont-Mayis.exe Dekont-Mayis.exe PID 528 wrote to memory of 3240 528 Dekont-Mayis.exe Dekont-Mayis.exe PID 528 wrote to memory of 3812 528 Dekont-Mayis.exe Dekont-Mayis.exe PID 528 wrote to memory of 3812 528 Dekont-Mayis.exe Dekont-Mayis.exe PID 528 wrote to memory of 3812 528 Dekont-Mayis.exe Dekont-Mayis.exe PID 528 wrote to memory of 3812 528 Dekont-Mayis.exe Dekont-Mayis.exe PID 528 wrote to memory of 3812 528 Dekont-Mayis.exe Dekont-Mayis.exe PID 528 wrote to memory of 3812 528 Dekont-Mayis.exe Dekont-Mayis.exe PID 528 wrote to memory of 3812 528 Dekont-Mayis.exe Dekont-Mayis.exe PID 528 wrote to memory of 3812 528 Dekont-Mayis.exe Dekont-Mayis.exe PID 528 wrote to memory of 5064 528 Dekont-Mayis.exe Dekont-Mayis.exe PID 528 wrote to memory of 5064 528 Dekont-Mayis.exe Dekont-Mayis.exe PID 528 wrote to memory of 5064 528 Dekont-Mayis.exe Dekont-Mayis.exe PID 528 wrote to memory of 5064 528 Dekont-Mayis.exe Dekont-Mayis.exe PID 528 wrote to memory of 5064 528 Dekont-Mayis.exe Dekont-Mayis.exe PID 528 wrote to memory of 5064 528 Dekont-Mayis.exe Dekont-Mayis.exe PID 528 wrote to memory of 5064 528 Dekont-Mayis.exe Dekont-Mayis.exe PID 528 wrote to memory of 5064 528 Dekont-Mayis.exe Dekont-Mayis.exe PID 3240 wrote to memory of 1548 3240 Dekont-Mayis.exe Dekont-Mayis.exe PID 3240 wrote to memory of 1548 3240 Dekont-Mayis.exe Dekont-Mayis.exe PID 3240 wrote to memory of 1548 3240 Dekont-Mayis.exe Dekont-Mayis.exe PID 1548 wrote to memory of 872 1548 Dekont-Mayis.exe Dekont-Mayis.exe PID 1548 wrote to memory of 872 1548 Dekont-Mayis.exe Dekont-Mayis.exe PID 1548 wrote to memory of 872 1548 Dekont-Mayis.exe Dekont-Mayis.exe PID 1548 wrote to memory of 872 1548 Dekont-Mayis.exe Dekont-Mayis.exe PID 1548 wrote to memory of 872 1548 Dekont-Mayis.exe Dekont-Mayis.exe PID 1548 wrote to memory of 872 1548 Dekont-Mayis.exe Dekont-Mayis.exe PID 1548 wrote to memory of 872 1548 Dekont-Mayis.exe Dekont-Mayis.exe PID 1548 wrote to memory of 872 1548 Dekont-Mayis.exe Dekont-Mayis.exe PID 1548 wrote to memory of 4656 1548 Dekont-Mayis.exe Dekont-Mayis.exe PID 1548 wrote to memory of 4656 1548 Dekont-Mayis.exe Dekont-Mayis.exe PID 1548 wrote to memory of 4656 1548 Dekont-Mayis.exe Dekont-Mayis.exe PID 1548 wrote to memory of 4656 1548 Dekont-Mayis.exe Dekont-Mayis.exe PID 1548 wrote to memory of 4656 1548 Dekont-Mayis.exe Dekont-Mayis.exe PID 1548 wrote to memory of 4656 1548 Dekont-Mayis.exe Dekont-Mayis.exe PID 1548 wrote to memory of 4656 1548 Dekont-Mayis.exe Dekont-Mayis.exe PID 1548 wrote to memory of 4656 1548 Dekont-Mayis.exe Dekont-Mayis.exe PID 1548 wrote to memory of 3772 1548 Dekont-Mayis.exe Dekont-Mayis.exe PID 1548 wrote to memory of 3772 1548 Dekont-Mayis.exe Dekont-Mayis.exe PID 1548 wrote to memory of 3772 1548 Dekont-Mayis.exe Dekont-Mayis.exe PID 1548 wrote to memory of 3772 1548 Dekont-Mayis.exe Dekont-Mayis.exe PID 1548 wrote to memory of 3772 1548 Dekont-Mayis.exe Dekont-Mayis.exe PID 1548 wrote to memory of 3772 1548 Dekont-Mayis.exe Dekont-Mayis.exe PID 1548 wrote to memory of 3772 1548 Dekont-Mayis.exe Dekont-Mayis.exe PID 1548 wrote to memory of 3772 1548 Dekont-Mayis.exe Dekont-Mayis.exe PID 3812 wrote to memory of 4624 3812 Dekont-Mayis.exe schtasks.exe PID 3812 wrote to memory of 4624 3812 Dekont-Mayis.exe schtasks.exe PID 3812 wrote to memory of 4624 3812 Dekont-Mayis.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe"C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exeC:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe"C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exeC:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe4⤵
- Executes dropped EXE
PID:872 -
C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exeC:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe4⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exeC:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe4⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exeC:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe2⤵
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "bns" /XML "C:\Users\Admin\AppData\Local\Temp\tmp26FB.tmp" /F3⤵
- Creates scheduled task(s)
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exeC:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe2⤵PID:5064
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Dekont-Mayis.exe.logFilesize
706B
MD5d95c58e609838928f0f49837cab7dfd2
SHA155e7139a1e3899195b92ed8771d1ca2c7d53c916
SHA2560407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339
SHA512405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d
-
C:\Users\Admin\AppData\Local\Temp\tmp26FB.tmpFilesize
1KB
MD5ce258e4d1ee9274298ad8a934564f693
SHA1bade788124550cc863093902a5d75547c5df60cc
SHA256493b42cf9fb3f7108d467a83937fe28cbe280194bcce3c9b41d32234ea7d6db4
SHA512bfcf71048785ed9d75788d96744e0191948104e92a58062935f3c723b8580ddf222c24047a8131b84c11fce76b2139a61bc403cca66b5b82904470a29e1b25b0
-
C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exeFilesize
242KB
MD54d4b2c3f80721a17b1933d01e0f889a8
SHA167222941b34301014e8e0208cefa97b86074ab67
SHA256a8a1713fd42448f33024b5631652ccaff80906a0b34060041f574b874b116d18
SHA5121b726882ed48a1a9b2ea9eca7e2da3c2eee7b4145f5ab012fa993a1f3f935e2cf469c7dbcf44ba771732b7a6a4ec58e8ab141dd90b23fb8b7db4bc0d68588d12
-
memory/528-8-0x0000000002920000-0x0000000002926000-memory.dmpFilesize
24KB
-
memory/528-3-0x00000000748A0000-0x0000000075050000-memory.dmpFilesize
7.7MB
-
memory/528-5-0x000000000DC80000-0x000000000DD1C000-memory.dmpFilesize
624KB
-
memory/528-6-0x000000000E2D0000-0x000000000E874000-memory.dmpFilesize
5.6MB
-
memory/528-7-0x000000000DDC0000-0x000000000DE52000-memory.dmpFilesize
584KB
-
memory/528-0-0x00000000748AE000-0x00000000748AF000-memory.dmpFilesize
4KB
-
memory/528-1-0x0000000000610000-0x0000000000656000-memory.dmpFilesize
280KB
-
memory/528-4-0x0000000005150000-0x0000000005190000-memory.dmpFilesize
256KB
-
memory/528-2-0x0000000004F80000-0x0000000004F86000-memory.dmpFilesize
24KB
-
memory/528-16-0x00000000748A0000-0x0000000075050000-memory.dmpFilesize
7.7MB
-
memory/3240-15-0x00000000748A0000-0x0000000075050000-memory.dmpFilesize
7.7MB
-
memory/3240-29-0x00000000748A0000-0x0000000075050000-memory.dmpFilesize
7.7MB
-
memory/3240-9-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3812-18-0x00000000748A0000-0x0000000075050000-memory.dmpFilesize
7.7MB
-
memory/3812-17-0x00000000748A0000-0x0000000075050000-memory.dmpFilesize
7.7MB
-
memory/3812-36-0x00000000748A0000-0x0000000075050000-memory.dmpFilesize
7.7MB