Malware Analysis Report

2024-08-06 18:37

Sample ID 240515-btm6xsac7s
Target 6d05d5e5310b31e26aaf54e7297f0f199056c92545c3b2602367dcdb67c761d0.zip
SHA256 6d05d5e5310b31e26aaf54e7297f0f199056c92545c3b2602367dcdb67c761d0
Tags
xenorat rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6d05d5e5310b31e26aaf54e7297f0f199056c92545c3b2602367dcdb67c761d0

Threat Level: Known bad

The file 6d05d5e5310b31e26aaf54e7297f0f199056c92545c3b2602367dcdb67c761d0.zip was found to be: Known bad.

Malicious Activity Summary

xenorat rat trojan

XenorRat

Detects executables packed with ConfuserEx Mod

Detects executables packed with ConfuserEx Mod

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Persistence
TA0003
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-15 01:26

Signatures

Detects executables packed with ConfuserEx Mod

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-15 01:26

Reported

2024-05-15 01:28

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe"

Signatures

XenorRat

trojan rat xenorat

Detects executables packed with ConfuserEx Mod

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2208 set thread context of 4536 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2208 set thread context of 4448 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2208 set thread context of 2664 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2844 set thread context of 4312 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2844 set thread context of 4848 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2844 set thread context of 2572 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2208 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2208 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2208 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2208 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2208 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2208 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2208 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2208 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2208 wrote to memory of 4448 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2208 wrote to memory of 4448 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2208 wrote to memory of 4448 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2208 wrote to memory of 4448 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2208 wrote to memory of 4448 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2208 wrote to memory of 4448 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2208 wrote to memory of 4448 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2208 wrote to memory of 4448 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2208 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2208 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2208 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2208 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2208 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2208 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2208 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2208 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 4536 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 4536 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 4536 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2844 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2844 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2844 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2844 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2844 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2844 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2844 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2844 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2844 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2844 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2844 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2844 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2844 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2844 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2844 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2844 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 4448 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Windows\SysWOW64\schtasks.exe
PID 4448 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Windows\SysWOW64\schtasks.exe
PID 4448 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

"C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe"

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

"C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe"

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "bns" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1C6C.tmp" /F

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 dns.dobiamfollollc.online udp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
NL 23.62.61.194:443 www.bing.com tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
US 8.8.8.8:53 udp

Files

memory/2208-0-0x0000000074B1E000-0x0000000074B1F000-memory.dmp

memory/2208-1-0x0000000000BE0000-0x0000000000C26000-memory.dmp

memory/2208-2-0x0000000005550000-0x0000000005556000-memory.dmp

memory/2208-3-0x0000000074B10000-0x00000000752C0000-memory.dmp

memory/2208-4-0x0000000005710000-0x0000000005750000-memory.dmp

memory/2208-5-0x000000000E210000-0x000000000E2AC000-memory.dmp

memory/2208-6-0x000000000E860000-0x000000000EE04000-memory.dmp

memory/2208-7-0x000000000E350000-0x000000000E3E2000-memory.dmp

memory/2208-8-0x0000000002EF0000-0x0000000002EF6000-memory.dmp

memory/4536-9-0x0000000000400000-0x0000000000412000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Dekont-Mayis.exe.log

MD5 d95c58e609838928f0f49837cab7dfd2
SHA1 55e7139a1e3899195b92ed8771d1ca2c7d53c916
SHA256 0407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339
SHA512 405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d

memory/4448-16-0x0000000074B10000-0x00000000752C0000-memory.dmp

memory/2208-17-0x0000000074B10000-0x00000000752C0000-memory.dmp

memory/4536-14-0x0000000074B10000-0x00000000752C0000-memory.dmp

memory/4448-18-0x0000000074B10000-0x00000000752C0000-memory.dmp

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

MD5 33f2e874128d3a24588e1c89927042bd
SHA1 e206af96ff648951608eaf599627635ddff7ecd8
SHA256 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7
SHA512 559dc3f6a0f9a6e762545b9683e265e4459b8623786c979c959d5d78dff7f4455fed72135fcccc966c10ba3d3588fcbf077a44091e3012743245dc41bfd1b3c5

memory/4536-29-0x0000000074B10000-0x00000000752C0000-memory.dmp

memory/4448-36-0x0000000074B10000-0x00000000752C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp1C6C.tmp

MD5 ce258e4d1ee9274298ad8a934564f693
SHA1 bade788124550cc863093902a5d75547c5df60cc
SHA256 493b42cf9fb3f7108d467a83937fe28cbe280194bcce3c9b41d32234ea7d6db4
SHA512 bfcf71048785ed9d75788d96744e0191948104e92a58062935f3c723b8580ddf222c24047a8131b84c11fce76b2139a61bc403cca66b5b82904470a29e1b25b0

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-15 01:26

Reported

2024-05-15 01:28

Platform

win7-20240508-en

Max time kernel

127s

Max time network

137s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe"

Signatures

XenorRat

trojan rat xenorat

Detects executables packed with ConfuserEx Mod

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1224 set thread context of 2928 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1224 set thread context of 2312 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1224 set thread context of 1332 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2656 set thread context of 2784 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2656 set thread context of 2596 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2656 set thread context of 1912 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1224 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1224 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1224 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1224 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1224 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1224 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1224 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1224 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1224 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1224 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1224 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1224 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1224 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1224 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1224 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1224 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1224 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1224 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1224 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1224 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1224 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1224 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1224 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1224 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1224 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1224 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1224 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2928 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2928 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2928 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2928 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2656 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2656 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2656 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2656 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2656 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2656 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2656 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2656 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2656 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2656 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2656 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2656 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2656 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2656 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2656 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2656 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2656 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2656 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2656 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2656 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2656 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2656 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2656 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2656 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2656 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2656 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2656 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 1332 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Windows\SysWOW64\schtasks.exe
PID 1332 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Windows\SysWOW64\schtasks.exe
PID 1332 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Windows\SysWOW64\schtasks.exe
PID 1332 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

"C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe"

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

"C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe"

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "bns" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2230.tmp" /F

Network

Country Destination Domain Proto
US 8.8.8.8:53 dns.dobiamfollollc.online udp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp

Files

memory/1224-0-0x000000007482E000-0x000000007482F000-memory.dmp

memory/1224-1-0x00000000013B0000-0x00000000013F6000-memory.dmp

memory/1224-2-0x0000000000250000-0x0000000000256000-memory.dmp

memory/1224-3-0x00000000004F0000-0x0000000000530000-memory.dmp

memory/1224-4-0x0000000074820000-0x0000000074F0E000-memory.dmp

memory/1224-5-0x00000000003E0000-0x00000000003E6000-memory.dmp

memory/2928-10-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2928-6-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2928-8-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1332-19-0x0000000074820000-0x0000000074F0E000-memory.dmp

memory/2928-17-0x0000000074820000-0x0000000074F0E000-memory.dmp

memory/1224-20-0x0000000074820000-0x0000000074F0E000-memory.dmp

\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

MD5 33f2e874128d3a24588e1c89927042bd
SHA1 e206af96ff648951608eaf599627635ddff7ecd8
SHA256 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7
SHA512 559dc3f6a0f9a6e762545b9683e265e4459b8623786c979c959d5d78dff7f4455fed72135fcccc966c10ba3d3588fcbf077a44091e3012743245dc41bfd1b3c5

memory/2656-27-0x0000000000BB0000-0x0000000000BF6000-memory.dmp

memory/2928-28-0x0000000074820000-0x0000000074F0E000-memory.dmp

memory/1332-39-0x0000000074820000-0x0000000074F0E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp2230.tmp

MD5 ce258e4d1ee9274298ad8a934564f693
SHA1 bade788124550cc863093902a5d75547c5df60cc
SHA256 493b42cf9fb3f7108d467a83937fe28cbe280194bcce3c9b41d32234ea7d6db4
SHA512 bfcf71048785ed9d75788d96744e0191948104e92a58062935f3c723b8580ddf222c24047a8131b84c11fce76b2139a61bc403cca66b5b82904470a29e1b25b0

memory/1332-42-0x0000000074820000-0x0000000074F0E000-memory.dmp

memory/1332-43-0x0000000074820000-0x0000000074F0E000-memory.dmp