Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-05-2024 16:03
Static task
static1
Behavioral task
behavioral1
Sample
fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
Resource
win7-20240221-en
General
-
Target
fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
-
Size
242KB
-
MD5
33f2e874128d3a24588e1c89927042bd
-
SHA1
e206af96ff648951608eaf599627635ddff7ecd8
-
SHA256
fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7
-
SHA512
559dc3f6a0f9a6e762545b9683e265e4459b8623786c979c959d5d78dff7f4455fed72135fcccc966c10ba3d3588fcbf077a44091e3012743245dc41bfd1b3c5
-
SSDEEP
6144:gRRan2neJf5QvtapiSgICS86G3vsMP1i8FvEOPDv5bq1RFI:gRTeJf5mappgICS+3xPFvrPDv5bq1I
Malware Config
Extracted
xenorat
dns.dobiamfollollc.online
Solid_rat_nd8889g
-
delay
61000
-
install_path
appdata
-
port
1283
-
startup_name
bns
Signatures
-
Detects XenoRAT malware 3 IoCs
XenoRAT is an open-source remote access tool (RAT) developed in C#.
Processes:
resource yara_rule behavioral1/memory/3032-6-0x0000000000400000-0x0000000000412000-memory.dmp XenoRAT behavioral1/memory/3032-12-0x0000000000400000-0x0000000000412000-memory.dmp XenoRAT behavioral1/memory/3032-8-0x0000000000400000-0x0000000000412000-memory.dmp XenoRAT -
Executes dropped EXE 4 IoCs
Processes:
fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exefbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exefbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exefbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exepid process 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe 552 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe 2532 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe 2484 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe -
Loads dropped DLL 4 IoCs
Processes:
fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exefbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exepid process 3032 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exefbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exedescription pid process target process PID 2400 set thread context of 3032 2400 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2400 set thread context of 2612 2400 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2400 set thread context of 2700 2400 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2880 set thread context of 552 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2880 set thread context of 2532 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2880 set thread context of 2484 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exefbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exedescription pid process Token: SeDebugPrivilege 2400 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe Token: SeDebugPrivilege 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe -
Suspicious use of WriteProcessMemory 62 IoCs
Processes:
fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exefbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exefbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exefbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exedescription pid process target process PID 2400 wrote to memory of 3032 2400 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2400 wrote to memory of 3032 2400 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2400 wrote to memory of 3032 2400 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2400 wrote to memory of 3032 2400 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2400 wrote to memory of 3032 2400 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2400 wrote to memory of 3032 2400 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2400 wrote to memory of 3032 2400 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2400 wrote to memory of 3032 2400 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2400 wrote to memory of 3032 2400 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2400 wrote to memory of 2612 2400 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2400 wrote to memory of 2612 2400 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2400 wrote to memory of 2612 2400 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2400 wrote to memory of 2612 2400 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2400 wrote to memory of 2612 2400 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2400 wrote to memory of 2612 2400 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2400 wrote to memory of 2612 2400 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2400 wrote to memory of 2612 2400 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2400 wrote to memory of 2612 2400 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2400 wrote to memory of 2700 2400 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2400 wrote to memory of 2700 2400 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2400 wrote to memory of 2700 2400 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2400 wrote to memory of 2700 2400 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2400 wrote to memory of 2700 2400 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2400 wrote to memory of 2700 2400 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2400 wrote to memory of 2700 2400 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2400 wrote to memory of 2700 2400 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2400 wrote to memory of 2700 2400 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 3032 wrote to memory of 2880 3032 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 3032 wrote to memory of 2880 3032 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 3032 wrote to memory of 2880 3032 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 3032 wrote to memory of 2880 3032 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2880 wrote to memory of 552 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2880 wrote to memory of 552 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2880 wrote to memory of 552 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2880 wrote to memory of 552 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2880 wrote to memory of 552 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2880 wrote to memory of 552 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2880 wrote to memory of 552 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2880 wrote to memory of 552 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2880 wrote to memory of 552 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2880 wrote to memory of 2532 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2880 wrote to memory of 2532 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2880 wrote to memory of 2532 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2880 wrote to memory of 2532 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2880 wrote to memory of 2532 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2880 wrote to memory of 2532 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2880 wrote to memory of 2532 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2880 wrote to memory of 2532 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2880 wrote to memory of 2532 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2880 wrote to memory of 2484 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2880 wrote to memory of 2484 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2880 wrote to memory of 2484 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2880 wrote to memory of 2484 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2880 wrote to memory of 2484 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2880 wrote to memory of 2484 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2880 wrote to memory of 2484 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2880 wrote to memory of 2484 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2880 wrote to memory of 2484 2880 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe PID 2484 wrote to memory of 2792 2484 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe schtasks.exe PID 2484 wrote to memory of 2792 2484 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe schtasks.exe PID 2484 wrote to memory of 2792 2484 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe schtasks.exe PID 2484 wrote to memory of 2792 2484 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe"C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exeC:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe"C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exeC:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exeC:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exeC:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "bns" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF41F.tmp" /F5⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exeC:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exeC:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpF41F.tmpFilesize
1KB
MD5f724991e5a7dee17c19c664decf07bd8
SHA1da8f5edc3bf8c204eee70d9e39ce2df132012833
SHA25682d5699e6e2b47c06d9d75c325d1d131f47bff1f71b7d5c13b336e43ba78cde1
SHA512870e24d09d4649c5b029a3019112434e28b9b97fe2e1c1d0465f8a3e4b1788757602cde33b49afe35430663a748aea32e94d435598d63d3eb6b31e028fa73f11
-
\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exeFilesize
242KB
MD533f2e874128d3a24588e1c89927042bd
SHA1e206af96ff648951608eaf599627635ddff7ecd8
SHA256fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7
SHA512559dc3f6a0f9a6e762545b9683e265e4459b8623786c979c959d5d78dff7f4455fed72135fcccc966c10ba3d3588fcbf077a44091e3012743245dc41bfd1b3c5
-
memory/2400-16-0x0000000074180000-0x000000007486E000-memory.dmpFilesize
6.9MB
-
memory/2400-1-0x0000000000010000-0x0000000000056000-memory.dmpFilesize
280KB
-
memory/2400-2-0x0000000000240000-0x0000000000246000-memory.dmpFilesize
24KB
-
memory/2400-4-0x0000000074180000-0x000000007486E000-memory.dmpFilesize
6.9MB
-
memory/2400-3-0x0000000000270000-0x00000000002B0000-memory.dmpFilesize
256KB
-
memory/2400-5-0x00000000002C0000-0x00000000002C6000-memory.dmpFilesize
24KB
-
memory/2400-0-0x000000007418E000-0x000000007418F000-memory.dmpFilesize
4KB
-
memory/2880-24-0x00000000009D0000-0x0000000000A16000-memory.dmpFilesize
280KB
-
memory/3032-6-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3032-15-0x0000000074180000-0x000000007486E000-memory.dmpFilesize
6.9MB
-
memory/3032-8-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3032-23-0x0000000074180000-0x000000007486E000-memory.dmpFilesize
6.9MB
-
memory/3032-12-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB