Malware Analysis Report

2024-08-06 18:35

Sample ID 240515-thm1wsha89
Target fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
SHA256 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7
Tags
xenorat rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7

Threat Level: Known bad

The file fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe was found to be: Known bad.

Malicious Activity Summary

xenorat rat trojan

Detects XenoRAT malware

XenorRat

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Persistence
TA0003
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-15 16:03

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-15 16:03

Reported

2024-05-15 16:06

Platform

win7-20240221-en

Max time kernel

146s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe"

Signatures

Detects XenoRAT malware

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

XenorRat

trojan rat xenorat

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2400 set thread context of 3032 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2400 set thread context of 2612 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2400 set thread context of 2700 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2880 set thread context of 552 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2880 set thread context of 2532 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2880 set thread context of 2484 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2400 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2400 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2400 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2400 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2400 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2400 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2400 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2400 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2400 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2400 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2400 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2400 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2400 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2400 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2400 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2400 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2400 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2400 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2400 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2400 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2400 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2400 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2400 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2400 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2400 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2400 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2400 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 3032 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 3032 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 3032 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 3032 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2880 wrote to memory of 552 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2880 wrote to memory of 552 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2880 wrote to memory of 552 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2880 wrote to memory of 552 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2880 wrote to memory of 552 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2880 wrote to memory of 552 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2880 wrote to memory of 552 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2880 wrote to memory of 552 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2880 wrote to memory of 552 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2880 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2880 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2880 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2880 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2880 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2880 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2880 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2880 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2880 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2880 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2880 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2880 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2880 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2880 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2880 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2880 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2880 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2880 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 2484 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Windows\SysWOW64\schtasks.exe
PID 2484 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Windows\SysWOW64\schtasks.exe
PID 2484 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Windows\SysWOW64\schtasks.exe
PID 2484 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

"C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe"

C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

"C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe"

C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "bns" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF41F.tmp" /F

Network

Country Destination Domain Proto
US 8.8.8.8:53 dns.dobiamfollollc.online udp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp

Files

memory/2400-0-0x000000007418E000-0x000000007418F000-memory.dmp

memory/2400-1-0x0000000000010000-0x0000000000056000-memory.dmp

memory/2400-2-0x0000000000240000-0x0000000000246000-memory.dmp

memory/2400-4-0x0000000074180000-0x000000007486E000-memory.dmp

memory/2400-3-0x0000000000270000-0x00000000002B0000-memory.dmp

memory/2400-5-0x00000000002C0000-0x00000000002C6000-memory.dmp

memory/3032-6-0x0000000000400000-0x0000000000412000-memory.dmp

memory/3032-12-0x0000000000400000-0x0000000000412000-memory.dmp

memory/3032-8-0x0000000000400000-0x0000000000412000-memory.dmp

memory/3032-15-0x0000000074180000-0x000000007486E000-memory.dmp

memory/2400-16-0x0000000074180000-0x000000007486E000-memory.dmp

\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

MD5 33f2e874128d3a24588e1c89927042bd
SHA1 e206af96ff648951608eaf599627635ddff7ecd8
SHA256 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7
SHA512 559dc3f6a0f9a6e762545b9683e265e4459b8623786c979c959d5d78dff7f4455fed72135fcccc966c10ba3d3588fcbf077a44091e3012743245dc41bfd1b3c5

memory/2880-24-0x00000000009D0000-0x0000000000A16000-memory.dmp

memory/3032-23-0x0000000074180000-0x000000007486E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpF41F.tmp

MD5 f724991e5a7dee17c19c664decf07bd8
SHA1 da8f5edc3bf8c204eee70d9e39ce2df132012833
SHA256 82d5699e6e2b47c06d9d75c325d1d131f47bff1f71b7d5c13b336e43ba78cde1
SHA512 870e24d09d4649c5b029a3019112434e28b9b97fe2e1c1d0465f8a3e4b1788757602cde33b49afe35430663a748aea32e94d435598d63d3eb6b31e028fa73f11

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-15 16:03

Reported

2024-05-15 16:06

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe"

Signatures

Detects XenoRAT malware

rat
Description Indicator Process Target
N/A N/A N/A N/A

XenorRat

trojan rat xenorat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4340 set thread context of 1020 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4340 set thread context of 4348 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4340 set thread context of 4564 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4284 set thread context of 1652 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4284 set thread context of 2116 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4284 set thread context of 2572 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4340 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4340 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4340 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4340 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4340 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4340 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4340 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4340 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4340 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4340 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4340 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4340 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4340 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4340 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4340 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4340 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4340 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4340 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4340 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4340 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4340 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4340 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4340 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4340 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4348 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4348 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4348 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4284 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4284 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4284 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4284 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4284 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4284 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4284 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4284 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4284 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4284 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4284 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4284 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4284 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4284 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4284 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4284 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4284 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4284 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4284 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4284 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4284 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4284 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4284 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4284 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe
PID 4564 wrote to memory of 3392 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Windows\SysWOW64\schtasks.exe
PID 4564 wrote to memory of 3392 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Windows\SysWOW64\schtasks.exe
PID 4564 wrote to memory of 3392 N/A C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

"C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe"

C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

C:\Users\Admin\AppData\Local\Temp\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1020 -ip 1020

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 80

C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

"C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe"

C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2572 -ip 2572

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 80

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "bns" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2DC2.tmp" /F

Network

Country Destination Domain Proto
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 dns.dobiamfollollc.online udp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
BE 2.17.107.104:443 www.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 104.107.17.2.in-addr.arpa udp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
US 8.8.8.8:53 udp

Files

memory/4340-0-0x00000000749CE000-0x00000000749CF000-memory.dmp

memory/4340-1-0x0000000000670000-0x00000000006B6000-memory.dmp

memory/4340-2-0x0000000002860000-0x0000000002866000-memory.dmp

memory/4340-3-0x000000000DA80000-0x000000000DAC0000-memory.dmp

memory/4340-4-0x000000000DB60000-0x000000000DBFC000-memory.dmp

memory/4340-5-0x00000000749C0000-0x0000000075170000-memory.dmp

memory/4340-6-0x000000000E1B0000-0x000000000E754000-memory.dmp

memory/4340-7-0x000000000DCA0000-0x000000000DD32000-memory.dmp

memory/4340-8-0x0000000002920000-0x0000000002926000-memory.dmp

memory/4348-10-0x0000000000400000-0x0000000000412000-memory.dmp

memory/4564-14-0x00000000749C0000-0x0000000075170000-memory.dmp

memory/4348-15-0x00000000749C0000-0x0000000075170000-memory.dmp

memory/4340-16-0x00000000749C0000-0x0000000075170000-memory.dmp

memory/4564-17-0x00000000749C0000-0x0000000075170000-memory.dmp

C:\Users\Admin\AppData\Roaming\XenoManager\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

MD5 33f2e874128d3a24588e1c89927042bd
SHA1 e206af96ff648951608eaf599627635ddff7ecd8
SHA256 fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7
SHA512 559dc3f6a0f9a6e762545b9683e265e4459b8623786c979c959d5d78dff7f4455fed72135fcccc966c10ba3d3588fcbf077a44091e3012743245dc41bfd1b3c5

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe.log

MD5 d95c58e609838928f0f49837cab7dfd2
SHA1 55e7139a1e3899195b92ed8771d1ca2c7d53c916
SHA256 0407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339
SHA512 405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d

memory/4348-29-0x00000000749C0000-0x0000000075170000-memory.dmp

memory/4284-30-0x00000000749C0000-0x0000000075170000-memory.dmp

memory/4284-37-0x00000000749C0000-0x0000000075170000-memory.dmp

memory/4564-38-0x00000000749C0000-0x0000000075170000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp2DC2.tmp

MD5 cef9bd9ff86b1e2446b1cebe03185a75
SHA1 adf01337b2168caa29c4c950501827ba8a78d6c8
SHA256 92535d26ae4597d9a1ef1cc3b98344582e7f939a65f63accbeec32f534e91792
SHA512 547e4c841eeb7051ef6974a859df85354fc39c12466d753af59a9cdbd34c2773f0949bc8a6088ea749d54dab4c5e7976b97b811d071288ecf6e5210cbb73ca3d