Analysis
-
max time kernel
129s -
max time network
135s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
15-05-2024 16:07
General
-
Target
valochesse.exe
-
Size
45KB
-
MD5
804fd6f013a48648f5d2232bca5bdb22
-
SHA1
b2e90724822c99e3b761e79990af49e824e2b76a
-
SHA256
e29b6f39017aebfd1768cd55ca32c93247e95c17cea77fb3ee68368d89aecf71
-
SHA512
86c1d6e032ccee7d8076430f44fe20ba773c064e57d1b3cd07096438989b68c8814be3f375a450202f7eca949d441474e91ccddbb37e17e690e22aac7353c025
-
SSDEEP
768:gdhO/poiiUcjlJInqbqmH9Xqk5nWEZ5SbTDa60WI7CPW59:Sw+jjgnIH9XqcnW85SbTx0WIl
Malware Config
Extracted
xenorat
2.tcp.eu.ngrok.io
xeno-rat
-
delay
100
-
install_path
appdata
-
port
19034
-
startup_name
tapware
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
valochesse.exepid process 2456 valochesse.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 63 IoCs
Processes:
valochesse.exepid process 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe 2456 valochesse.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
valochesse.exedescription pid process Token: SeDebugPrivilege 2456 valochesse.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
valochesse.exevalochesse.execmd.exedescription pid process target process PID 2776 wrote to memory of 2456 2776 valochesse.exe valochesse.exe PID 2776 wrote to memory of 2456 2776 valochesse.exe valochesse.exe PID 2776 wrote to memory of 2456 2776 valochesse.exe valochesse.exe PID 2456 wrote to memory of 4064 2456 valochesse.exe schtasks.exe PID 2456 wrote to memory of 4064 2456 valochesse.exe schtasks.exe PID 2456 wrote to memory of 4064 2456 valochesse.exe schtasks.exe PID 2456 wrote to memory of 1484 2456 valochesse.exe schtasks.exe PID 2456 wrote to memory of 1484 2456 valochesse.exe schtasks.exe PID 2456 wrote to memory of 1484 2456 valochesse.exe schtasks.exe PID 2456 wrote to memory of 4656 2456 valochesse.exe schtasks.exe PID 2456 wrote to memory of 4656 2456 valochesse.exe schtasks.exe PID 2456 wrote to memory of 4656 2456 valochesse.exe schtasks.exe PID 2456 wrote to memory of 2248 2456 valochesse.exe cmd.exe PID 2456 wrote to memory of 2248 2456 valochesse.exe cmd.exe PID 2456 wrote to memory of 2248 2456 valochesse.exe cmd.exe PID 2248 wrote to memory of 1796 2248 cmd.exe choice.exe PID 2248 wrote to memory of 1796 2248 cmd.exe choice.exe PID 2248 wrote to memory of 1796 2248 cmd.exe choice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\valochesse.exe"C:\Users\Admin\AppData\Local\Temp\valochesse.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Roaming\XenoManager\valochesse.exe"C:\Users\Admin\AppData\Roaming\XenoManager\valochesse.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "tapware" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDE0C.tmp" /F3⤵
- Creates scheduled task(s)
PID:4064 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /query /v /fo csv3⤵PID:1484
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /delete /tn "\tapware" /f3⤵PID:4656
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\XenoManager\valochesse.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 34⤵PID:1796
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\valochesse.exe.logFilesize
226B
MD5957779c42144282d8cd83192b8fbc7cf
SHA1de83d08d2cca06b9ff3d1ef239d6b60b705d25fe
SHA2560d7ca7ba65e2b465e4878e324ceab8f8981f5ec06dcf5bc32559a4467a9c7d51
SHA512f1549c61b4f2906d13b2aabb74772c2bc826cd42373d7bb6c48cbb125d5aa2ec17617e6b5e67e8aae3bb5790cc831cdba48a45008ed01df4fba8be448cce39fd
-
C:\Users\Admin\AppData\Local\Temp\tmpDE0C.tmpFilesize
1KB
MD583ea5bae1b54e68e477655caab346750
SHA1e5e75e863cb4cf2e5f1957e0be078f243c047f39
SHA2563d56ac0067ccb6684f6980f72aa8cd2af395cf17f536549316d414b4712b0791
SHA512e78649f8140fdcbb0f9875d0321ebe0e7cc3f4b28bfe82196f8c7ede5bc08e20a6c90ebd9dc0f8bbf01929c186fe6a62a547eea63de0269980ff3189fe3c921a
-
C:\Users\Admin\AppData\Roaming\XenoManager\valochesse.exeFilesize
45KB
MD5804fd6f013a48648f5d2232bca5bdb22
SHA1b2e90724822c99e3b761e79990af49e824e2b76a
SHA256e29b6f39017aebfd1768cd55ca32c93247e95c17cea77fb3ee68368d89aecf71
SHA51286c1d6e032ccee7d8076430f44fe20ba773c064e57d1b3cd07096438989b68c8814be3f375a450202f7eca949d441474e91ccddbb37e17e690e22aac7353c025
-
memory/2456-9-0x0000000073950000-0x000000007403E000-memory.dmpFilesize
6.9MB
-
memory/2456-12-0x0000000006170000-0x00000000061D6000-memory.dmpFilesize
408KB
-
memory/2456-13-0x0000000073950000-0x000000007403E000-memory.dmpFilesize
6.9MB
-
memory/2456-14-0x0000000073950000-0x000000007403E000-memory.dmpFilesize
6.9MB
-
memory/2456-15-0x0000000073950000-0x000000007403E000-memory.dmpFilesize
6.9MB
-
memory/2776-0-0x000000007395E000-0x000000007395F000-memory.dmpFilesize
4KB
-
memory/2776-1-0x00000000003C0000-0x00000000003D2000-memory.dmpFilesize
72KB