Malware Analysis Report

2024-08-06 18:36

Sample ID 240516-bh5ltsdd2x
Target 23909b22079b8d7a53e9a3e7940cbc4626ba74f19382973e1b3dafbade7243ea.zip
SHA256 23909b22079b8d7a53e9a3e7940cbc4626ba74f19382973e1b3dafbade7243ea
Tags
xenorat rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

23909b22079b8d7a53e9a3e7940cbc4626ba74f19382973e1b3dafbade7243ea

Threat Level: Known bad

The file 23909b22079b8d7a53e9a3e7940cbc4626ba74f19382973e1b3dafbade7243ea.zip was found to be: Known bad.

Malicious Activity Summary

xenorat rat trojan

Detects executables packed with ConfuserEx Mod

XenorRat

Detects executables packed with ConfuserEx Mod

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Suspicious use of SetThreadContext

Unsigned PE

Program crash

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Persistence
TA0003
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-16 01:09

Signatures

Detects executables packed with ConfuserEx Mod

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-16 01:09

Reported

2024-05-16 01:12

Platform

win7-20240508-en

Max time kernel

143s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe"

Signatures

XenorRat

trojan rat xenorat

Detects executables packed with ConfuserEx Mod

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2900 set thread context of 2176 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2900 set thread context of 2948 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2900 set thread context of 2656 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2628 set thread context of 2648 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2628 set thread context of 2568 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2628 set thread context of 2524 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2900 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2900 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2900 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2900 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2900 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2900 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2900 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2900 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2900 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2900 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2900 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2900 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2900 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2900 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2900 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2900 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2900 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2900 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2900 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2900 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2900 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2900 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2900 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2900 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2900 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2900 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2900 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2176 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2176 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2176 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2176 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2628 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2628 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2628 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2628 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2628 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2628 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2628 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2628 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2628 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2628 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2628 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2628 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2628 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2628 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2628 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2628 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2628 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2628 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2628 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2628 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2628 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2628 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2628 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2628 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2628 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2628 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2628 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2948 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Windows\SysWOW64\schtasks.exe
PID 2948 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Windows\SysWOW64\schtasks.exe
PID 2948 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Windows\SysWOW64\schtasks.exe
PID 2948 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

"C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe"

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

"C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe"

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "bns" /XML "C:\Users\Admin\AppData\Local\Temp\tmp145B.tmp" /F

Network

Country Destination Domain Proto
US 8.8.8.8:53 dns.dobiamfollollc.online udp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp

Files

memory/2900-0-0x000000007451E000-0x000000007451F000-memory.dmp

memory/2900-1-0x0000000000A80000-0x0000000000AC6000-memory.dmp

memory/2900-2-0x0000000000230000-0x0000000000236000-memory.dmp

memory/2900-3-0x0000000074510000-0x0000000074BFE000-memory.dmp

memory/2900-4-0x0000000000600000-0x0000000000640000-memory.dmp

memory/2900-5-0x00000000003C0000-0x00000000003C6000-memory.dmp

memory/2176-10-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2176-8-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2176-6-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2176-17-0x0000000074510000-0x0000000074BFE000-memory.dmp

memory/2900-23-0x0000000074510000-0x0000000074BFE000-memory.dmp

memory/2948-25-0x0000000074510000-0x0000000074BFE000-memory.dmp

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

MD5 f36fa3a72893c4151b136426119ad589
SHA1 2f83d91056d831a40182c743c36fab2622be8906
SHA256 3f2490dd9d05980a4b02f6b5e6e9c18f349cc4192a4733374318c20bc7f0a885
SHA512 fa51532d7257fb7e71a2f5f9091350086c1772dc5458b572674071c25288b80b205bf17db271e58e11e45d930f4c1745938e45068125bf92b29fd8ca3e6859ff

memory/2176-31-0x0000000074510000-0x0000000074BFE000-memory.dmp

memory/2628-32-0x0000000000090000-0x00000000000D6000-memory.dmp

memory/2948-48-0x0000000074510000-0x0000000074BFE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp145B.tmp

MD5 ce258e4d1ee9274298ad8a934564f693
SHA1 bade788124550cc863093902a5d75547c5df60cc
SHA256 493b42cf9fb3f7108d467a83937fe28cbe280194bcce3c9b41d32234ea7d6db4
SHA512 bfcf71048785ed9d75788d96744e0191948104e92a58062935f3c723b8580ddf222c24047a8131b84c11fce76b2139a61bc403cca66b5b82904470a29e1b25b0

memory/2948-51-0x0000000074510000-0x0000000074BFE000-memory.dmp

memory/2948-52-0x0000000074510000-0x0000000074BFE000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-16 01:09

Reported

2024-05-16 01:12

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe"

Signatures

XenorRat

trojan rat xenorat

Detects executables packed with ConfuserEx Mod

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4508 set thread context of 1748 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 4508 set thread context of 1356 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 4508 set thread context of 2848 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 4556 set thread context of 3504 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 4556 set thread context of 2148 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 4556 set thread context of 1932 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4508 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 4508 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 4508 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 4508 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 4508 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 4508 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 4508 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 4508 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 4508 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 4508 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 4508 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 4508 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 4508 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 4508 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 4508 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 4508 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 4508 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 4508 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 4508 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 4508 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 4508 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 4508 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 4508 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 4508 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2848 wrote to memory of 4556 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2848 wrote to memory of 4556 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2848 wrote to memory of 4556 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 4556 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 4556 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 4556 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 4556 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 4556 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 4556 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 4556 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 4556 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 4556 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 4556 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 4556 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 4556 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 4556 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 4556 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 4556 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 4556 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 4556 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 4556 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 4556 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 4556 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 4556 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 4556 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 4556 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 4556 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 3504 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Windows\SysWOW64\schtasks.exe
PID 3504 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Windows\SysWOW64\schtasks.exe
PID 3504 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

"C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe"

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1356 -ip 1356

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1748 -ip 1748

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

"C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 80

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 80

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1932 -ip 1932

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 80

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "bns" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3553.tmp" /F

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.177:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 177.196.17.2.in-addr.arpa udp
BE 2.17.196.177:443 www.bing.com tcp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 35.15.31.184.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 dns.dobiamfollollc.online udp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
US 8.8.8.8:53 udp

Files

memory/4508-0-0x0000000074F4E000-0x0000000074F4F000-memory.dmp

memory/4508-1-0x0000000000CB0000-0x0000000000CF6000-memory.dmp

memory/4508-2-0x0000000005620000-0x0000000005626000-memory.dmp

memory/4508-3-0x0000000074F40000-0x00000000756F0000-memory.dmp

memory/4508-4-0x0000000005630000-0x0000000005670000-memory.dmp

memory/4508-5-0x00000000059F0000-0x0000000005A8C000-memory.dmp

memory/4508-6-0x0000000006040000-0x00000000065E4000-memory.dmp

memory/4508-7-0x0000000005A90000-0x0000000005B22000-memory.dmp

memory/4508-8-0x0000000005800000-0x0000000005806000-memory.dmp

memory/1356-10-0x0000000000400000-0x0000000000420000-memory.dmp

memory/2848-11-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2848-14-0x0000000074F40000-0x00000000756F0000-memory.dmp

memory/4508-15-0x0000000074F40000-0x00000000756F0000-memory.dmp

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

MD5 f36fa3a72893c4151b136426119ad589
SHA1 2f83d91056d831a40182c743c36fab2622be8906
SHA256 3f2490dd9d05980a4b02f6b5e6e9c18f349cc4192a4733374318c20bc7f0a885
SHA512 fa51532d7257fb7e71a2f5f9091350086c1772dc5458b572674071c25288b80b205bf17db271e58e11e45d930f4c1745938e45068125bf92b29fd8ca3e6859ff

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Dekont-Mayis.exe.log

MD5 d95c58e609838928f0f49837cab7dfd2
SHA1 55e7139a1e3899195b92ed8771d1ca2c7d53c916
SHA256 0407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339
SHA512 405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d

memory/4556-27-0x0000000074F40000-0x00000000756F0000-memory.dmp

memory/2848-28-0x0000000074F40000-0x00000000756F0000-memory.dmp

memory/4556-29-0x0000000074F40000-0x00000000756F0000-memory.dmp

memory/4556-36-0x0000000074F40000-0x00000000756F0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp3553.tmp

MD5 9c78c61f199b96783cc88b8825b9340e
SHA1 08c61d86bc67340d945a6f4774106a5cef8931cc
SHA256 28f3603e1e96eb52cbec71c6bc3f1744f872db9102a9a0f2919ed0f04ebafc1f
SHA512 0bae19e4a6abe3db37e88c62187fcd3d4462a16a4f22108ae767a1195072424bd6094dee072e73dbe4b159860504949b09a4518bee9f4fe08a084946cac6fa5f