Malware Analysis Report

2024-08-06 18:36

Sample ID 240516-yn17xsdg4x
Target 23909b22079b8d7a53e9a3e7940cbc4626ba74f19382973e1b3dafbade7243ea.zip
SHA256 23909b22079b8d7a53e9a3e7940cbc4626ba74f19382973e1b3dafbade7243ea
Tags
xenorat rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

23909b22079b8d7a53e9a3e7940cbc4626ba74f19382973e1b3dafbade7243ea

Threat Level: Known bad

The file 23909b22079b8d7a53e9a3e7940cbc4626ba74f19382973e1b3dafbade7243ea.zip was found to be: Known bad.

Malicious Activity Summary

xenorat rat trojan

Detects XenoRAT malware

XenorRat

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Enumerates physical storage devices

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Persistence
TA0003
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-16 19:56

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-16 19:56

Reported

2024-05-16 19:59

Platform

win7-20240221-en

Max time kernel

144s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe"

Signatures

Detects XenoRAT malware

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

XenorRat

trojan rat xenorat

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1948 set thread context of 2928 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1948 set thread context of 1796 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1948 set thread context of 2580 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2416 set thread context of 2556 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2416 set thread context of 2404 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2416 set thread context of 2464 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1948 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1948 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1948 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1948 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1948 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1948 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1948 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1948 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1948 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1948 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1948 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1948 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1948 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1948 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1948 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1948 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1948 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1948 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1948 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1948 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1948 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1948 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1948 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1948 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1948 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1948 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1948 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1796 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 1796 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 1796 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 1796 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2416 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2416 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2416 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2416 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2416 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2416 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2416 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2416 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2416 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2416 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2416 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2416 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2416 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2416 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2416 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2416 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2416 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2416 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2416 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2416 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2416 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2416 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2416 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2416 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2416 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2416 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2416 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2928 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Windows\SysWOW64\schtasks.exe
PID 2928 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Windows\SysWOW64\schtasks.exe
PID 2928 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Windows\SysWOW64\schtasks.exe
PID 2928 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

"C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe"

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

"C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe"

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "bns" /XML "C:\Users\Admin\AppData\Local\Temp\tmp223.tmp" /F

Network

Country Destination Domain Proto
US 8.8.8.8:53 dns.dobiamfollollc.online udp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp

Files

memory/1948-0-0x00000000748CE000-0x00000000748CF000-memory.dmp

memory/1948-1-0x00000000012A0000-0x00000000012E6000-memory.dmp

memory/1948-2-0x0000000000240000-0x0000000000246000-memory.dmp

memory/1948-3-0x00000000010D0000-0x0000000001110000-memory.dmp

memory/1948-4-0x00000000748C0000-0x0000000074FAE000-memory.dmp

memory/1948-5-0x00000000002C0000-0x00000000002C6000-memory.dmp

memory/2928-6-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2928-12-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2928-8-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2928-23-0x00000000748C0000-0x0000000074FAE000-memory.dmp

memory/1948-24-0x00000000748C0000-0x0000000074FAE000-memory.dmp

\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

MD5 f36fa3a72893c4151b136426119ad589
SHA1 2f83d91056d831a40182c743c36fab2622be8906
SHA256 3f2490dd9d05980a4b02f6b5e6e9c18f349cc4192a4733374318c20bc7f0a885
SHA512 fa51532d7257fb7e71a2f5f9091350086c1772dc5458b572674071c25288b80b205bf17db271e58e11e45d930f4c1745938e45068125bf92b29fd8ca3e6859ff

memory/2416-31-0x00000000008C0000-0x0000000000906000-memory.dmp

memory/2928-47-0x00000000748C0000-0x0000000074FAE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp223.tmp

MD5 ce258e4d1ee9274298ad8a934564f693
SHA1 bade788124550cc863093902a5d75547c5df60cc
SHA256 493b42cf9fb3f7108d467a83937fe28cbe280194bcce3c9b41d32234ea7d6db4
SHA512 bfcf71048785ed9d75788d96744e0191948104e92a58062935f3c723b8580ddf222c24047a8131b84c11fce76b2139a61bc403cca66b5b82904470a29e1b25b0

memory/2928-50-0x00000000748C0000-0x0000000074FAE000-memory.dmp

memory/2928-51-0x00000000748C0000-0x0000000074FAE000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-16 19:56

Reported

2024-05-16 19:59

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe"

Signatures

Detects XenoRAT malware

rat
Description Indicator Process Target
N/A N/A N/A N/A

XenorRat

trojan rat xenorat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3620 set thread context of 4268 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 3620 set thread context of 1200 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 3620 set thread context of 3508 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 2292 set thread context of 2328 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2292 set thread context of 1728 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2292 set thread context of 556 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3620 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 3620 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 3620 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 3620 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 3620 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 3620 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 3620 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 3620 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 3620 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 3620 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 3620 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 3620 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 3620 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 3620 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 3620 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 3620 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 3620 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 3620 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 3620 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 3620 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 3620 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 3620 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 3620 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 3620 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe
PID 1200 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 1200 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 1200 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2292 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2292 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2292 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2292 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2292 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2292 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2292 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2292 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2292 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2292 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2292 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2292 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2292 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2292 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2292 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2292 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2292 wrote to memory of 556 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2292 wrote to memory of 556 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2292 wrote to memory of 556 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2292 wrote to memory of 556 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2292 wrote to memory of 556 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2292 wrote to memory of 556 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2292 wrote to memory of 556 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 2292 wrote to memory of 556 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe
PID 3508 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Windows\SysWOW64\schtasks.exe
PID 3508 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Windows\SysWOW64\schtasks.exe
PID 3508 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

"C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe"

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Users\Admin\AppData\Local\Temp\Dekont-Mayis.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4268 -ip 4268

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

"C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 80

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "bns" /XML "C:\Users\Admin\AppData\Local\Temp\tmp33AD.tmp" /F

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 211.131.50.23.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
NL 23.62.61.129:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 129.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 dns.dobiamfollollc.online udp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp
NL 94.156.68.125:1283 dns.dobiamfollollc.online tcp

Files

memory/3620-0-0x0000000074B3E000-0x0000000074B3F000-memory.dmp

memory/3620-1-0x00000000008E0000-0x0000000000926000-memory.dmp

memory/3620-2-0x0000000005110000-0x0000000005116000-memory.dmp

memory/3620-3-0x0000000074B30000-0x00000000752E0000-memory.dmp

memory/3620-4-0x00000000051F0000-0x0000000005230000-memory.dmp

memory/3620-5-0x000000000DE50000-0x000000000DEEC000-memory.dmp

memory/3620-6-0x000000000E4A0000-0x000000000EA44000-memory.dmp

memory/3620-7-0x000000000DEF0000-0x000000000DF82000-memory.dmp

memory/3620-8-0x0000000002C00000-0x0000000002C06000-memory.dmp

memory/1200-10-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1200-14-0x0000000074B30000-0x00000000752E0000-memory.dmp

memory/3508-15-0x0000000074B30000-0x00000000752E0000-memory.dmp

memory/3620-16-0x0000000074B30000-0x00000000752E0000-memory.dmp

C:\Users\Admin\AppData\Roaming\XenoManager\Dekont-Mayis.exe

MD5 f36fa3a72893c4151b136426119ad589
SHA1 2f83d91056d831a40182c743c36fab2622be8906
SHA256 3f2490dd9d05980a4b02f6b5e6e9c18f349cc4192a4733374318c20bc7f0a885
SHA512 fa51532d7257fb7e71a2f5f9091350086c1772dc5458b572674071c25288b80b205bf17db271e58e11e45d930f4c1745938e45068125bf92b29fd8ca3e6859ff

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Dekont-Mayis.exe.log

MD5 d95c58e609838928f0f49837cab7dfd2
SHA1 55e7139a1e3899195b92ed8771d1ca2c7d53c916
SHA256 0407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339
SHA512 405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d

memory/2292-28-0x0000000074B30000-0x00000000752E0000-memory.dmp

memory/1200-29-0x0000000074B30000-0x00000000752E0000-memory.dmp

memory/2292-36-0x0000000074B30000-0x00000000752E0000-memory.dmp

memory/3508-37-0x0000000074B30000-0x00000000752E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp33AD.tmp

MD5 ce258e4d1ee9274298ad8a934564f693
SHA1 bade788124550cc863093902a5d75547c5df60cc
SHA256 493b42cf9fb3f7108d467a83937fe28cbe280194bcce3c9b41d32234ea7d6db4
SHA512 bfcf71048785ed9d75788d96744e0191948104e92a58062935f3c723b8580ddf222c24047a8131b84c11fce76b2139a61bc403cca66b5b82904470a29e1b25b0