Analysis
-
max time kernel
32s -
max time network
32s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 17:27
General
-
Target
Synapse X Installer.exe
-
Size
43KB
-
MD5
769aad21a347b7576895910e55970390
-
SHA1
36831993993050af72ea201cfa6ebc4726860e56
-
SHA256
72e0f8bf690b647ae965d9a99f89c4f04c3b9500aac53f2a3fd376a2546b287a
-
SHA512
9bb36a376f0b3e8a26a813f1054bf92a9ca737bd9eb96403d28b4edb81c361408a058e5ccefda3e44bbf4943d9799203665161b02394d35a05faa20851f670a5
-
SSDEEP
768:d/jqPyqisr4dGirXAHg5rbWDdJwtZ69e7Sd/bDXNJb7bTDa/o1IV27C1:tNqwohJKZ69eKjBJb7bT2o1IgC1
Malware Config
Extracted
xenorat
192.168.1.219
131313131323
-
delay
1000
-
install_path
temp
-
port
1234
-
startup_name
Windows Client
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Synapse X Installer.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation Synapse X Installer.exe -
Executes dropped EXE 1 IoCs
Processes:
Synapse X Installer.exepid process 3588 Synapse X Installer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
taskmgr.exepid process 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 3592 taskmgr.exe Token: SeSystemProfilePrivilege 3592 taskmgr.exe Token: SeCreateGlobalPrivilege 3592 taskmgr.exe -
Suspicious use of FindShellTrayWindow 38 IoCs
Processes:
taskmgr.exepid process 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe -
Suspicious use of SendNotifyMessage 37 IoCs
Processes:
taskmgr.exepid process 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe 3592 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
Synapse X Installer.exeSynapse X Installer.exedescription pid process target process PID 4048 wrote to memory of 3588 4048 Synapse X Installer.exe Synapse X Installer.exe PID 4048 wrote to memory of 3588 4048 Synapse X Installer.exe Synapse X Installer.exe PID 4048 wrote to memory of 3588 4048 Synapse X Installer.exe Synapse X Installer.exe PID 3588 wrote to memory of 4808 3588 Synapse X Installer.exe schtasks.exe PID 3588 wrote to memory of 4808 3588 Synapse X Installer.exe schtasks.exe PID 3588 wrote to memory of 4808 3588 Synapse X Installer.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Synapse X Installer.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X Installer.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\Synapse X Installer.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\Synapse X Installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "Windows Client" /XML "C:\Users\Admin\AppData\Local\Temp\tmp688D.tmp" /F3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Synapse X Installer.exe.logFilesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\Synapse X Installer.exeFilesize
43KB
MD5769aad21a347b7576895910e55970390
SHA136831993993050af72ea201cfa6ebc4726860e56
SHA25672e0f8bf690b647ae965d9a99f89c4f04c3b9500aac53f2a3fd376a2546b287a
SHA5129bb36a376f0b3e8a26a813f1054bf92a9ca737bd9eb96403d28b4edb81c361408a058e5ccefda3e44bbf4943d9799203665161b02394d35a05faa20851f670a5
-
C:\Users\Admin\AppData\Local\Temp\tmp688D.tmpFilesize
1KB
MD5a27e485b47a3c136c01199b55f08c0d8
SHA199a6c183d0673217570cf2e5efcc8bf44d78f483
SHA2560c297eec1e3f58624331b58ae22a57cdd344071d58942c6897bb6ae1409e95df
SHA512386fe030cbcb380350e5e5cc8179b76115601ad9b322f90a9d71f76fb2468993986a224796b489c600b4a388d76584772369259ac05d64a6551978e3c9102b60
-
memory/3588-31-0x0000000074950000-0x0000000075100000-memory.dmpFilesize
7.7MB
-
memory/3588-15-0x0000000074950000-0x0000000075100000-memory.dmpFilesize
7.7MB
-
memory/3592-20-0x000001B34D8B0000-0x000001B34D8B1000-memory.dmpFilesize
4KB
-
memory/3592-18-0x000001B34D8B0000-0x000001B34D8B1000-memory.dmpFilesize
4KB
-
memory/3592-19-0x000001B34D8B0000-0x000001B34D8B1000-memory.dmpFilesize
4KB
-
memory/3592-24-0x000001B34D8B0000-0x000001B34D8B1000-memory.dmpFilesize
4KB
-
memory/3592-25-0x000001B34D8B0000-0x000001B34D8B1000-memory.dmpFilesize
4KB
-
memory/3592-30-0x000001B34D8B0000-0x000001B34D8B1000-memory.dmpFilesize
4KB
-
memory/3592-29-0x000001B34D8B0000-0x000001B34D8B1000-memory.dmpFilesize
4KB
-
memory/3592-28-0x000001B34D8B0000-0x000001B34D8B1000-memory.dmpFilesize
4KB
-
memory/3592-27-0x000001B34D8B0000-0x000001B34D8B1000-memory.dmpFilesize
4KB
-
memory/3592-26-0x000001B34D8B0000-0x000001B34D8B1000-memory.dmpFilesize
4KB
-
memory/4048-0-0x000000007495E000-0x000000007495F000-memory.dmpFilesize
4KB
-
memory/4048-1-0x0000000000B20000-0x0000000000B32000-memory.dmpFilesize
72KB