Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
23-05-2024 19:24
General
-
Target
skididbop.exe
-
Size
45KB
-
MD5
3c8c937572ec914fcec514388198512c
-
SHA1
45b51ee6aa6eaa491dde2e536ccfeb93f13519a4
-
SHA256
dd4b30cd3c1ed3b6ff0952f5aa9e14a334a4bd11a09cdc7ab37aa45cfd739328
-
SHA512
0303eb186bf0b388b23a359992386da1b4f65988655590717bc37ac6860a2529eae575ee0d03245b94c1e6c68cea5731ce46dfe2f373bb856cb43a874edbf6e6
-
SSDEEP
768:6dhO/poiiUcjlJInVFH9Xqk5nWEZ5SbTDa/WI7CPW5N:cw+jjgnrH9XqcnW85SbTWWIF
Malware Config
Extracted
xenorat
45.88.186.12
2
-
install_path
appdata
-
port
5050
-
startup_name
svchost
Signatures
-
XenorRat
XenorRat is a remote access trojan written in C#.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\skididbop.exe"C:\Users\Admin\AppData\Local\Temp\skididbop.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XenoManager\skididbop.exe"C:\Users\Admin\AppData\Roaming\XenoManager\skididbop.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "svchost" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEA1.tmp" /F3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpEA1.tmpFilesize
1KB
MD5dc8677af1eb292ed4441e714ed6d7038
SHA1e2318c9551ec5aa9c86216068c7a5836c1c44af8
SHA256b3401a3ac9335049092975fd28904570aac36c1b3bfc9281bbbf73ab0c10e6ab
SHA512b1ff0c90f57a6257e8dec1ba8c6e1a54844b0db5ec90b3d1fc437484a6c2c0b88b7ea299311e4a6704533d9ffdb8a8bbc7f2998feae7b878d01bc3ab2f80d34f
-
\Users\Admin\AppData\Roaming\XenoManager\skididbop.exeFilesize
45KB
MD53c8c937572ec914fcec514388198512c
SHA145b51ee6aa6eaa491dde2e536ccfeb93f13519a4
SHA256dd4b30cd3c1ed3b6ff0952f5aa9e14a334a4bd11a09cdc7ab37aa45cfd739328
SHA5120303eb186bf0b388b23a359992386da1b4f65988655590717bc37ac6860a2529eae575ee0d03245b94c1e6c68cea5731ce46dfe2f373bb856cb43a874edbf6e6
-
memory/2236-0-0x0000000074C3E000-0x0000000074C3F000-memory.dmpFilesize
4KB
-
memory/2236-1-0x00000000000D0000-0x00000000000E2000-memory.dmpFilesize
72KB
-
memory/3056-9-0x0000000000850000-0x0000000000862000-memory.dmpFilesize
72KB
-
memory/3056-12-0x0000000074C30000-0x000000007531E000-memory.dmpFilesize
6.9MB
-
memory/3056-13-0x0000000074C30000-0x000000007531E000-memory.dmpFilesize
6.9MB
-
memory/3056-14-0x0000000074C30000-0x000000007531E000-memory.dmpFilesize
6.9MB
-
memory/3056-15-0x0000000074C30000-0x000000007531E000-memory.dmpFilesize
6.9MB
-
memory/3056-16-0x00000000007C0000-0x00000000007D2000-memory.dmpFilesize
72KB
-
memory/3056-17-0x0000000000780000-0x000000000078A000-memory.dmpFilesize
40KB