Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 12:58
Behavioral task
behavioral1
Sample
GT Proxy.exe
Resource
win7-20240221-en
General
-
Target
GT Proxy.exe
-
Size
310KB
-
MD5
85cfe597bd2fb4ea20e68f83f47b7df4
-
SHA1
4ab1dea0fadc87022dab356b02a759f72ec30c2d
-
SHA256
4735fa85ee766193771be94023eabf93f7763ab742cdd0c0bf5a84e36bcaef3a
-
SHA512
44087253b541b64a43eb60051420a8f25cfc571eb0e357864cce50a44ab709f7eb27d9054444dacd32645d0b4a7b53f25003b30c9452e079921be154d89a859f
-
SSDEEP
6144:LWP91UbeeC+5r6PmRIoS5P7xVEDc7SuDSSwb:Lw8CB9V5b
Malware Config
Extracted
xenorat
149.0.26.4
Growtopia_4232
-
delay
5000
-
install_path
appdata
-
port
4444
-
startup_name
nothingset
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
GT Proxy.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation GT Proxy.exe -
Executes dropped EXE 1 IoCs
Processes:
GT Proxy.exepid process 1656 GT Proxy.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
GT Proxy.exedescription pid process target process PID 760 wrote to memory of 1656 760 GT Proxy.exe GT Proxy.exe PID 760 wrote to memory of 1656 760 GT Proxy.exe GT Proxy.exe PID 760 wrote to memory of 1656 760 GT Proxy.exe GT Proxy.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\GT Proxy.exe"C:\Users\Admin\AppData\Local\Temp\GT Proxy.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XenoManager\GT Proxy.exe"C:\Users\Admin\AppData\Roaming\XenoManager\GT Proxy.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\XenoManager\GT Proxy.exeFilesize
310KB
MD585cfe597bd2fb4ea20e68f83f47b7df4
SHA14ab1dea0fadc87022dab356b02a759f72ec30c2d
SHA2564735fa85ee766193771be94023eabf93f7763ab742cdd0c0bf5a84e36bcaef3a
SHA51244087253b541b64a43eb60051420a8f25cfc571eb0e357864cce50a44ab709f7eb27d9054444dacd32645d0b4a7b53f25003b30c9452e079921be154d89a859f
-
memory/760-0-0x000000007449E000-0x000000007449F000-memory.dmpFilesize
4KB
-
memory/760-1-0x0000000000CE0000-0x0000000000D34000-memory.dmpFilesize
336KB
-
memory/1656-14-0x0000000074490000-0x0000000074C40000-memory.dmpFilesize
7.7MB
-
memory/1656-15-0x0000000074490000-0x0000000074C40000-memory.dmpFilesize
7.7MB