Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
30-05-2024 02:40
General
-
Target
wavepublicbeta.exe
-
Size
45KB
-
MD5
4186d43679d969e99c418e70d809a847
-
SHA1
bc4e6d7fa8bac30f2740f998b89f93ae70796c16
-
SHA256
de2c417b12a1868844093165b3f764e4c244d67097c16e658e7e7837889b4373
-
SHA512
d13476da1c1c1ef43196496b81a18b53743a340457a57e17898d0af7004bc6bcf1692273776b615d5e6e6695343b7fd26765561e2998d7b9fae11aed2e178347
-
SSDEEP
768:FdhO/poiiUcjlJInBVH9Xqk5nWEZ5SbTDaSuI7CPW5N:bw+jjgnXH9XqcnW85SbTnuIl
Malware Config
Extracted
xenorat
david-login.gl.at.ply.gg
Xeno_rat_nd8912d
-
delay
5000
-
install_path
nothingset
-
port
54479
-
startup_name
nothingset
Signatures
-
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 224 schtasks.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe 4180 wavepublicbeta.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4180 wavepublicbeta.exe Token: SeDebugPrivilege 3984 firefox.exe Token: SeDebugPrivilege 3984 firefox.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3984 firefox.exe 3984 firefox.exe 3984 firefox.exe 3984 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3984 firefox.exe 3984 firefox.exe 3984 firefox.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4180 wavepublicbeta.exe 3984 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2784 wrote to memory of 3984 2784 firefox.exe 78 PID 2784 wrote to memory of 3984 2784 firefox.exe 78 PID 2784 wrote to memory of 3984 2784 firefox.exe 78 PID 2784 wrote to memory of 3984 2784 firefox.exe 78 PID 2784 wrote to memory of 3984 2784 firefox.exe 78 PID 2784 wrote to memory of 3984 2784 firefox.exe 78 PID 2784 wrote to memory of 3984 2784 firefox.exe 78 PID 2784 wrote to memory of 3984 2784 firefox.exe 78 PID 2784 wrote to memory of 3984 2784 firefox.exe 78 PID 2784 wrote to memory of 3984 2784 firefox.exe 78 PID 2784 wrote to memory of 3984 2784 firefox.exe 78 PID 3984 wrote to memory of 2396 3984 firefox.exe 79 PID 3984 wrote to memory of 2396 3984 firefox.exe 79 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 484 3984 firefox.exe 80 PID 3984 wrote to memory of 1688 3984 firefox.exe 81 PID 3984 wrote to memory of 1688 3984 firefox.exe 81 PID 3984 wrote to memory of 1688 3984 firefox.exe 81 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\wavepublicbeta.exe"C:\Users\Admin\AppData\Local\Temp\wavepublicbeta.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4180 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "XenoUpdateManager" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2ADF.tmp" /F2⤵
- Creates scheduled task(s)
PID:224
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3348
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3984.0.153246496\739819434" -parentBuildID 20221007134813 -prefsHandle 1680 -prefMapHandle 1672 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d1902e6c-1847-4262-8c85-d91897283851} 3984 "\\.\pipe\gecko-crash-server-pipe.3984" 1760 2337fc05658 gpu3⤵PID:2396
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3984.1.1988010980\996376036" -parentBuildID 20221007134813 -prefsHandle 2104 -prefMapHandle 2100 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ffa34ada-d60c-4608-9cea-a93d75bf2ecd} 3984 "\\.\pipe\gecko-crash-server-pipe.3984" 2116 2337e63f158 socket3⤵
- Checks processor information in registry
PID:484
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3984.2.1779161057\1893823732" -childID 1 -isForBrowser -prefsHandle 2636 -prefMapHandle 2740 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1080 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bbf8c78f-e14f-40af-815a-d44d45eb1deb} 3984 "\\.\pipe\gecko-crash-server-pipe.3984" 2944 2330c496258 tab3⤵PID:1688
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3984.3.200189947\2062920680" -childID 2 -isForBrowser -prefsHandle 3388 -prefMapHandle 3384 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1080 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9e8d931-f4ae-4948-9fe8-f2dd56862975} 3984 "\\.\pipe\gecko-crash-server-pipe.3984" 3400 23375e69658 tab3⤵PID:3364
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3984.4.96412497\315112256" -childID 3 -isForBrowser -prefsHandle 4436 -prefMapHandle 4432 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1080 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b19af26-d9fc-4a7a-84b9-2cfdfb3e6845} 3984 "\\.\pipe\gecko-crash-server-pipe.3984" 4448 2330e224e58 tab3⤵PID:2488
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3984.5.1178752016\1872602243" -childID 4 -isForBrowser -prefsHandle 4932 -prefMapHandle 4928 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1080 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {609bb069-bd68-47ae-89e2-8885254c26c8} 3984 "\\.\pipe\gecko-crash-server-pipe.3984" 4940 2330e589958 tab3⤵PID:2860
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3984.6.2017594752\874604100" -childID 5 -isForBrowser -prefsHandle 3608 -prefMapHandle 4820 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1080 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fcae9bd6-d97d-4e8a-9e11-a0a85d72edb3} 3984 "\\.\pipe\gecko-crash-server-pipe.3984" 4956 2330e589658 tab3⤵PID:4044
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3984.7.482039004\581236093" -childID 6 -isForBrowser -prefsHandle 5164 -prefMapHandle 5168 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1080 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ca371c8-e238-4b34-b980-70f998897db2} 3984 "\\.\pipe\gecko-crash-server-pipe.3984" 5156 2330e589f58 tab3⤵PID:4608
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3984.8.1245781838\2130296915" -childID 7 -isForBrowser -prefsHandle 5512 -prefMapHandle 2952 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1080 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b9cdac03-df20-4535-b5f5-32304ee82100} 3984 "\\.\pipe\gecko-crash-server-pipe.3984" 5528 2330b121658 tab3⤵PID:2584
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5000519ca8a4cd99742492f31c782bd21
SHA18b8546abf1c2480e68c02e42c9608b3881bba83b
SHA2568a2096a786dd2d63fa072acac9460c9e2a4ce2c056c7ec4faa24b19284de7881
SHA5127883e1a3ade0534f2b0c05c1ed7b7d3ff27b2b7dea7bf55e59e4b819bb502c685ce06444b013e7f35c5ee8315025eadacee2d0eecb7b643e0e8efee381c99b75
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin
Filesize9KB
MD58f6ec2f03ff6c95d17db0d91be09d6f6
SHA1ab4d2a3e49e0cea898362c0db658a693e77d6647
SHA256565d013ec4924fe599e3306bdfe3bc9b7e33fe205dc58916f9e2f889fc3555b3
SHA512bf628f8bd88b8297d13014b22e69db3c4747a16d92250698239c730821e196545ff9730c4579f4e073c58c1b09bf3b994dde33612b57d74c801768941520fd1a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\ae621759-fd96-4088-b64b-12ed88cb8d96
Filesize734B
MD5377fb8e8d455defa5acc19df996a59f6
SHA1e2d5def78ee5bd9c5ab9d8c7e3e5b37046640f73
SHA256bb6bacf32c78418b4cbb05a103584e0a498af31e777fd8cb0c9ccb1160c0aaf6
SHA512cc9e9048f779c074d1b5e583e60e1dfad29c869825f91804a7ec1f1eb956ba21ab96b238293f0f6edb740cf4ed5026da4c748a83035a47ad0782f58c5431865d
-
Filesize
6KB
MD591e8c79815c1f140ecf20675d0681ef8
SHA1805c137fb16df2c9ba865e5a900efb8f6eb1cb62
SHA2560f41ca8da5526b10ee4732e51bbe55891596f1fce5eedb76fe31eaf6a17a18d6
SHA512cf4beb4366afe88a1a94d10c0f7a3eb92d59ad61e190c51e1634a5b04ddf8900e38c2d45323a1988f4ab21f95a68abeb0188401c64060464dfc69218098679b9
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize3KB
MD5b87440c63ad1ee63f6c2417469d99d0d
SHA1c587afd4942ddbb79e4b9eef37bc9c8a69ce53b2
SHA256e033b9446c27134f517dcba1846a8d2d9077ca10506c14820d3a3f5eabe580a7
SHA512aa0e87672c4cc4e612df30cac7ac0e09e08df913205e4cf0de5a81bd56788de5bff57f68dfc6c4233829e2c120721863949b09d828fe75ed298f02b5554201a8
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore.jsonlz4
Filesize4KB
MD5107752799302b34ae00d2b3a38086d20
SHA1a9a344ffeb875ee663fb6004c1a00766be54d44b
SHA2560cc53aa599eed0dd247893bedab4968a1000616793f922c8a969043e45bad9f5
SHA512f1aeeaadc771e7dc0849a8581ef57fc96ac1fa4f5325ba322311ed66db72226775f195be0017824d9908d2515f4356271135032f8a66924b0da18d437459431a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize184KB
MD57f868e557b098795d645df9ea302427f
SHA1001f3306144559b4049a8ab139b4139f51e59c0e
SHA256b228e23ecfb7965e3badefcbb031de0b4bb887634bccb34a826ac8ac89124ac5
SHA51256fd8aa514cc25db5a2c9191d665eaffe90182cc5e4f15317e0cfbc9adf7336d9ad937d20384b0504f784e5939b76b4c4b0020cb06e4a472c650355cc6c4c89a