Malware Analysis Report

2024-08-06 18:23

Sample ID 240531-jn9rqsbg7w
Target Pago_transferencia.exe
SHA256 acb620ecc1205abaff13777bd804a1f921a420c0c4765f1c6682c927f1b66f6e
Tags
xenorat rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

acb620ecc1205abaff13777bd804a1f921a420c0c4765f1c6682c927f1b66f6e

Threat Level: Known bad

The file Pago_transferencia.exe was found to be: Known bad.

Malicious Activity Summary

xenorat rat trojan

XenorRat

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Persistence
TA0003
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-31 07:50

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-31 07:50

Reported

2024-05-31 07:52

Platform

win10v2004-20240426-en

Max time kernel

147s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe"

Signatures

XenorRat

trojan rat xenorat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4404 set thread context of 3060 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 4404 set thread context of 4108 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 4404 set thread context of 4848 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 4560 set thread context of 1984 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 4560 set thread context of 1660 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 4560 set thread context of 1396 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4404 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 4404 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 4404 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 4404 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 4404 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 4404 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 4404 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 4404 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 4404 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 4404 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 4404 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 4404 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 4404 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 4404 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 4404 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 4404 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 4404 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 4404 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 4404 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 4404 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 4404 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 4404 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 4404 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 4404 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 4108 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 4108 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 4108 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 4560 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 4560 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 4560 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 4560 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 4560 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 4560 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 4560 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 4560 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 4560 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 4560 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 4560 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 4560 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 4560 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 4560 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 4560 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 4560 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 4560 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 4560 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 4560 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 4560 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 4560 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 4560 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 4560 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 4560 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 3060 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Windows\SysWOW64\schtasks.exe
PID 3060 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Windows\SysWOW64\schtasks.exe
PID 3060 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe

"C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe"

C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe

C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe

C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe

C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe

C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe

C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe

"C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe"

C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "hns" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4031.tmp" /F

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 dns.dobiamfollollc.online udp
NL 94.156.66.169:1284 dns.dobiamfollollc.online tcp
NL 94.156.66.169:1284 dns.dobiamfollollc.online tcp
NL 94.156.66.169:1284 dns.dobiamfollollc.online tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
NL 94.156.66.169:1284 dns.dobiamfollollc.online tcp
NL 94.156.66.169:1284 dns.dobiamfollollc.online tcp
NL 94.156.66.169:1284 dns.dobiamfollollc.online tcp
NL 94.156.66.169:1284 dns.dobiamfollollc.online tcp

Files

memory/4404-0-0x00000000749DE000-0x00000000749DF000-memory.dmp

memory/4404-1-0x0000000000700000-0x0000000000746000-memory.dmp

memory/4404-2-0x0000000002BA0000-0x0000000002BA6000-memory.dmp

memory/4404-3-0x00000000749D0000-0x0000000075180000-memory.dmp

memory/4404-4-0x0000000002C10000-0x0000000002C50000-memory.dmp

memory/4404-5-0x0000000005390000-0x000000000542C000-memory.dmp

memory/4404-6-0x00000000059E0000-0x0000000005F84000-memory.dmp

memory/4404-7-0x00000000054D0000-0x0000000005562000-memory.dmp

memory/4404-8-0x0000000005430000-0x0000000005436000-memory.dmp

memory/3060-9-0x0000000000400000-0x0000000000412000-memory.dmp

memory/3060-12-0x00000000749D0000-0x0000000075180000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Pago_transferencia.exe.log

MD5 d95c58e609838928f0f49837cab7dfd2
SHA1 55e7139a1e3899195b92ed8771d1ca2c7d53c916
SHA256 0407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339
SHA512 405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d

memory/4108-15-0x00000000749D0000-0x0000000075180000-memory.dmp

memory/4848-17-0x00000000749D0000-0x0000000075180000-memory.dmp

memory/3060-18-0x00000000749D0000-0x0000000075180000-memory.dmp

memory/4404-26-0x00000000749D0000-0x0000000075180000-memory.dmp

C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe

MD5 46d15e0b7105b6a1e499843065583960
SHA1 71119b1d895f728026a27d6d7db519f6d0044baa
SHA256 acb620ecc1205abaff13777bd804a1f921a420c0c4765f1c6682c927f1b66f6e
SHA512 ec546e0ed7cad0ac2f518e64041da796a386f3ae368ab1abd49642827b7e1ebda06afa8ca90fbc660e752fa051edf6215958c7bb4d09237a6c1e6c694acaca73

memory/4108-30-0x00000000749D0000-0x0000000075180000-memory.dmp

memory/3060-37-0x00000000749D0000-0x0000000075180000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp4031.tmp

MD5 525b73703e96a6750bb731fd48003c31
SHA1 0097fffe5fa518bdaffc37b8aad7bec95d4a2fd2
SHA256 18c64a88a073a69bd3ba18dbeae6d97eaf407ca8d04eba3b9e1648d7605dc444
SHA512 5718d58e7edde070a0b6d45bd485e3ae60955578ca2aafbb9b70b8201eb148891e1f221221ef10b08875ee69a8733109376c5264e1ab2a007a20436a8996b089

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-31 07:50

Reported

2024-05-31 07:52

Platform

win7-20231129-en

Max time kernel

143s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe"

Signatures

XenorRat

trojan rat xenorat

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3044 set thread context of 2788 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 3044 set thread context of 3052 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 3044 set thread context of 2244 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 2592 set thread context of 2596 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2592 set thread context of 2516 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2592 set thread context of 2472 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3044 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 3044 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 3044 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 3044 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 3044 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 3044 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 3044 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 3044 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 3044 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 3044 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 3044 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 3044 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 3044 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 3044 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 3044 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 3044 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 3044 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 3044 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 3044 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 3044 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 3044 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 3044 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 3044 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 3044 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 3044 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 3044 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 3044 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe
PID 2244 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2244 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2244 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2244 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2592 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2592 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2592 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2592 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2592 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2592 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2592 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2592 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2592 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2592 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2592 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2592 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2592 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2592 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2592 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2592 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2592 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2592 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2592 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2592 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2592 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2592 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2592 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2592 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2592 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2592 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2592 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe
PID 2788 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Windows\SysWOW64\schtasks.exe
PID 2788 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Windows\SysWOW64\schtasks.exe
PID 2788 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Windows\SysWOW64\schtasks.exe
PID 2788 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe

"C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe"

C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe

C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe

C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe

C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe

C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe

C:\Users\Admin\AppData\Local\Temp\Pago_transferencia.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe

"C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe"

C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe

C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "hns" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF6BE.tmp" /F

Network

Country Destination Domain Proto
US 8.8.8.8:53 dns.dobiamfollollc.online udp
NL 94.156.66.169:1284 dns.dobiamfollollc.online tcp
NL 94.156.66.169:1284 dns.dobiamfollollc.online tcp
NL 94.156.66.169:1284 dns.dobiamfollollc.online tcp
NL 94.156.66.169:1284 dns.dobiamfollollc.online tcp
NL 94.156.66.169:1284 dns.dobiamfollollc.online tcp
NL 94.156.66.169:1284 dns.dobiamfollollc.online tcp
NL 94.156.66.169:1284 dns.dobiamfollollc.online tcp
NL 94.156.66.169:1284 dns.dobiamfollollc.online tcp

Files

memory/3044-0-0x0000000074DCE000-0x0000000074DCF000-memory.dmp

memory/3044-1-0x0000000001320000-0x0000000001366000-memory.dmp

memory/3044-2-0x0000000000270000-0x0000000000276000-memory.dmp

memory/3044-3-0x0000000000610000-0x0000000000650000-memory.dmp

memory/3044-4-0x0000000074DC0000-0x00000000754AE000-memory.dmp

memory/3044-5-0x00000000002E0000-0x00000000002E6000-memory.dmp

memory/2788-6-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2788-16-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2788-8-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2788-23-0x0000000074DC0000-0x00000000754AE000-memory.dmp

C:\Users\Admin\AppData\Roaming\XenoManager\Pago_transferencia.exe

MD5 46d15e0b7105b6a1e499843065583960
SHA1 71119b1d895f728026a27d6d7db519f6d0044baa
SHA256 acb620ecc1205abaff13777bd804a1f921a420c0c4765f1c6682c927f1b66f6e
SHA512 ec546e0ed7cad0ac2f518e64041da796a386f3ae368ab1abd49642827b7e1ebda06afa8ca90fbc660e752fa051edf6215958c7bb4d09237a6c1e6c694acaca73

memory/3044-30-0x0000000074DC0000-0x00000000754AE000-memory.dmp

memory/2592-31-0x0000000000880000-0x00000000008C6000-memory.dmp

memory/2788-44-0x0000000074DC0000-0x00000000754AE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpF6BE.tmp

MD5 525b73703e96a6750bb731fd48003c31
SHA1 0097fffe5fa518bdaffc37b8aad7bec95d4a2fd2
SHA256 18c64a88a073a69bd3ba18dbeae6d97eaf407ca8d04eba3b9e1648d7605dc444
SHA512 5718d58e7edde070a0b6d45bd485e3ae60955578ca2aafbb9b70b8201eb148891e1f221221ef10b08875ee69a8733109376c5264e1ab2a007a20436a8996b089

memory/2788-47-0x0000000074DC0000-0x00000000754AE000-memory.dmp

memory/2788-48-0x0000000074DC0000-0x00000000754AE000-memory.dmp