Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
01-06-2024 19:34
Static task
static1
Behavioral task
behavioral1
Sample
55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe
Resource
win7-20231129-en
General
-
Target
55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe
-
Size
243KB
-
MD5
2bd233b4d1cb93a0971748e038f7d5f4
-
SHA1
165447a2f77ea24155cd59afd2681f8703a52141
-
SHA256
55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872
-
SHA512
1b1a6ac49146cf6ffdb648ff1c7da6b66de1fb40ee056f12d9a5ec69cdcc00911567a6c6f82d504a654234c2fbc5fca2417d8c94437e0a6d65587aee0b009bd2
-
SSDEEP
6144:egh4hBiHKmDvP9hINHpcZ8S+jqv0LatcNAoYoBei/my3PQSeMQSI:cCqmj9SmKjqyatcN+4/my3PQSeMQX
Malware Config
Extracted
xenorat
dns.dobiamfollollc.online
Jolid_rat_nd8889g
-
delay
61000
-
install_path
appdata
-
port
1284
-
startup_name
hns
Signatures
-
Detects XenoRAT malware 3 IoCs
XenoRAT is an open-source remote access tool (RAT) developed in C#.
resource yara_rule behavioral1/memory/1976-11-0x0000000000400000-0x0000000000412000-memory.dmp XenoRAT behavioral1/memory/1976-9-0x0000000000400000-0x0000000000412000-memory.dmp XenoRAT behavioral1/memory/1976-7-0x0000000000400000-0x0000000000412000-memory.dmp XenoRAT -
Executes dropped EXE 4 IoCs
pid Process 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 2476 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 2732 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 2608 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe -
Loads dropped DLL 4 IoCs
pid Process 1116 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 1160 set thread context of 1888 1160 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 28 PID 1160 set thread context of 1976 1160 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 29 PID 1160 set thread context of 1116 1160 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 30 PID 2568 set thread context of 2476 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 32 PID 2568 set thread context of 2732 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 33 PID 2568 set thread context of 2608 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1276 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1160 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe Token: SeDebugPrivilege 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe -
Suspicious use of WriteProcessMemory 62 IoCs
description pid Process procid_target PID 1160 wrote to memory of 1888 1160 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 28 PID 1160 wrote to memory of 1888 1160 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 28 PID 1160 wrote to memory of 1888 1160 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 28 PID 1160 wrote to memory of 1888 1160 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 28 PID 1160 wrote to memory of 1888 1160 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 28 PID 1160 wrote to memory of 1888 1160 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 28 PID 1160 wrote to memory of 1888 1160 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 28 PID 1160 wrote to memory of 1888 1160 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 28 PID 1160 wrote to memory of 1888 1160 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 28 PID 1160 wrote to memory of 1976 1160 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 29 PID 1160 wrote to memory of 1976 1160 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 29 PID 1160 wrote to memory of 1976 1160 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 29 PID 1160 wrote to memory of 1976 1160 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 29 PID 1160 wrote to memory of 1976 1160 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 29 PID 1160 wrote to memory of 1976 1160 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 29 PID 1160 wrote to memory of 1976 1160 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 29 PID 1160 wrote to memory of 1976 1160 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 29 PID 1160 wrote to memory of 1976 1160 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 29 PID 1160 wrote to memory of 1116 1160 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 30 PID 1160 wrote to memory of 1116 1160 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 30 PID 1160 wrote to memory of 1116 1160 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 30 PID 1160 wrote to memory of 1116 1160 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 30 PID 1160 wrote to memory of 1116 1160 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 30 PID 1160 wrote to memory of 1116 1160 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 30 PID 1160 wrote to memory of 1116 1160 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 30 PID 1160 wrote to memory of 1116 1160 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 30 PID 1160 wrote to memory of 1116 1160 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 30 PID 1116 wrote to memory of 2568 1116 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 31 PID 1116 wrote to memory of 2568 1116 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 31 PID 1116 wrote to memory of 2568 1116 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 31 PID 1116 wrote to memory of 2568 1116 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 31 PID 2568 wrote to memory of 2476 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 32 PID 2568 wrote to memory of 2476 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 32 PID 2568 wrote to memory of 2476 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 32 PID 2568 wrote to memory of 2476 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 32 PID 2568 wrote to memory of 2476 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 32 PID 2568 wrote to memory of 2476 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 32 PID 2568 wrote to memory of 2476 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 32 PID 2568 wrote to memory of 2476 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 32 PID 2568 wrote to memory of 2476 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 32 PID 2568 wrote to memory of 2732 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 33 PID 2568 wrote to memory of 2732 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 33 PID 2568 wrote to memory of 2732 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 33 PID 2568 wrote to memory of 2732 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 33 PID 2568 wrote to memory of 2732 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 33 PID 2568 wrote to memory of 2732 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 33 PID 2568 wrote to memory of 2732 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 33 PID 2568 wrote to memory of 2732 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 33 PID 2568 wrote to memory of 2732 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 33 PID 2568 wrote to memory of 2608 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 34 PID 2568 wrote to memory of 2608 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 34 PID 2568 wrote to memory of 2608 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 34 PID 2568 wrote to memory of 2608 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 34 PID 2568 wrote to memory of 2608 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 34 PID 2568 wrote to memory of 2608 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 34 PID 2568 wrote to memory of 2608 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 34 PID 2568 wrote to memory of 2608 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 34 PID 2568 wrote to memory of 2608 2568 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 34 PID 1976 wrote to memory of 1276 1976 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 37 PID 1976 wrote to memory of 1276 1976 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 37 PID 1976 wrote to memory of 1276 1976 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 37 PID 1976 wrote to memory of 1276 1976 55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe"C:\Users\Admin\AppData\Local\Temp\55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exeC:\Users\Admin\AppData\Local\Temp\55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe2⤵PID:1888
-
-
C:\Users\Admin\AppData\Local\Temp\55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exeC:\Users\Admin\AppData\Local\Temp\55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "hns" /XML "C:\Users\Admin\AppData\Local\Temp\tmp493.tmp" /F3⤵
- Creates scheduled task(s)
PID:1276
-
-
-
C:\Users\Admin\AppData\Local\Temp\55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exeC:\Users\Admin\AppData\Local\Temp\55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Roaming\XenoManager\55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe"C:\Users\Admin\AppData\Roaming\XenoManager\55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Roaming\XenoManager\55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exeC:\Users\Admin\AppData\Roaming\XenoManager\55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe4⤵
- Executes dropped EXE
PID:2476
-
-
C:\Users\Admin\AppData\Roaming\XenoManager\55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exeC:\Users\Admin\AppData\Roaming\XenoManager\55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe4⤵
- Executes dropped EXE
PID:2732
-
-
C:\Users\Admin\AppData\Roaming\XenoManager\55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exeC:\Users\Admin\AppData\Roaming\XenoManager\55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe4⤵
- Executes dropped EXE
PID:2608
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD568b52be4e04a83f4a58384955c71b47a
SHA1f4e30617ff3c5ecb9da5c663447569b3c2b681fe
SHA25657297141cac0dbc7bf22800a5f925f1258c45b067aeed8acb5bf0dfabade5f51
SHA51277e3a8617ca51ee29d7237339e5c1d08abacb43d491a7289ac9d14a78b9f5ea1303589d0673d8d995b3b6129803f696cba0ee85375e932ed29cd31dd4b6f9aa7
-
C:\Users\Admin\AppData\Roaming\XenoManager\55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe
Filesize243KB
MD52bd233b4d1cb93a0971748e038f7d5f4
SHA1165447a2f77ea24155cd59afd2681f8703a52141
SHA25655066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872
SHA5121b1a6ac49146cf6ffdb648ff1c7da6b66de1fb40ee056f12d9a5ec69cdcc00911567a6c6f82d504a654234c2fbc5fca2417d8c94437e0a6d65587aee0b009bd2