xenorat | b9e61bef0d3bbe426ef78c71f18141967f2622d048fe0f24ccb80cdef75bb27f

Resubmissions

08-06-2024 04:31

240608-e5hmcshh95 10

02-06-2024 08:52

240602-ks7zdahc33 10

Analysis

max time kernel
1049s
max time network
977s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
02-06-2024 08:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

incognitobeta.exe
Size

45KB
MD5

e9fc233c0a49d897c3d5d86350986f19
SHA1

fa122e95d3b34518aff46efac9e7f56926b64e40
SHA256

b9e61bef0d3bbe426ef78c71f18141967f2622d048fe0f24ccb80cdef75bb27f
SHA512

de06a67f60959efb9bd89066b81e3ad788b1b49ae10ac19269914470fa7605bea95e3f98e348d2df67baf0efe310b6c2333c29e1d0ca2e6071db185aafecebd4
SSDEEP

768:hdhO/poiiUcjlJIn8tUH9Xqk5nWEZ5SbTDaaWI7CPW5Z:fw+jjgn6UH9XqcnW85SbTjWIh

Score

10^/10

xenorat rat trojan

Malware Config

Extracted

Family

xenorat

127.0.0.1

Mutex

incognito

Attributes

delay
5000
install_path
temp
port
4444
startup_name
USBsupervisor

Signatures

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat
Executes dropped EXE 6 IoCs

Processes:

incognitobeta.exeincognitobeta.exeincognitobeta.exeincognitobeta.exeincognitobeta.exeincognitobeta.exe

pid process

3056 incognitobeta.exe
2584 incognitobeta.exe
3592 incognitobeta.exe
4788 incognitobeta.exe
1980 incognitobeta.exe
3464 incognitobeta.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

4252 schtasks.exe
1204 schtasks.exe
4956 schtasks.exe
2328 schtasks.exe
3704 schtasks.exe
2984 schtasks.exe

pid	process
3056	incognitobeta.exe
2584	incognitobeta.exe
3592	incognitobeta.exe
4788	incognitobeta.exe
1980	incognitobeta.exe
3464	incognitobeta.exe

pid	process
4252	schtasks.exe
1204	schtasks.exe
4956	schtasks.exe
2328	schtasks.exe
3704	schtasks.exe
2984	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133617920024970798"	chrome.exe

Modifies registry class 1 IoCs

Processes:

MiniSearchHost.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe
NTFS ADS 1 IoCs

Processes:

chrome.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\incognitobeta.exe:Zone.Identifier chrome.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

1344 chrome.exe
1344 chrome.exe
1556 chrome.exe
1556 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

chrome.exe

pid process

1344 chrome.exe
1344 chrome.exe
1344 chrome.exe
1344 chrome.exe
1344 chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\incognitobeta.exe:Zone.Identifier	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exeAUDIODG.EXE

description	pid	process
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: 33	4444	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4444	AUDIODG.EXE
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

Processes:

chrome.exe

pid	process
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

chrome.exe

pid	process
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

MiniSearchHost.exe

pid process

2840 MiniSearchHost.exe

pid	process
2840	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

incognitobeta.exeincognitobeta.exechrome.exe

description	pid	process	target process
PID 1540 wrote to memory of 3056	1540	incognitobeta.exe	incognitobeta.exe
PID 1540 wrote to memory of 3056	1540	incognitobeta.exe	incognitobeta.exe
PID 1540 wrote to memory of 3056	1540	incognitobeta.exe	incognitobeta.exe
PID 3056 wrote to memory of 4252	3056	incognitobeta.exe	schtasks.exe
PID 3056 wrote to memory of 4252	3056	incognitobeta.exe	schtasks.exe
PID 3056 wrote to memory of 4252	3056	incognitobeta.exe	schtasks.exe
PID 1344 wrote to memory of 2196	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 2196	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 1652	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 1652	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 1652	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 1652	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 1652	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 1652	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 1652	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 1652	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 1652	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 1652	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 1652	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 1652	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 1652	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 1652	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 1652	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 1652	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 1652	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 1652	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 1652	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 1652	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 1652	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 1652	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 1652	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 1652	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 1652	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 1652	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 1652	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 1652	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 1652	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 1652	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 1652	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 3772	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 3772	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 852	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 852	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 852	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 852	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 852	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 852	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 852	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 852	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 852	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 852	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 852	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 852	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 852	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 852	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 852	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 852	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 852	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 852	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 852	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 852	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 852	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 852	1344	chrome.exe	chrome.exe
PID 1344 wrote to memory of 852	1344	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\incognitobeta.exe
"C:\Users\Admin\AppData\Local\Temp\incognitobeta.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1540

C:\Users\Admin\AppData\Local\Temp\XenoManager\incognitobeta.exe
"C:\Users\Admin\AppData\Local\Temp\XenoManager\incognitobeta.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /Create /TN "USBsupervisor" /XML "C:\Users\Admin\AppData\Local\Temp\tmp685F.tmp" /F
3⤵
- Creates scheduled task(s)
PID:4252

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1344

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe74edab58,0x7ffe74edab68,0x7ffe74edab78
2⤵
PID:2196

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1672 --field-trial-handle=1832,i,17824719868413612810,7112859909811461074,131072 /prefetch:2
2⤵
PID:1652

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1832,i,17824719868413612810,7112859909811461074,131072 /prefetch:8
2⤵
PID:3772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2200 --field-trial-handle=1832,i,17824719868413612810,7112859909811461074,131072 /prefetch:8
2⤵
PID:852

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3064 --field-trial-handle=1832,i,17824719868413612810,7112859909811461074,131072 /prefetch:1
2⤵
PID:1120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3160 --field-trial-handle=1832,i,17824719868413612810,7112859909811461074,131072 /prefetch:1
2⤵
PID:2012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4336 --field-trial-handle=1832,i,17824719868413612810,7112859909811461074,131072 /prefetch:1
2⤵
PID:1548

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4296 --field-trial-handle=1832,i,17824719868413612810,7112859909811461074,131072 /prefetch:8
2⤵
PID:2440

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4572 --field-trial-handle=1832,i,17824719868413612810,7112859909811461074,131072 /prefetch:8
2⤵
PID:1204

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 --field-trial-handle=1832,i,17824719868413612810,7112859909811461074,131072 /prefetch:8
2⤵
PID:3952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4936 --field-trial-handle=1832,i,17824719868413612810,7112859909811461074,131072 /prefetch:8
2⤵
PID:1556

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 --field-trial-handle=1832,i,17824719868413612810,7112859909811461074,131072 /prefetch:8
2⤵
PID:4352

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4696 --field-trial-handle=1832,i,17824719868413612810,7112859909811461074,131072 /prefetch:1
2⤵
PID:1720

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4652 --field-trial-handle=1832,i,17824719868413612810,7112859909811461074,131072 /prefetch:1
2⤵
PID:824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4088 --field-trial-handle=1832,i,17824719868413612810,7112859909811461074,131072 /prefetch:8
2⤵
PID:2224

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4276 --field-trial-handle=1832,i,17824719868413612810,7112859909811461074,131072 /prefetch:8
2⤵
PID:4856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5092 --field-trial-handle=1832,i,17824719868413612810,7112859909811461074,131072 /prefetch:8
2⤵
PID:2364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4372 --field-trial-handle=1832,i,17824719868413612810,7112859909811461074,131072 /prefetch:8
2⤵
PID:4612

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 --field-trial-handle=1832,i,17824719868413612810,7112859909811461074,131072 /prefetch:8
2⤵
- NTFS ADS
PID:2412

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3460 --field-trial-handle=1832,i,17824719868413612810,7112859909811461074,131072 /prefetch:8
2⤵
PID:4404

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5172 --field-trial-handle=1832,i,17824719868413612810,7112859909811461074,131072 /prefetch:8
2⤵
PID:4240

C:\Users\Admin\Downloads\incognitobeta.exe
"C:\Users\Admin\Downloads\incognitobeta.exe"
2⤵
- Executes dropped EXE
PID:2584

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /Create /TN "USBsupervisor" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4FC.tmp" /F
3⤵
- Creates scheduled task(s)
PID:1204

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1472 --field-trial-handle=1832,i,17824719868413612810,7112859909811461074,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1556

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:1176

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004D8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4444

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2188

C:\Users\Admin\Downloads\incognitobeta.exe
"C:\Users\Admin\Downloads\incognitobeta.exe"
1⤵
- Executes dropped EXE
PID:3592

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /Create /TN "USBsupervisor" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF49C.tmp" /F
2⤵
- Creates scheduled task(s)
PID:4956

C:\Users\Admin\AppData\Local\Temp\XenoManager\incognitobeta.exe
"C:\Users\Admin\AppData\Local\Temp\XenoManager\incognitobeta.exe"
1⤵
- Executes dropped EXE
PID:4788

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /Create /TN "USBsupervisor" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB2FA.tmp" /F
2⤵
- Creates scheduled task(s)
PID:2328

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2840

C:\Users\Admin\AppData\Local\Temp\XenoManager\incognitobeta.exe
"C:\Users\Admin\AppData\Local\Temp\XenoManager\incognitobeta.exe"
1⤵
- Executes dropped EXE
PID:1980

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /Create /TN "USBsupervisor" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4E02.tmp" /F
2⤵
- Creates scheduled task(s)
PID:3704

C:\Users\Admin\AppData\Local\Temp\XenoManager\incognitobeta.exe
"C:\Users\Admin\AppData\Local\Temp\XenoManager\incognitobeta.exe"
1⤵
- Executes dropped EXE
PID:3464

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /Create /TN "USBsupervisor" /XML "C:\Users\Admin\AppData\Local\Temp\tmp708E.tmp" /F
2⤵
- Creates scheduled task(s)
PID:2984

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
72B

MD5
ddb5535e497e266473f6d0e8dafe4545

SHA1
afea156792be7ad713dcbc5796af4b9636802830

SHA256
4cde2743003ac21bd3596d0af6cf5316d088abe381e68bfc2536f42a180bd2b8

SHA512
1f83f877f37857956be2a85c08b5fd8aa271e6a31391776e73789a153caf8bba35c8c015e422717418d35f6b0532649bde4f815cefe37c50b7c147c24af6c2d4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\p\Paths\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
9e39b67901e634dde2c83ddd0b95fa6e

SHA1
9b0eba702f5ddbb1bb4992c7a8c4cf2b17f369fc

SHA256
35edc3ad17139b3f17db096721921efaa088e436ad94e4eed98701ced0c26092

SHA512
b1afa40e307ab4b2d53828614d6d9848e194096ae343823960ab50b7833f7a0cf2491de88c53a96f730734af6734314bc4f1eae90b7d90c157ae0c4e165c033f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
523B

MD5
e3500fdf341e3e99af406a4f52a6ccaf

SHA1
308ca31cea384ee585612d2bd78bbc9e4f405ea1

SHA256
75542af7092b28d42a73e82bb7b90019bfdb777e74ad42d1f58f2330b7e93edd

SHA512
c42b49f64e535469e57d0af4fa4375ff03caff9fd72d8a768a8ce1d7de51ec96a88eea1e6a147041b03cf443b3c05b2c585e4d856f405265f08f2adefd9fdacc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
356B

MD5
f8182c36ea1c9956a44fd61d991cb1e0

SHA1
b8fba815cb85b07438959feba1ea93cd049af3ab

SHA256
ce1aa546d9a13c5f3625b866431addb1a913e1303f4e4c8e46c591b2b1525f3d

SHA512
4eb3c155bee46fc9dfb16f8aacc616178887f0eb9ea1ee3e0da9da8e2e181ef31197a7f354d71aeaf8f0815165d8a4d4b983c9d18d3fed1aa685f2290f3054a1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
967462ec4b0477302ab56a02e56e37f9

SHA1
14e1a65565788695ca435c75b29bba046d3bf5bc

SHA256
ba3a2d5cf2e93aa4eff7f70ab5dca547ec6c4dc1662b95613a537197fae110b5

SHA512
899396ffcc65ac8bf62c588aeffba88d8c9743406aa078f0d5e424f01a0b5000fd2921a51d734cbf6fbf3f94258bac8c7105a8af8dddef44128d75a80d1c36f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
97e916f25c85ce6832b145f746600b8a

SHA1
8b271041493aa3ebefbcce3a76a64121deb7ad03

SHA256
e0084ef2b6f6b47d83c859f7d1f0fd97097830d45cb02e5ee623cb3356afad3b

SHA512
9f4ece2878ed0fc6aa263fb18705e60e8ba587db6eae1359bdbfe2bfe8c59cab8ab32cea50b195d66a29f363a106ec66a6c73d7898785542527d6a74779dfcc0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
a7cc0bec35062bb409ee5ccc0fe957b5

SHA1
a9ba275f75d5f03642052f73978a5e1f4a6d94db

SHA256
196dbc78f46ad1bba58f97addaf9ae597f049ac86ee8ba1404218d46ac994949

SHA512
fd5883327ac0bc311f2f202b45ac4bd4f19658d5c074dca54c4b376b94022a456e21a7728cc8c10b526a15a0172c0bce776ef79ca11f4de9ef1b6682a2d74b2e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
16KB

MD5
104d0ed613f3fce00a95032272bd94e0

SHA1
89bd5727e9eb431b1b53ee2f18e9230c3244c222

SHA256
af5ada2fa9e389fa536bd29b20b33743c9d125146c37820419d19013fd39b831

SHA512
dccf27c60064539df6c608bb2f9e7f839287c4fa288fa742beb7e6b2455eb0b0b50eed35b27c4ecca5aae21ce2047ef25a6fcff8400387d379393177769a5964

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
96B

MD5
5a94c6dff6c34e1a60762f332b1402bd

SHA1
8242d763165a5bbe8013589caf0d7cd745e5b391

SHA256
c255e278e68b104061fc8fbed990dd2a9b820bf5ed8023cb2fb7755d922272ac

SHA512
744c745c709b3f730ba9fb87a51d43fe99e18f53f8c8e061674c5c666cdaa291a4954a10d8447a2dc251f6e8a1a6c15a07ce4df3453e8dd2e8fff3bacfe7f581

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
261KB

MD5
3919ee4804a087250b029d8d7bd2a83d

SHA1
470e403e908f5a1167c0d87a25429e97d4e64c7f

SHA256
2b9deef900b935848987b3d5f600fc91564d9fd116b74a3b457179abf4c65a3f

SHA512
49498dbb87f2226686eed1fa130eb89375914cfbdd8e3d61fc2d3f50f78b06a1955f9d7862a7b48c6b0354b3f7259982e05482fa60d1b1f98d02ad706b865bd5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
98KB

MD5
11fba2a66a7b4e2affb80e51f21695f8

SHA1
0beaddac8b07979bad0de99afcd62fdd12e442b4

SHA256
d0420ce7a846ce5caf7d7624c53717daeb629fd518801f26a98806de504aac5d

SHA512
a4290ba501b845a73500bea44884d825b7f58440d8011498eb8834eb5a8b411f03a688e76b31319eca1d2176affdb71d0cdb0aa72bb3d296bfa7d03754cc3d7e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe581884.TMP
Filesize
83KB

MD5
48294e2b62d79d81de52035ffcd37b6b

SHA1
105650bf112a3174930debbc74481e02d11cfe9f

SHA256
7c2da53b489b57fa704c9697d1b2496a14df18b85a0840f677d177cd8eb7a511

SHA512
30f20077fa0be7574bccaa233eadc1b06492e7f9d128575c919a48f09f5b7e48a2c08d58daf86a01f27967aa8d5132b625542c857e94bfa12c071a06cbd78369

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\incognitobeta.exe.log
Filesize
226B

MD5
1294de804ea5400409324a82fdc7ec59

SHA1
9a39506bc6cadf99c1f2129265b610c69d1518f7

SHA256
494398ec6108c68573c366c96aae23d35e7f9bdbb440a4aab96e86fcad5871d0

SHA512
033905cc5b4d0c0ffab2138da47e3223765146fa751c9f84b199284b653a04874c32a23aae577d2e06ce6c6b34fec62331b5fc928e3baf68dc53263ecdfa10c1

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize
10KB

MD5
6e2dd918b2c22ec9d38424b34577d88b

SHA1
ce9b5ec7934ace13a02d64f494ec8cf6de8ce5c9

SHA256
037e7f2cd9d518cafd37f55edee61feac13b4dfdd35f67b41d7af525d93b7f0f

SHA512
fe292b07ea0f7db690e00640f29b5cf7de32ddcdc887c24075801e1b7ad756e94dab31e297efff6c9def49ec3ac20e22c71ba40afb7e4fb75bf0678b64328eca

Download Submit
C:\Users\Admin\AppData\Local\Temp\XenoManager\incognitobeta.exe
Filesize
45KB

MD5
e9fc233c0a49d897c3d5d86350986f19

SHA1
fa122e95d3b34518aff46efac9e7f56926b64e40

SHA256
b9e61bef0d3bbe426ef78c71f18141967f2622d048fe0f24ccb80cdef75bb27f

SHA512
de06a67f60959efb9bd89066b81e3ad788b1b49ae10ac19269914470fa7605bea95e3f98e348d2df67baf0efe310b6c2333c29e1d0ca2e6071db185aafecebd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4FC.tmp
Filesize
1KB

MD5
ca4ca40491a93a911b17bc514c823008

SHA1
01a1a262d989ebedcea1adb2759cc777c693cc4b

SHA256
ae114e800e7c731cc2df421131355d9144dbf560f9717e57f30607fd465d0d76

SHA512
bc6fd439ea0defc06454a85b2a6302690901a5d3e4c8b64fab5f099d596412653fe061f0090daefceb62d334a64f33660beccdfc622bf76e6aa1b675b0083f51

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp685F.tmp
Filesize
1KB

MD5
0ee58773051bcc7078f9f29474b1eadd

SHA1
7f49e6cfd836b54c08f966e32c9f1f5670fe3dfb

SHA256
ebc60f1db998381cbe8a1a62ff1fef0516f8ba2b03ca61883de1238581b48338

SHA512
3e68474c21230eae6197f5dbd2aa35fe7208fa9fa2f3687cdd5e2f7c3b75272552a85e3979617c00c58a97e2660a3eaee183c8f0c9599f7da2de23ddd72f328c

Download Submit
C:\Users\Admin\Downloads\incognitobeta.exe:Zone.Identifier
Filesize
52B

MD5
dfcb8dc1e74a5f6f8845bcdf1e3dee6c

SHA1
ba515dc430c8634db4900a72e99d76135145d154

SHA256
161510bd3ea26ff17303de536054637ef1de87a9bd6966134e85d47fc4448b67

SHA512
c0eff5861c2df0828f1c1526536ec6a5a2e625a60ab75e7051a54e6575460c3af93d1452e75ca9a2110f38a84696c7e0e1e44fb13daa630ffcdda83db08ff78d

Download Submit
\??\pipe\crashpad_1344_FHRJLHFTQDTNAIWB
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1540-0-0x00000000747BE000-0x00000000747BF000-memory.dmp

Filesize
4KB

Download
memory/1540-1-0x0000000000BB0000-0x0000000000BC2000-memory.dmp

Filesize
72KB

Download
memory/3056-75-0x00000000747B0000-0x0000000074F61000-memory.dmp

Filesize
7.7MB

Download
memory/3056-67-0x00000000747B0000-0x0000000074F61000-memory.dmp

Filesize
7.7MB

Download
memory/3056-15-0x00000000747B0000-0x0000000074F61000-memory.dmp

Filesize
7.7MB

Download