Analysis
-
max time kernel
140s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04-06-2024 19:46
Static task
static1
Behavioral task
behavioral1
Sample
payment.exe
Resource
win7-20240508-en
General
-
Target
payment.exe
-
Size
242KB
-
MD5
eebe7da6234f15c2055ddff4b4da6948
-
SHA1
76dc426d92a7785677d2ab1ac4cf7c1a63f6af48
-
SHA256
5a74ace81656d018cc01e7db0cf24abe072524df6c297fa2081019e89680e5e1
-
SHA512
0e088d5892921d67df1703f5e958a549b32fee13865af459212c0b6fd2f928b8f0534dccf17c1727d7e4fcb6162d90085736f3d58ba801c2fd285d8a9c01abd8
-
SSDEEP
6144:F1gj4ZzsyX3tzfeVcVz3xkQm3S4eWwNZE3UJxI:F1gj4J7feV6Zr9NZE3UJq
Malware Config
Extracted
xenorat
dns.dobiamfollollc.online
Solid_rat_nd8889g
-
delay
61000
-
install_path
appdata
-
port
1283
-
startup_name
bns
Signatures
-
Detects XenoRAT malware 1 IoCs
XenoRAT is an open-source remote access tool (RAT) developed in C#.
Processes:
resource yara_rule behavioral2/memory/3872-10-0x0000000000400000-0x0000000000412000-memory.dmp XenoRAT -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
payment.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation payment.exe -
Executes dropped EXE 4 IoCs
Processes:
payment.exepayment.exepayment.exepayment.exepid process 1168 payment.exe 2864 payment.exe 3624 payment.exe 3656 payment.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
payment.exepayment.exedescription pid process target process PID 2028 set thread context of 2236 2028 payment.exe payment.exe PID 2028 set thread context of 3872 2028 payment.exe payment.exe PID 2028 set thread context of 908 2028 payment.exe payment.exe PID 1168 set thread context of 2864 1168 payment.exe payment.exe PID 1168 set thread context of 3624 1168 payment.exe payment.exe PID 1168 set thread context of 3656 1168 payment.exe payment.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3984 2236 WerFault.exe payment.exe 4048 2864 WerFault.exe payment.exe 4720 3656 WerFault.exe payment.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
payment.exepayment.exedescription pid process Token: SeDebugPrivilege 2028 payment.exe Token: SeDebugPrivilege 1168 payment.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
payment.exepayment.exepayment.exepayment.exedescription pid process target process PID 2028 wrote to memory of 2236 2028 payment.exe payment.exe PID 2028 wrote to memory of 2236 2028 payment.exe payment.exe PID 2028 wrote to memory of 2236 2028 payment.exe payment.exe PID 2028 wrote to memory of 2236 2028 payment.exe payment.exe PID 2028 wrote to memory of 2236 2028 payment.exe payment.exe PID 2028 wrote to memory of 2236 2028 payment.exe payment.exe PID 2028 wrote to memory of 2236 2028 payment.exe payment.exe PID 2028 wrote to memory of 2236 2028 payment.exe payment.exe PID 2028 wrote to memory of 3872 2028 payment.exe payment.exe PID 2028 wrote to memory of 3872 2028 payment.exe payment.exe PID 2028 wrote to memory of 3872 2028 payment.exe payment.exe PID 2028 wrote to memory of 3872 2028 payment.exe payment.exe PID 2028 wrote to memory of 3872 2028 payment.exe payment.exe PID 2028 wrote to memory of 3872 2028 payment.exe payment.exe PID 2028 wrote to memory of 3872 2028 payment.exe payment.exe PID 2028 wrote to memory of 3872 2028 payment.exe payment.exe PID 2028 wrote to memory of 908 2028 payment.exe payment.exe PID 2028 wrote to memory of 908 2028 payment.exe payment.exe PID 2028 wrote to memory of 908 2028 payment.exe payment.exe PID 2028 wrote to memory of 908 2028 payment.exe payment.exe PID 2028 wrote to memory of 908 2028 payment.exe payment.exe PID 2028 wrote to memory of 908 2028 payment.exe payment.exe PID 2028 wrote to memory of 908 2028 payment.exe payment.exe PID 2028 wrote to memory of 908 2028 payment.exe payment.exe PID 908 wrote to memory of 1168 908 payment.exe payment.exe PID 908 wrote to memory of 1168 908 payment.exe payment.exe PID 908 wrote to memory of 1168 908 payment.exe payment.exe PID 1168 wrote to memory of 2864 1168 payment.exe payment.exe PID 1168 wrote to memory of 2864 1168 payment.exe payment.exe PID 1168 wrote to memory of 2864 1168 payment.exe payment.exe PID 1168 wrote to memory of 2864 1168 payment.exe payment.exe PID 1168 wrote to memory of 2864 1168 payment.exe payment.exe PID 1168 wrote to memory of 2864 1168 payment.exe payment.exe PID 1168 wrote to memory of 2864 1168 payment.exe payment.exe PID 1168 wrote to memory of 2864 1168 payment.exe payment.exe PID 1168 wrote to memory of 3624 1168 payment.exe payment.exe PID 1168 wrote to memory of 3624 1168 payment.exe payment.exe PID 1168 wrote to memory of 3624 1168 payment.exe payment.exe PID 1168 wrote to memory of 3624 1168 payment.exe payment.exe PID 1168 wrote to memory of 3624 1168 payment.exe payment.exe PID 1168 wrote to memory of 3624 1168 payment.exe payment.exe PID 1168 wrote to memory of 3624 1168 payment.exe payment.exe PID 1168 wrote to memory of 3624 1168 payment.exe payment.exe PID 1168 wrote to memory of 3656 1168 payment.exe payment.exe PID 1168 wrote to memory of 3656 1168 payment.exe payment.exe PID 1168 wrote to memory of 3656 1168 payment.exe payment.exe PID 1168 wrote to memory of 3656 1168 payment.exe payment.exe PID 1168 wrote to memory of 3656 1168 payment.exe payment.exe PID 1168 wrote to memory of 3656 1168 payment.exe payment.exe PID 1168 wrote to memory of 3656 1168 payment.exe payment.exe PID 1168 wrote to memory of 3656 1168 payment.exe payment.exe PID 3872 wrote to memory of 1804 3872 payment.exe schtasks.exe PID 3872 wrote to memory of 1804 3872 payment.exe schtasks.exe PID 3872 wrote to memory of 1804 3872 payment.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\payment.exe"C:\Users\Admin\AppData\Local\Temp\payment.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\payment.exeC:\Users\Admin\AppData\Local\Temp\payment.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 803⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\payment.exeC:\Users\Admin\AppData\Local\Temp\payment.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "bns" /XML "C:\Users\Admin\AppData\Local\Temp\tmp41A8.tmp" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\payment.exeC:\Users\Admin\AppData\Local\Temp\payment.exe2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XenoManager\payment.exe"C:\Users\Admin\AppData\Roaming\XenoManager\payment.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XenoManager\payment.exeC:\Users\Admin\AppData\Roaming\XenoManager\payment.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 805⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\XenoManager\payment.exeC:\Users\Admin\AppData\Roaming\XenoManager\payment.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\XenoManager\payment.exeC:\Users\Admin\AppData\Roaming\XenoManager\payment.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3656 -s 805⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2236 -ip 22361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 2864 -ip 28641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3656 -ip 36561⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\payment.exe.logFilesize
706B
MD5d95c58e609838928f0f49837cab7dfd2
SHA155e7139a1e3899195b92ed8771d1ca2c7d53c916
SHA2560407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339
SHA512405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d
-
C:\Users\Admin\AppData\Local\Temp\tmp41A8.tmpFilesize
1KB
MD5d8edaf260103b270a8ddc4c777cfa47b
SHA12ae20729bde4b5e46ec1193e84bd4e46578a283c
SHA256b5e1e4d8e154f0229ad5f58012165f17d6a179889e691bebe679fea314981e77
SHA51295f8a1faa37cf576b352d21f0a5d020a8b36cd63f450fdc68eb1a5e095f58e4a755edc71461a3738f8a5c2de6690d8207ac75e126e8d3a44c7b96940b2f27290
-
C:\Users\Admin\AppData\Roaming\XenoManager\payment.exeFilesize
242KB
MD5eebe7da6234f15c2055ddff4b4da6948
SHA176dc426d92a7785677d2ab1ac4cf7c1a63f6af48
SHA2565a74ace81656d018cc01e7db0cf24abe072524df6c297fa2081019e89680e5e1
SHA5120e088d5892921d67df1703f5e958a549b32fee13865af459212c0b6fd2f928b8f0534dccf17c1727d7e4fcb6162d90085736f3d58ba801c2fd285d8a9c01abd8
-
memory/908-29-0x0000000074B60000-0x0000000075310000-memory.dmpFilesize
7.7MB
-
memory/908-15-0x0000000074B60000-0x0000000075310000-memory.dmpFilesize
7.7MB
-
memory/1168-37-0x0000000074B60000-0x0000000075310000-memory.dmpFilesize
7.7MB
-
memory/1168-30-0x0000000074B60000-0x0000000075310000-memory.dmpFilesize
7.7MB
-
memory/2028-16-0x0000000074B60000-0x0000000075310000-memory.dmpFilesize
7.7MB
-
memory/2028-6-0x000000000EB40000-0x000000000F0E4000-memory.dmpFilesize
5.6MB
-
memory/2028-1-0x0000000000EA0000-0x0000000000EE6000-memory.dmpFilesize
280KB
-
memory/2028-7-0x000000000E630000-0x000000000E6C2000-memory.dmpFilesize
584KB
-
memory/2028-5-0x000000000E4F0000-0x000000000E58C000-memory.dmpFilesize
624KB
-
memory/2028-4-0x00000000058E0000-0x0000000005920000-memory.dmpFilesize
256KB
-
memory/2028-8-0x0000000003210000-0x0000000003216000-memory.dmpFilesize
24KB
-
memory/2028-3-0x0000000074B60000-0x0000000075310000-memory.dmpFilesize
7.7MB
-
memory/2028-0-0x0000000074B6E000-0x0000000074B6F000-memory.dmpFilesize
4KB
-
memory/2028-2-0x0000000003240000-0x0000000003246000-memory.dmpFilesize
24KB
-
memory/3872-17-0x0000000074B60000-0x0000000075310000-memory.dmpFilesize
7.7MB
-
memory/3872-14-0x0000000074B60000-0x0000000075310000-memory.dmpFilesize
7.7MB
-
memory/3872-38-0x0000000074B60000-0x0000000075310000-memory.dmpFilesize
7.7MB
-
memory/3872-10-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB