Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
06-06-2024 13:18
Static task
static1
General
-
Target
Pago652024.exe
-
Size
222KB
-
MD5
8a522f9786f61b5bd677d7a8ed6bd1aa
-
SHA1
06fdb9d40c9b6448fd8c1a47595eb3e8b3e9ed29
-
SHA256
e4d55c94e2904333166dc800a24bb13f97f8ceaf8815bbc133f3ac40dd4211f2
-
SHA512
e79c2be732536b4db756280d889b2021b31396ec669368796d507d7238be27984239d367bf22d9d1dea615b85b5b5b96677a08a383e28272a432988e537deabd
-
SSDEEP
6144:0kE+cZHhNRHvo14E92D08KHKIpRfvv0upeG2wxywW0pS/i1SbUI:0kpcZB/PoODOEuYG2wxywW0pS/i1SbB
Malware Config
Extracted
xenorat
91.92.248.167
Rolid_rat_nd8889g
-
delay
60000
-
install_path
appdata
-
port
1278
-
startup_name
mns
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation Pago652024.exe -
Executes dropped EXE 4 IoCs
pid Process 4028 Pago652024.exe 1056 Pago652024.exe 1912 Pago652024.exe 1968 Pago652024.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 3756 set thread context of 4364 3756 Pago652024.exe 84 PID 3756 set thread context of 1428 3756 Pago652024.exe 85 PID 3756 set thread context of 3292 3756 Pago652024.exe 86 PID 4028 set thread context of 1056 4028 Pago652024.exe 89 PID 4028 set thread context of 1912 4028 Pago652024.exe 90 PID 4028 set thread context of 1968 4028 Pago652024.exe 91 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3220 1968 WerFault.exe 91 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2932 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3756 Pago652024.exe Token: SeDebugPrivilege 4028 Pago652024.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 3756 wrote to memory of 4364 3756 Pago652024.exe 84 PID 3756 wrote to memory of 4364 3756 Pago652024.exe 84 PID 3756 wrote to memory of 4364 3756 Pago652024.exe 84 PID 3756 wrote to memory of 4364 3756 Pago652024.exe 84 PID 3756 wrote to memory of 4364 3756 Pago652024.exe 84 PID 3756 wrote to memory of 4364 3756 Pago652024.exe 84 PID 3756 wrote to memory of 4364 3756 Pago652024.exe 84 PID 3756 wrote to memory of 4364 3756 Pago652024.exe 84 PID 3756 wrote to memory of 1428 3756 Pago652024.exe 85 PID 3756 wrote to memory of 1428 3756 Pago652024.exe 85 PID 3756 wrote to memory of 1428 3756 Pago652024.exe 85 PID 3756 wrote to memory of 1428 3756 Pago652024.exe 85 PID 3756 wrote to memory of 1428 3756 Pago652024.exe 85 PID 3756 wrote to memory of 1428 3756 Pago652024.exe 85 PID 3756 wrote to memory of 1428 3756 Pago652024.exe 85 PID 3756 wrote to memory of 1428 3756 Pago652024.exe 85 PID 3756 wrote to memory of 3292 3756 Pago652024.exe 86 PID 3756 wrote to memory of 3292 3756 Pago652024.exe 86 PID 3756 wrote to memory of 3292 3756 Pago652024.exe 86 PID 3756 wrote to memory of 3292 3756 Pago652024.exe 86 PID 3756 wrote to memory of 3292 3756 Pago652024.exe 86 PID 3756 wrote to memory of 3292 3756 Pago652024.exe 86 PID 3756 wrote to memory of 3292 3756 Pago652024.exe 86 PID 3756 wrote to memory of 3292 3756 Pago652024.exe 86 PID 1428 wrote to memory of 4028 1428 Pago652024.exe 87 PID 1428 wrote to memory of 4028 1428 Pago652024.exe 87 PID 1428 wrote to memory of 4028 1428 Pago652024.exe 87 PID 4028 wrote to memory of 1056 4028 Pago652024.exe 89 PID 4028 wrote to memory of 1056 4028 Pago652024.exe 89 PID 4028 wrote to memory of 1056 4028 Pago652024.exe 89 PID 4028 wrote to memory of 1056 4028 Pago652024.exe 89 PID 4028 wrote to memory of 1056 4028 Pago652024.exe 89 PID 4028 wrote to memory of 1056 4028 Pago652024.exe 89 PID 4028 wrote to memory of 1056 4028 Pago652024.exe 89 PID 4028 wrote to memory of 1056 4028 Pago652024.exe 89 PID 4028 wrote to memory of 1912 4028 Pago652024.exe 90 PID 4028 wrote to memory of 1912 4028 Pago652024.exe 90 PID 4028 wrote to memory of 1912 4028 Pago652024.exe 90 PID 4028 wrote to memory of 1912 4028 Pago652024.exe 90 PID 4028 wrote to memory of 1912 4028 Pago652024.exe 90 PID 4028 wrote to memory of 1912 4028 Pago652024.exe 90 PID 4028 wrote to memory of 1912 4028 Pago652024.exe 90 PID 4028 wrote to memory of 1912 4028 Pago652024.exe 90 PID 4028 wrote to memory of 1968 4028 Pago652024.exe 91 PID 4028 wrote to memory of 1968 4028 Pago652024.exe 91 PID 4028 wrote to memory of 1968 4028 Pago652024.exe 91 PID 4028 wrote to memory of 1968 4028 Pago652024.exe 91 PID 4028 wrote to memory of 1968 4028 Pago652024.exe 91 PID 4028 wrote to memory of 1968 4028 Pago652024.exe 91 PID 4028 wrote to memory of 1968 4028 Pago652024.exe 91 PID 4028 wrote to memory of 1968 4028 Pago652024.exe 91 PID 4364 wrote to memory of 2932 4364 Pago652024.exe 106 PID 4364 wrote to memory of 2932 4364 Pago652024.exe 106 PID 4364 wrote to memory of 2932 4364 Pago652024.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\Pago652024.exe"C:\Users\Admin\AppData\Local\Temp\Pago652024.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\Pago652024.exeC:\Users\Admin\AppData\Local\Temp\Pago652024.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "mns" /XML "C:\Users\Admin\AppData\Local\Temp\tmp630A.tmp" /F3⤵
- Creates scheduled task(s)
PID:2932
-
-
-
C:\Users\Admin\AppData\Local\Temp\Pago652024.exeC:\Users\Admin\AppData\Local\Temp\Pago652024.exe2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Roaming\XenoManager\Pago652024.exe"C:\Users\Admin\AppData\Roaming\XenoManager\Pago652024.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Roaming\XenoManager\Pago652024.exeC:\Users\Admin\AppData\Roaming\XenoManager\Pago652024.exe4⤵
- Executes dropped EXE
PID:1056
-
-
C:\Users\Admin\AppData\Roaming\XenoManager\Pago652024.exeC:\Users\Admin\AppData\Roaming\XenoManager\Pago652024.exe4⤵
- Executes dropped EXE
PID:1912
-
-
C:\Users\Admin\AppData\Roaming\XenoManager\Pago652024.exeC:\Users\Admin\AppData\Roaming\XenoManager\Pago652024.exe4⤵
- Executes dropped EXE
PID:1968 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 805⤵
- Program crash
PID:3220
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Pago652024.exeC:\Users\Admin\AppData\Local\Temp\Pago652024.exe2⤵PID:3292
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1968 -ip 19681⤵PID:1704
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
706B
MD5d95c58e609838928f0f49837cab7dfd2
SHA155e7139a1e3899195b92ed8771d1ca2c7d53c916
SHA2560407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339
SHA512405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d
-
Filesize
1KB
MD5831f29adcdc8c602266b3fb65f01b1c5
SHA1092247b5233f6c748f9bf715939134b0f1836655
SHA2566b533eb2c748b5994edcece75c7d339bc4fcbc2a3a0f8bb797017b6380d5c6d0
SHA51200fd058322514a9c846d57ed59d3cdc497f2a16b061c72cb20e65f51529225be406640f6620121131fddfb3bbe21e5592e0b74b0f6e47126933e4e4cb42a90c2
-
Filesize
222KB
MD58a522f9786f61b5bd677d7a8ed6bd1aa
SHA106fdb9d40c9b6448fd8c1a47595eb3e8b3e9ed29
SHA256e4d55c94e2904333166dc800a24bb13f97f8ceaf8815bbc133f3ac40dd4211f2
SHA512e79c2be732536b4db756280d889b2021b31396ec669368796d507d7238be27984239d367bf22d9d1dea615b85b5b5b96677a08a383e28272a432988e537deabd