Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
06-06-2024 13:18
Static task
static1
General
-
Target
Pago652024.exe
-
Size
222KB
-
MD5
8a522f9786f61b5bd677d7a8ed6bd1aa
-
SHA1
06fdb9d40c9b6448fd8c1a47595eb3e8b3e9ed29
-
SHA256
e4d55c94e2904333166dc800a24bb13f97f8ceaf8815bbc133f3ac40dd4211f2
-
SHA512
e79c2be732536b4db756280d889b2021b31396ec669368796d507d7238be27984239d367bf22d9d1dea615b85b5b5b96677a08a383e28272a432988e537deabd
-
SSDEEP
6144:0kE+cZHhNRHvo14E92D08KHKIpRfvv0upeG2wxywW0pS/i1SbUI:0kpcZB/PoODOEuYG2wxywW0pS/i1SbB
Malware Config
Extracted
xenorat
91.92.248.167
Rolid_rat_nd8889g
-
delay
60000
-
install_path
appdata
-
port
1278
-
startup_name
mns
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Pago652024.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation Pago652024.exe -
Executes dropped EXE 4 IoCs
Processes:
Pago652024.exePago652024.exePago652024.exePago652024.exepid process 4028 Pago652024.exe 1056 Pago652024.exe 1912 Pago652024.exe 1968 Pago652024.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
Pago652024.exePago652024.exedescription pid process target process PID 3756 set thread context of 4364 3756 Pago652024.exe Pago652024.exe PID 3756 set thread context of 1428 3756 Pago652024.exe Pago652024.exe PID 3756 set thread context of 3292 3756 Pago652024.exe Pago652024.exe PID 4028 set thread context of 1056 4028 Pago652024.exe Pago652024.exe PID 4028 set thread context of 1912 4028 Pago652024.exe Pago652024.exe PID 4028 set thread context of 1968 4028 Pago652024.exe Pago652024.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3220 1968 WerFault.exe Pago652024.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Pago652024.exePago652024.exedescription pid process Token: SeDebugPrivilege 3756 Pago652024.exe Token: SeDebugPrivilege 4028 Pago652024.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
Pago652024.exePago652024.exePago652024.exePago652024.exedescription pid process target process PID 3756 wrote to memory of 4364 3756 Pago652024.exe Pago652024.exe PID 3756 wrote to memory of 4364 3756 Pago652024.exe Pago652024.exe PID 3756 wrote to memory of 4364 3756 Pago652024.exe Pago652024.exe PID 3756 wrote to memory of 4364 3756 Pago652024.exe Pago652024.exe PID 3756 wrote to memory of 4364 3756 Pago652024.exe Pago652024.exe PID 3756 wrote to memory of 4364 3756 Pago652024.exe Pago652024.exe PID 3756 wrote to memory of 4364 3756 Pago652024.exe Pago652024.exe PID 3756 wrote to memory of 4364 3756 Pago652024.exe Pago652024.exe PID 3756 wrote to memory of 1428 3756 Pago652024.exe Pago652024.exe PID 3756 wrote to memory of 1428 3756 Pago652024.exe Pago652024.exe PID 3756 wrote to memory of 1428 3756 Pago652024.exe Pago652024.exe PID 3756 wrote to memory of 1428 3756 Pago652024.exe Pago652024.exe PID 3756 wrote to memory of 1428 3756 Pago652024.exe Pago652024.exe PID 3756 wrote to memory of 1428 3756 Pago652024.exe Pago652024.exe PID 3756 wrote to memory of 1428 3756 Pago652024.exe Pago652024.exe PID 3756 wrote to memory of 1428 3756 Pago652024.exe Pago652024.exe PID 3756 wrote to memory of 3292 3756 Pago652024.exe Pago652024.exe PID 3756 wrote to memory of 3292 3756 Pago652024.exe Pago652024.exe PID 3756 wrote to memory of 3292 3756 Pago652024.exe Pago652024.exe PID 3756 wrote to memory of 3292 3756 Pago652024.exe Pago652024.exe PID 3756 wrote to memory of 3292 3756 Pago652024.exe Pago652024.exe PID 3756 wrote to memory of 3292 3756 Pago652024.exe Pago652024.exe PID 3756 wrote to memory of 3292 3756 Pago652024.exe Pago652024.exe PID 3756 wrote to memory of 3292 3756 Pago652024.exe Pago652024.exe PID 1428 wrote to memory of 4028 1428 Pago652024.exe Pago652024.exe PID 1428 wrote to memory of 4028 1428 Pago652024.exe Pago652024.exe PID 1428 wrote to memory of 4028 1428 Pago652024.exe Pago652024.exe PID 4028 wrote to memory of 1056 4028 Pago652024.exe Pago652024.exe PID 4028 wrote to memory of 1056 4028 Pago652024.exe Pago652024.exe PID 4028 wrote to memory of 1056 4028 Pago652024.exe Pago652024.exe PID 4028 wrote to memory of 1056 4028 Pago652024.exe Pago652024.exe PID 4028 wrote to memory of 1056 4028 Pago652024.exe Pago652024.exe PID 4028 wrote to memory of 1056 4028 Pago652024.exe Pago652024.exe PID 4028 wrote to memory of 1056 4028 Pago652024.exe Pago652024.exe PID 4028 wrote to memory of 1056 4028 Pago652024.exe Pago652024.exe PID 4028 wrote to memory of 1912 4028 Pago652024.exe Pago652024.exe PID 4028 wrote to memory of 1912 4028 Pago652024.exe Pago652024.exe PID 4028 wrote to memory of 1912 4028 Pago652024.exe Pago652024.exe PID 4028 wrote to memory of 1912 4028 Pago652024.exe Pago652024.exe PID 4028 wrote to memory of 1912 4028 Pago652024.exe Pago652024.exe PID 4028 wrote to memory of 1912 4028 Pago652024.exe Pago652024.exe PID 4028 wrote to memory of 1912 4028 Pago652024.exe Pago652024.exe PID 4028 wrote to memory of 1912 4028 Pago652024.exe Pago652024.exe PID 4028 wrote to memory of 1968 4028 Pago652024.exe Pago652024.exe PID 4028 wrote to memory of 1968 4028 Pago652024.exe Pago652024.exe PID 4028 wrote to memory of 1968 4028 Pago652024.exe Pago652024.exe PID 4028 wrote to memory of 1968 4028 Pago652024.exe Pago652024.exe PID 4028 wrote to memory of 1968 4028 Pago652024.exe Pago652024.exe PID 4028 wrote to memory of 1968 4028 Pago652024.exe Pago652024.exe PID 4028 wrote to memory of 1968 4028 Pago652024.exe Pago652024.exe PID 4028 wrote to memory of 1968 4028 Pago652024.exe Pago652024.exe PID 4364 wrote to memory of 2932 4364 Pago652024.exe schtasks.exe PID 4364 wrote to memory of 2932 4364 Pago652024.exe schtasks.exe PID 4364 wrote to memory of 2932 4364 Pago652024.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Pago652024.exe"C:\Users\Admin\AppData\Local\Temp\Pago652024.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Pago652024.exeC:\Users\Admin\AppData\Local\Temp\Pago652024.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "mns" /XML "C:\Users\Admin\AppData\Local\Temp\tmp630A.tmp" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Pago652024.exeC:\Users\Admin\AppData\Local\Temp\Pago652024.exe2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XenoManager\Pago652024.exe"C:\Users\Admin\AppData\Roaming\XenoManager\Pago652024.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XenoManager\Pago652024.exeC:\Users\Admin\AppData\Roaming\XenoManager\Pago652024.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\XenoManager\Pago652024.exeC:\Users\Admin\AppData\Roaming\XenoManager\Pago652024.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\XenoManager\Pago652024.exeC:\Users\Admin\AppData\Roaming\XenoManager\Pago652024.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 805⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Pago652024.exeC:\Users\Admin\AppData\Local\Temp\Pago652024.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1968 -ip 19681⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Pago652024.exe.logFilesize
706B
MD5d95c58e609838928f0f49837cab7dfd2
SHA155e7139a1e3899195b92ed8771d1ca2c7d53c916
SHA2560407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339
SHA512405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d
-
C:\Users\Admin\AppData\Local\Temp\tmp630A.tmpFilesize
1KB
MD5831f29adcdc8c602266b3fb65f01b1c5
SHA1092247b5233f6c748f9bf715939134b0f1836655
SHA2566b533eb2c748b5994edcece75c7d339bc4fcbc2a3a0f8bb797017b6380d5c6d0
SHA51200fd058322514a9c846d57ed59d3cdc497f2a16b061c72cb20e65f51529225be406640f6620121131fddfb3bbe21e5592e0b74b0f6e47126933e4e4cb42a90c2
-
C:\Users\Admin\AppData\Roaming\XenoManager\Pago652024.exeFilesize
222KB
MD58a522f9786f61b5bd677d7a8ed6bd1aa
SHA106fdb9d40c9b6448fd8c1a47595eb3e8b3e9ed29
SHA256e4d55c94e2904333166dc800a24bb13f97f8ceaf8815bbc133f3ac40dd4211f2
SHA512e79c2be732536b4db756280d889b2021b31396ec669368796d507d7238be27984239d367bf22d9d1dea615b85b5b5b96677a08a383e28272a432988e537deabd
-
memory/1428-30-0x0000000074DE0000-0x0000000075590000-memory.dmpFilesize
7.7MB
-
memory/1428-16-0x0000000074DE0000-0x0000000075590000-memory.dmpFilesize
7.7MB
-
memory/3292-17-0x0000000074DE0000-0x0000000075590000-memory.dmpFilesize
7.7MB
-
memory/3756-5-0x000000000E1E0000-0x000000000E27C000-memory.dmpFilesize
624KB
-
memory/3756-4-0x0000000074DE0000-0x0000000075590000-memory.dmpFilesize
7.7MB
-
memory/3756-8-0x0000000002ED0000-0x0000000002ED6000-memory.dmpFilesize
24KB
-
memory/3756-1-0x0000000000CF0000-0x0000000000D2C000-memory.dmpFilesize
240KB
-
memory/3756-6-0x000000000E830000-0x000000000EDD4000-memory.dmpFilesize
5.6MB
-
memory/3756-0-0x0000000074DEE000-0x0000000074DEF000-memory.dmpFilesize
4KB
-
memory/3756-2-0x0000000002FC0000-0x0000000002FC6000-memory.dmpFilesize
24KB
-
memory/3756-7-0x000000000E320000-0x000000000E3B2000-memory.dmpFilesize
584KB
-
memory/3756-18-0x0000000074DE0000-0x0000000075590000-memory.dmpFilesize
7.7MB
-
memory/3756-3-0x00000000056C0000-0x00000000056FA000-memory.dmpFilesize
232KB
-
memory/4364-20-0x0000000074DE0000-0x0000000075590000-memory.dmpFilesize
7.7MB
-
memory/4364-13-0x0000000074DE0000-0x0000000075590000-memory.dmpFilesize
7.7MB
-
memory/4364-37-0x0000000074DE0000-0x0000000075590000-memory.dmpFilesize
7.7MB
-
memory/4364-9-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB