xenorat | 018d9108b39ca28180b68fb1b96a4ec9c3dc29721605c45c028f4753b58dbcd6

Analysis

max time kernel
65s
max time network
71s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17-06-2024 17:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$seroxen-monkey.exe
Size

55KB
MD5

1936e8941d3d7450e6e6c3d442bdb435
SHA1

01de40c456fd23cd2e47fa8f2482e9de1457da84
SHA256

018d9108b39ca28180b68fb1b96a4ec9c3dc29721605c45c028f4753b58dbcd6
SHA512

cfc37f09b6aa945ac86a395a34e88c918c1175d5fd1da6ef37bb61ea2bb75f5b2c6a108a1e89e8a4fe6b155c09a6c744a15dfa7c6400a14892cea665041d9855
SSDEEP

768:+mv1HjsdCOPVauou790wjyxS1X1ukFHNsgsWpDJXbJgg+z6bximNgG:71HgVauoHuv1X1dts6BJXbJse/uG

Score

10^/10

xenorat rat trojan

Malware Config

Extracted

Family

xenorat

our-brochure.gl.at.ply.gg

Mutex

monkeys_littless_nd8912d

Attributes

delay
3000
install_path
temp
port
32731
startup_name
Updaters

Signatures

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	$seroxen-monkey.exe

Executes dropped EXE 1 IoCs

pid	Process
4280	$seroxen-monkey.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1276	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133631199272955509"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3712	chrome.exe
3712	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4280	$seroxen-monkey.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 4280	4656	$seroxen-monkey.exe	82
PID 4656 wrote to memory of 4280	4656	$seroxen-monkey.exe	82
PID 4656 wrote to memory of 4280	4656	$seroxen-monkey.exe	82
PID 3712 wrote to memory of 1860	3712	chrome.exe	87
PID 3712 wrote to memory of 1860	3712	chrome.exe	87
PID 3712 wrote to memory of 4972	3712	chrome.exe	88
PID 3712 wrote to memory of 4972	3712	chrome.exe	88
PID 3712 wrote to memory of 4972	3712	chrome.exe	88
PID 3712 wrote to memory of 4972	3712	chrome.exe	88
PID 3712 wrote to memory of 4972	3712	chrome.exe	88
PID 3712 wrote to memory of 4972	3712	chrome.exe	88
PID 3712 wrote to memory of 4972	3712	chrome.exe	88
PID 3712 wrote to memory of 4972	3712	chrome.exe	88
PID 3712 wrote to memory of 4972	3712	chrome.exe	88
PID 3712 wrote to memory of 4972	3712	chrome.exe	88
PID 3712 wrote to memory of 4972	3712	chrome.exe	88
PID 3712 wrote to memory of 4972	3712	chrome.exe	88
PID 3712 wrote to memory of 4972	3712	chrome.exe	88
PID 3712 wrote to memory of 4972	3712	chrome.exe	88
PID 3712 wrote to memory of 4972	3712	chrome.exe	88
PID 3712 wrote to memory of 4972	3712	chrome.exe	88
PID 3712 wrote to memory of 4972	3712	chrome.exe	88
PID 3712 wrote to memory of 4972	3712	chrome.exe	88
PID 3712 wrote to memory of 4972	3712	chrome.exe	88
PID 3712 wrote to memory of 4972	3712	chrome.exe	88
PID 3712 wrote to memory of 4972	3712	chrome.exe	88
PID 3712 wrote to memory of 4972	3712	chrome.exe	88
PID 3712 wrote to memory of 4972	3712	chrome.exe	88
PID 3712 wrote to memory of 4972	3712	chrome.exe	88
PID 3712 wrote to memory of 4972	3712	chrome.exe	88
PID 3712 wrote to memory of 4972	3712	chrome.exe	88
PID 3712 wrote to memory of 4972	3712	chrome.exe	88
PID 3712 wrote to memory of 4972	3712	chrome.exe	88
PID 3712 wrote to memory of 4972	3712	chrome.exe	88
PID 3712 wrote to memory of 4972	3712	chrome.exe	88
PID 3712 wrote to memory of 4972	3712	chrome.exe	88
PID 3712 wrote to memory of 2892	3712	chrome.exe	89
PID 3712 wrote to memory of 2892	3712	chrome.exe	89
PID 3712 wrote to memory of 2412	3712	chrome.exe	90
PID 3712 wrote to memory of 2412	3712	chrome.exe	90
PID 3712 wrote to memory of 2412	3712	chrome.exe	90
PID 3712 wrote to memory of 2412	3712	chrome.exe	90
PID 3712 wrote to memory of 2412	3712	chrome.exe	90
PID 3712 wrote to memory of 2412	3712	chrome.exe	90
PID 3712 wrote to memory of 2412	3712	chrome.exe	90
PID 3712 wrote to memory of 2412	3712	chrome.exe	90
PID 3712 wrote to memory of 2412	3712	chrome.exe	90
PID 3712 wrote to memory of 2412	3712	chrome.exe	90
PID 3712 wrote to memory of 2412	3712	chrome.exe	90
PID 3712 wrote to memory of 2412	3712	chrome.exe	90
PID 3712 wrote to memory of 2412	3712	chrome.exe	90
PID 3712 wrote to memory of 2412	3712	chrome.exe	90
PID 3712 wrote to memory of 2412	3712	chrome.exe	90
PID 3712 wrote to memory of 2412	3712	chrome.exe	90
PID 3712 wrote to memory of 2412	3712	chrome.exe	90
PID 3712 wrote to memory of 2412	3712	chrome.exe	90
PID 3712 wrote to memory of 2412	3712	chrome.exe	90
PID 3712 wrote to memory of 2412	3712	chrome.exe	90
PID 3712 wrote to memory of 2412	3712	chrome.exe	90
PID 3712 wrote to memory of 2412	3712	chrome.exe	90
PID 3712 wrote to memory of 2412	3712	chrome.exe	90
PID 3712 wrote to memory of 2412	3712	chrome.exe	90
PID 3712 wrote to memory of 2412	3712	chrome.exe	90
PID 3712 wrote to memory of 2412	3712	chrome.exe	90

C:\Users\Admin\AppData\Local\Temp\$seroxen-monkey.exe
"C:\Users\Admin\AppData\Local\Temp\$seroxen-monkey.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Users\Admin\AppData\Local\Temp\Manager\$seroxen-monkey.exe
  "C:\Users\Admin\AppData\Local\Temp\Manager\$seroxen-monkey.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4280
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /Create /TN "Updaters" /XML "C:\Users\Admin\AppData\Local\Temp\tmp928B.tmp" /F
    3⤵
    - Creates scheduled task(s)
    PID:1276

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff0872ab58,0x7fff0872ab68,0x7fff0872ab78
  2⤵
  PID:1860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1932,i,13984351452957630514,2922805500433392485,131072 /prefetch:2
  2⤵
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1540 --field-trial-handle=1932,i,13984351452957630514,2922805500433392485,131072 /prefetch:8
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2260 --field-trial-handle=1932,i,13984351452957630514,2922805500433392485,131072 /prefetch:8
  2⤵
  PID:2412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3028 --field-trial-handle=1932,i,13984351452957630514,2922805500433392485,131072 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3060 --field-trial-handle=1932,i,13984351452957630514,2922805500433392485,131072 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4348 --field-trial-handle=1932,i,13984351452957630514,2922805500433392485,131072 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4724 --field-trial-handle=1932,i,13984351452957630514,2922805500433392485,131072 /prefetch:8
  2⤵
  PID:1360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 --field-trial-handle=1932,i,13984351452957630514,2922805500433392485,131072 /prefetch:8
  2⤵
  PID:2668
- C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:4112
- - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff6f837ae48,0x7ff6f837ae58,0x7ff6f837ae68
    3⤵
    PID:1204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4872 --field-trial-handle=1932,i,13984351452957630514,2922805500433392485,131072 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5084 --field-trial-handle=1932,i,13984351452957630514,2922805500433392485,131072 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4912 --field-trial-handle=1932,i,13984351452957630514,2922805500433392485,131072 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4376 --field-trial-handle=1932,i,13984351452957630514,2922805500433392485,131072 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4932 --field-trial-handle=1932,i,13984351452957630514,2922805500433392485,131072 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4636 --field-trial-handle=1932,i,13984351452957630514,2922805500433392485,131072 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3280 --field-trial-handle=1932,i,13984351452957630514,2922805500433392485,131072 /prefetch:1
  2⤵
  PID:972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4868 --field-trial-handle=1932,i,13984351452957630514,2922805500433392485,131072 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 --field-trial-handle=1932,i,13984351452957630514,2922805500433392485,131072 /prefetch:8
  2⤵
  PID:3556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 --field-trial-handle=1932,i,13984351452957630514,2922805500433392485,131072 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 --field-trial-handle=1932,i,13984351452957630514,2922805500433392485,131072 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=2692 --field-trial-handle=1932,i,13984351452957630514,2922805500433392485,131072 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=4996 --field-trial-handle=1932,i,13984351452957630514,2922805500433392485,131072 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=1684 --field-trial-handle=1932,i,13984351452957630514,2922805500433392485,131072 /prefetch:1
  2⤵
  PID:1524

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7f9cf8bd-ad50-4672-add7-f43f9c4efa02.tmp

Filesize
7KB

MD5
eea29244e4638eaa30efb83f21419e2c

SHA1
ff6d4bc289e72f397553c128c6fbd9eccd71364d

SHA256
a90527b143291547bec76f8ad4b39568ac155951474683ac684c6add69241220

SHA512
93ec56724da2cf1f05811a87279d37dbc3deea576ff9d27891a92aec422e5b55c05a0689d55445a1a8032f66046cd70e7b2f2f75241d17593319150fa4702928

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
12e69d86dcda5ba92f15f6125ba69cc0

SHA1
88c460dbdc25336a9b3a9825d927340b8b451d59

SHA256
9767cb51569506cf9b81238082ed403b273402ef7d44dd2da89fa61c34f7d3b1

SHA512
d5fa32ab45e3140910eb135c2929640d6675a6daba3f10f8ba072244f4409691769a0f9a54cffad244019d0f66ad659c57a2d1f5b5f3dcdd2a15120a550755da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
257KB

MD5
0b7d467c61847ae6b87a66f40f9c1dea

SHA1
3301d8098d8e487684a1ade409e117eb955042dc

SHA256
acdf2b091cd63a1ab39a88d8462bd71ff1f4a38c893a50e9c276c39492ef4714

SHA512
df94154df19b28d1abe7fc24fe9959a33d912ba412f3b9dbb72a07af92f14f0f49d5287b079cac636f8e7b385c2669dc6dfdffcbdb65995d08c9822482c2eb23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
257KB

MD5
805a509f46ec72311f353a9089e8bd9b

SHA1
0d2efe1059aba0b9c76cbad1790458fa678fde1c

SHA256
2700b3f1f7defc0e53a45910300fd6a3673d743cd297d40cbe34a5fc37d1986f

SHA512
9a89e8c571373c20ec1e63f32854c39f7fa43dd2cbaa0a0bb3ea1953ee0951536a22f8ce6eef01763628235514d93e42925f75278b0b5cf083165c228949ca88

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
92KB

MD5
d66f90fc7dc935b4d39d5aa119fcbbf2

SHA1
fce8de28d738bed70f93e33ed2bc57c2353cb8f3

SHA256
874865e856a42e3b03ab64e5dfa15874054ffadab8518cd0f38e438731c45813

SHA512
2905e88e7be34704ad1757f22fbeb32e7f7b0a4901a0170f080e822b7123d25b8cf00e980c6f5d97e2c598f65b476346b331e30b033f2a0247290bea7a248492

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe580a3c.TMP

Filesize
89KB

MD5
ebd726409311c92a690beead164a62c6

SHA1
a78bb727910a0d8a9c9a5ca40dd2b65ff3342220

SHA256
23d4d8b40728cbfbae2bb167206519dda6344ab669d401dd36e9be57b119e737

SHA512
bc7cb924f7bf5e0316fe852730ccd5de1ced9f61b38461bc8935b586c469ca0769edea047eaab6512af3544eb92242f4efb87a6d1df3d8ddf325ce2603059215

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\$seroxen-monkey.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\Manager\$seroxen-monkey.exe

Filesize
55KB

MD5
1936e8941d3d7450e6e6c3d442bdb435

SHA1
01de40c456fd23cd2e47fa8f2482e9de1457da84

SHA256
018d9108b39ca28180b68fb1b96a4ec9c3dc29721605c45c028f4753b58dbcd6

SHA512
cfc37f09b6aa945ac86a395a34e88c918c1175d5fd1da6ef37bb61ea2bb75f5b2c6a108a1e89e8a4fe6b155c09a6c744a15dfa7c6400a14892cea665041d9855

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp928B.tmp

Filesize
1KB

MD5
a7ec8debdd23eb03b477b0655f4519c0

SHA1
1f31753f1774bf1efaa210ba22de0d6527d8581d

SHA256
1def7a4255900c783f9e8b5540c6314e81b0359de3cfaa41d31a11d7a3d5ae51

SHA512
54bde219f52f9250f4352034c37f8e6039c15062d9457b33e113d5c6533d9f397a4b03efc661534295e484863644e50da97ac7a271aaba02f21dd758512f6503

Download Submit
memory/4280-15-0x0000000074FC0000-0x0000000075770000-memory.dmp

Filesize
7.7MB

Download
memory/4280-74-0x0000000074FC0000-0x0000000075770000-memory.dmp

Filesize
7.7MB

Download
memory/4280-16-0x0000000074FC0000-0x0000000075770000-memory.dmp

Filesize
7.7MB

Download
memory/4656-0-0x0000000074FCE000-0x0000000074FCF000-memory.dmp

Filesize
4KB

Download
memory/4656-1-0x0000000000B60000-0x0000000000B74000-memory.dmp

Filesize
80KB

Download