Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
21-06-2024 05:56
Static task
static1
Behavioral task
behavioral1
Sample
dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe
Resource
win10v2004-20240508-en
General
-
Target
dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe
-
Size
221KB
-
MD5
792c34fea9fdbebd00ccb3e2c82bd3a5
-
SHA1
d50a4769a2fca48504e9535a598f1e812d003c2f
-
SHA256
dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a
-
SHA512
f68beb38b7c68432211531d7a6f95626f388089098c878aee956def1e6de96744fa6459064ebd04df01316092cc018ad8321691cdc57265da889f030bf77e606
-
SSDEEP
3072:chp584YL4TWFxVvaZAUOQDMwutBq17PTPlw92Vr5/6PSr2k5fsPI:chMmSFxhaZQsmBq1bTPlwq/Vr2k5fAI
Malware Config
Extracted
xenorat
91.92.248.167
Wolid_rat_nd8859g
-
delay
60000
-
install_path
appdata
-
port
1280
-
startup_name
cms
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 1964 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 1512 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 5056 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 4896 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 1652 set thread context of 2708 1652 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 78 PID 1652 set thread context of 4980 1652 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 79 PID 1652 set thread context of 440 1652 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 80 PID 1964 set thread context of 1512 1964 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 82 PID 1964 set thread context of 5056 1964 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 83 PID 1964 set thread context of 4896 1964 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 84 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process 672 1512 WerFault.exe 3356 5056 WerFault.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3912 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1652 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe Token: SeDebugPrivilege 1964 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 1652 wrote to memory of 2708 1652 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 78 PID 1652 wrote to memory of 2708 1652 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 78 PID 1652 wrote to memory of 2708 1652 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 78 PID 1652 wrote to memory of 2708 1652 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 78 PID 1652 wrote to memory of 2708 1652 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 78 PID 1652 wrote to memory of 2708 1652 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 78 PID 1652 wrote to memory of 2708 1652 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 78 PID 1652 wrote to memory of 2708 1652 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 78 PID 1652 wrote to memory of 4980 1652 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 79 PID 1652 wrote to memory of 4980 1652 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 79 PID 1652 wrote to memory of 4980 1652 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 79 PID 1652 wrote to memory of 4980 1652 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 79 PID 1652 wrote to memory of 4980 1652 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 79 PID 1652 wrote to memory of 4980 1652 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 79 PID 1652 wrote to memory of 4980 1652 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 79 PID 1652 wrote to memory of 4980 1652 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 79 PID 1652 wrote to memory of 440 1652 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 80 PID 1652 wrote to memory of 440 1652 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 80 PID 1652 wrote to memory of 440 1652 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 80 PID 1652 wrote to memory of 440 1652 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 80 PID 1652 wrote to memory of 440 1652 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 80 PID 1652 wrote to memory of 440 1652 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 80 PID 1652 wrote to memory of 440 1652 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 80 PID 1652 wrote to memory of 440 1652 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 80 PID 2708 wrote to memory of 1964 2708 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 81 PID 2708 wrote to memory of 1964 2708 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 81 PID 2708 wrote to memory of 1964 2708 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 81 PID 1964 wrote to memory of 1512 1964 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 82 PID 1964 wrote to memory of 1512 1964 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 82 PID 1964 wrote to memory of 1512 1964 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 82 PID 1964 wrote to memory of 1512 1964 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 82 PID 1964 wrote to memory of 1512 1964 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 82 PID 1964 wrote to memory of 1512 1964 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 82 PID 1964 wrote to memory of 1512 1964 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 82 PID 1964 wrote to memory of 1512 1964 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 82 PID 1964 wrote to memory of 5056 1964 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 83 PID 1964 wrote to memory of 5056 1964 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 83 PID 1964 wrote to memory of 5056 1964 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 83 PID 1964 wrote to memory of 5056 1964 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 83 PID 1964 wrote to memory of 5056 1964 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 83 PID 1964 wrote to memory of 5056 1964 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 83 PID 1964 wrote to memory of 5056 1964 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 83 PID 1964 wrote to memory of 5056 1964 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 83 PID 1964 wrote to memory of 4896 1964 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 84 PID 1964 wrote to memory of 4896 1964 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 84 PID 1964 wrote to memory of 4896 1964 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 84 PID 1964 wrote to memory of 4896 1964 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 84 PID 1964 wrote to memory of 4896 1964 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 84 PID 1964 wrote to memory of 4896 1964 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 84 PID 1964 wrote to memory of 4896 1964 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 84 PID 1964 wrote to memory of 4896 1964 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 84 PID 4980 wrote to memory of 3912 4980 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 90 PID 4980 wrote to memory of 3912 4980 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 90 PID 4980 wrote to memory of 3912 4980 dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe"C:\Users\Admin\AppData\Local\Temp\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exeC:\Users\Admin\AppData\Local\Temp\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Roaming\XenoManager\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe"C:\Users\Admin\AppData\Roaming\XenoManager\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Roaming\XenoManager\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exeC:\Users\Admin\AppData\Roaming\XenoManager\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe4⤵
- Executes dropped EXE
PID:1512 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 925⤵
- Program crash
PID:672
-
-
-
C:\Users\Admin\AppData\Roaming\XenoManager\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exeC:\Users\Admin\AppData\Roaming\XenoManager\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe4⤵
- Executes dropped EXE
PID:5056 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 925⤵
- Program crash
PID:3356
-
-
-
C:\Users\Admin\AppData\Roaming\XenoManager\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exeC:\Users\Admin\AppData\Roaming\XenoManager\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe4⤵
- Executes dropped EXE
PID:4896
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exeC:\Users\Admin\AppData\Local\Temp\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "cms" /XML "C:\Users\Admin\AppData\Local\Temp\tmp65D9.tmp" /F3⤵
- Scheduled Task/Job: Scheduled Task
PID:3912
-
-
-
C:\Users\Admin\AppData\Local\Temp\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exeC:\Users\Admin\AppData\Local\Temp\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe2⤵PID:440
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1512 -ip 15121⤵PID:3944
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 5056 -ip 50561⤵PID:1164
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe.log
Filesize706B
MD580305b9a250a27091f46fa147674ffb3
SHA181b485761494618e4c8bba9af56c29b2ea8e8a07
SHA256d9febc24cdfe2a616fff0e891fb055951aad00be6d57b0bc3cf8f4f643c5f6ae
SHA51252544d526e83ae2a71d63768457435dbe79843a76146f60b7e41ec7b53ddb620323592325e19d6776b92b7e1fbb8dc79db85e94a30d970f0983563456ccd7a19
-
Filesize
1KB
MD5f8dc44da42b7efb85bc15ab7f6fa7bd2
SHA1f81f26de6ba0432771aeffa2bcf169012d4f835f
SHA2567cd99bf8e6e3763d8614843118ea96c6b23a8bd4740f050238702a81cfb2f292
SHA5126973a187fb215b6c1f027fe88b15a0ec989dd75ddf73cbb2de60f0d7820bed36e18f0bdfe5c13a13d8aab765802fdeb35998c608523dfbbdd7814d5b5e82f32b
-
C:\Users\Admin\AppData\Roaming\XenoManager\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe
Filesize221KB
MD5792c34fea9fdbebd00ccb3e2c82bd3a5
SHA1d50a4769a2fca48504e9535a598f1e812d003c2f
SHA256dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a
SHA512f68beb38b7c68432211531d7a6f95626f388089098c878aee956def1e6de96744fa6459064ebd04df01316092cc018ad8321691cdc57265da889f030bf77e606