Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
21-06-2024 05:59
Static task
static1
Behavioral task
behavioral1
Sample
792c34fea9fdbebd00ccb3e2c82bd3a5.exe
Resource
win7-20231129-en
General
-
Target
792c34fea9fdbebd00ccb3e2c82bd3a5.exe
-
Size
221KB
-
MD5
792c34fea9fdbebd00ccb3e2c82bd3a5
-
SHA1
d50a4769a2fca48504e9535a598f1e812d003c2f
-
SHA256
dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a
-
SHA512
f68beb38b7c68432211531d7a6f95626f388089098c878aee956def1e6de96744fa6459064ebd04df01316092cc018ad8321691cdc57265da889f030bf77e606
-
SSDEEP
3072:chp584YL4TWFxVvaZAUOQDMwutBq17PTPlw92Vr5/6PSr2k5fsPI:chMmSFxhaZQsmBq1bTPlwq/Vr2k5fAI
Malware Config
Extracted
xenorat
91.92.248.167
Wolid_rat_nd8859g
-
delay
60000
-
install_path
appdata
-
port
1280
-
startup_name
cms
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 2724 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 2472 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 2044 792c34fea9fdbebd00ccb3e2c82bd3a5.exe -
Loads dropped DLL 4 IoCs
pid Process 3020 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 1660 set thread context of 2932 1660 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 28 PID 1660 set thread context of 3016 1660 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 29 PID 1660 set thread context of 3020 1660 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 30 PID 2692 set thread context of 2724 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 32 PID 2692 set thread context of 2472 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 33 PID 2692 set thread context of 2044 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1408 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1660 792c34fea9fdbebd00ccb3e2c82bd3a5.exe Token: SeDebugPrivilege 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe -
Suspicious use of WriteProcessMemory 62 IoCs
description pid Process procid_target PID 1660 wrote to memory of 2932 1660 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 28 PID 1660 wrote to memory of 2932 1660 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 28 PID 1660 wrote to memory of 2932 1660 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 28 PID 1660 wrote to memory of 2932 1660 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 28 PID 1660 wrote to memory of 2932 1660 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 28 PID 1660 wrote to memory of 2932 1660 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 28 PID 1660 wrote to memory of 2932 1660 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 28 PID 1660 wrote to memory of 2932 1660 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 28 PID 1660 wrote to memory of 2932 1660 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 28 PID 1660 wrote to memory of 3016 1660 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 29 PID 1660 wrote to memory of 3016 1660 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 29 PID 1660 wrote to memory of 3016 1660 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 29 PID 1660 wrote to memory of 3016 1660 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 29 PID 1660 wrote to memory of 3016 1660 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 29 PID 1660 wrote to memory of 3016 1660 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 29 PID 1660 wrote to memory of 3016 1660 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 29 PID 1660 wrote to memory of 3016 1660 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 29 PID 1660 wrote to memory of 3016 1660 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 29 PID 1660 wrote to memory of 3020 1660 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 30 PID 1660 wrote to memory of 3020 1660 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 30 PID 1660 wrote to memory of 3020 1660 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 30 PID 1660 wrote to memory of 3020 1660 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 30 PID 1660 wrote to memory of 3020 1660 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 30 PID 1660 wrote to memory of 3020 1660 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 30 PID 1660 wrote to memory of 3020 1660 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 30 PID 1660 wrote to memory of 3020 1660 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 30 PID 1660 wrote to memory of 3020 1660 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 30 PID 3020 wrote to memory of 2692 3020 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 31 PID 3020 wrote to memory of 2692 3020 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 31 PID 3020 wrote to memory of 2692 3020 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 31 PID 3020 wrote to memory of 2692 3020 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 31 PID 2692 wrote to memory of 2724 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 32 PID 2692 wrote to memory of 2724 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 32 PID 2692 wrote to memory of 2724 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 32 PID 2692 wrote to memory of 2724 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 32 PID 2692 wrote to memory of 2724 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 32 PID 2692 wrote to memory of 2724 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 32 PID 2692 wrote to memory of 2724 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 32 PID 2692 wrote to memory of 2724 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 32 PID 2692 wrote to memory of 2724 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 32 PID 2692 wrote to memory of 2472 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 33 PID 2692 wrote to memory of 2472 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 33 PID 2692 wrote to memory of 2472 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 33 PID 2692 wrote to memory of 2472 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 33 PID 2692 wrote to memory of 2472 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 33 PID 2692 wrote to memory of 2472 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 33 PID 2692 wrote to memory of 2472 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 33 PID 2692 wrote to memory of 2472 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 33 PID 2692 wrote to memory of 2472 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 33 PID 2692 wrote to memory of 2044 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 34 PID 2692 wrote to memory of 2044 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 34 PID 2692 wrote to memory of 2044 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 34 PID 2692 wrote to memory of 2044 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 34 PID 2692 wrote to memory of 2044 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 34 PID 2692 wrote to memory of 2044 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 34 PID 2692 wrote to memory of 2044 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 34 PID 2692 wrote to memory of 2044 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 34 PID 2692 wrote to memory of 2044 2692 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 34 PID 3016 wrote to memory of 1408 3016 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 37 PID 3016 wrote to memory of 1408 3016 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 37 PID 3016 wrote to memory of 1408 3016 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 37 PID 3016 wrote to memory of 1408 3016 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\792c34fea9fdbebd00ccb3e2c82bd3a5.exe"C:\Users\Admin\AppData\Local\Temp\792c34fea9fdbebd00ccb3e2c82bd3a5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\792c34fea9fdbebd00ccb3e2c82bd3a5.exeC:\Users\Admin\AppData\Local\Temp\792c34fea9fdbebd00ccb3e2c82bd3a5.exe2⤵PID:2932
-
-
C:\Users\Admin\AppData\Local\Temp\792c34fea9fdbebd00ccb3e2c82bd3a5.exeC:\Users\Admin\AppData\Local\Temp\792c34fea9fdbebd00ccb3e2c82bd3a5.exe2⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "cms" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFB6F.tmp" /F3⤵
- Scheduled Task/Job: Scheduled Task
PID:1408
-
-
-
C:\Users\Admin\AppData\Local\Temp\792c34fea9fdbebd00ccb3e2c82bd3a5.exeC:\Users\Admin\AppData\Local\Temp\792c34fea9fdbebd00ccb3e2c82bd3a5.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Roaming\XenoManager\792c34fea9fdbebd00ccb3e2c82bd3a5.exe"C:\Users\Admin\AppData\Roaming\XenoManager\792c34fea9fdbebd00ccb3e2c82bd3a5.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Roaming\XenoManager\792c34fea9fdbebd00ccb3e2c82bd3a5.exeC:\Users\Admin\AppData\Roaming\XenoManager\792c34fea9fdbebd00ccb3e2c82bd3a5.exe4⤵
- Executes dropped EXE
PID:2724
-
-
C:\Users\Admin\AppData\Roaming\XenoManager\792c34fea9fdbebd00ccb3e2c82bd3a5.exeC:\Users\Admin\AppData\Roaming\XenoManager\792c34fea9fdbebd00ccb3e2c82bd3a5.exe4⤵
- Executes dropped EXE
PID:2472
-
-
C:\Users\Admin\AppData\Roaming\XenoManager\792c34fea9fdbebd00ccb3e2c82bd3a5.exeC:\Users\Admin\AppData\Roaming\XenoManager\792c34fea9fdbebd00ccb3e2c82bd3a5.exe4⤵
- Executes dropped EXE
PID:2044
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54e5246e7abef1fefc0f54218c98badf2
SHA16fc50eec3f46acb1f2129d27e8b006463cad2e44
SHA2562234cdda018017ab71809b5acc4c6a75b1a086552566ec742ae46461a42dace3
SHA51279fc972aee63493401fd0419e642684a6b82cf931b42c93e77c231f7b6cd91e00c457b7f52d5cce40bfd4389fa16b8ec9a87555e449a84330d8fa6a6e07b23cb
-
Filesize
221KB
MD5792c34fea9fdbebd00ccb3e2c82bd3a5
SHA1d50a4769a2fca48504e9535a598f1e812d003c2f
SHA256dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a
SHA512f68beb38b7c68432211531d7a6f95626f388089098c878aee956def1e6de96744fa6459064ebd04df01316092cc018ad8321691cdc57265da889f030bf77e606