Analysis
-
max time kernel
142s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
22-06-2024 01:27
Static task
static1
Behavioral task
behavioral1
Sample
ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe
Resource
win7-20240220-en
General
-
Target
ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe
-
Size
221KB
-
MD5
6621fcab4de5fab7eac4d8d03c87f233
-
SHA1
70dd77e26e803239877b30439eb123454bc137cc
-
SHA256
ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2
-
SHA512
d132d2399c65b6b0083f7172c04d4708b28b3deceb93fd0c5dfc5bcfdfd9ee459c5b46853d176e08e99a2a8842945e6cd396e4137fac430c67abea388e83789c
-
SSDEEP
6144:WdwDpybdvNg134Gnq2YZstYaGaqjWq9441D/Kv+I:/cE134GiZ4Ya7mWq9441D/Kvj
Malware Config
Extracted
xenorat
91.92.248.167
Wolid_rat_nd8859g
-
delay
60000
-
install_path
appdata
-
port
1280
-
startup_name
cms
Signatures
-
Detects executables packed with ConfuserEx Mod 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1724-3-0x0000000000410000-0x000000000044A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx -
Executes dropped EXE 4 IoCs
Processes:
ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exepid process 2596 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe 892 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe 2688 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe 2476 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe -
Loads dropped DLL 1 IoCs
Processes:
ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exepid process 1952 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exedescription pid process target process PID 1724 set thread context of 1208 1724 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1724 set thread context of 2592 1724 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1724 set thread context of 1952 1724 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 2596 set thread context of 892 2596 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 2596 set thread context of 2688 2596 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 2596 set thread context of 2476 2596 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exedescription pid process Token: SeDebugPrivilege 1724 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe Token: SeDebugPrivilege 2596 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe -
Suspicious use of WriteProcessMemory 62 IoCs
Processes:
ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exedescription pid process target process PID 1724 wrote to memory of 1208 1724 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1724 wrote to memory of 1208 1724 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1724 wrote to memory of 1208 1724 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1724 wrote to memory of 1208 1724 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1724 wrote to memory of 1208 1724 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1724 wrote to memory of 1208 1724 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1724 wrote to memory of 1208 1724 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1724 wrote to memory of 1208 1724 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1724 wrote to memory of 1208 1724 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1724 wrote to memory of 2592 1724 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1724 wrote to memory of 2592 1724 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1724 wrote to memory of 2592 1724 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1724 wrote to memory of 2592 1724 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1724 wrote to memory of 2592 1724 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1724 wrote to memory of 2592 1724 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1724 wrote to memory of 2592 1724 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1724 wrote to memory of 2592 1724 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1724 wrote to memory of 2592 1724 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1724 wrote to memory of 1952 1724 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1724 wrote to memory of 1952 1724 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1724 wrote to memory of 1952 1724 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1724 wrote to memory of 1952 1724 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1724 wrote to memory of 1952 1724 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1724 wrote to memory of 1952 1724 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1724 wrote to memory of 1952 1724 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1724 wrote to memory of 1952 1724 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1724 wrote to memory of 1952 1724 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1952 wrote to memory of 2596 1952 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1952 wrote to memory of 2596 1952 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1952 wrote to memory of 2596 1952 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1952 wrote to memory of 2596 1952 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 2596 wrote to memory of 892 2596 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 2596 wrote to memory of 892 2596 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 2596 wrote to memory of 892 2596 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 2596 wrote to memory of 892 2596 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 2596 wrote to memory of 892 2596 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 2596 wrote to memory of 892 2596 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 2596 wrote to memory of 892 2596 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 2596 wrote to memory of 892 2596 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 2596 wrote to memory of 892 2596 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 2596 wrote to memory of 2688 2596 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 2596 wrote to memory of 2688 2596 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 2596 wrote to memory of 2688 2596 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 2596 wrote to memory of 2688 2596 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 2596 wrote to memory of 2688 2596 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 2596 wrote to memory of 2688 2596 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 2596 wrote to memory of 2688 2596 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 2596 wrote to memory of 2688 2596 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 2596 wrote to memory of 2688 2596 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 2596 wrote to memory of 2476 2596 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 2596 wrote to memory of 2476 2596 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 2596 wrote to memory of 2476 2596 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 2596 wrote to memory of 2476 2596 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 2596 wrote to memory of 2476 2596 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 2596 wrote to memory of 2476 2596 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 2596 wrote to memory of 2476 2596 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 2596 wrote to memory of 2476 2596 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 2596 wrote to memory of 2476 2596 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1208 wrote to memory of 2628 1208 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe schtasks.exe PID 1208 wrote to memory of 2628 1208 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe schtasks.exe PID 1208 wrote to memory of 2628 1208 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe schtasks.exe PID 1208 wrote to memory of 2628 1208 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe"C:\Users\Admin\AppData\Local\Temp\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeC:\Users\Admin\AppData\Local\Temp\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "cms" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF6CD.tmp" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Local\Temp\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeC:\Users\Admin\AppData\Local\Temp\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeC:\Users\Admin\AppData\Local\Temp\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XenoManager\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe"C:\Users\Admin\AppData\Roaming\XenoManager\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XenoManager\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeC:\Users\Admin\AppData\Roaming\XenoManager\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\XenoManager\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeC:\Users\Admin\AppData\Roaming\XenoManager\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\XenoManager\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeC:\Users\Admin\AppData\Roaming\XenoManager\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpF6CD.tmpFilesize
1KB
MD583d6e89b8754d25b433641acaa2a66eb
SHA1f89d5bdae947ac5cb70fc2ab675b48081d9b0732
SHA2565616a5762d790c9d6f881095099a0adae1b5f2dee34ec1909e823d851a28f5d0
SHA512fb805ced008dc025a0e851ed0075fbc7f9f65a667e82fe68a8f434490f476d1a5bceebaadedf726ac5447f7ccfbd91ef19669ef499150960c9d4b0204cbef97f
-
\Users\Admin\AppData\Roaming\XenoManager\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeFilesize
221KB
MD56621fcab4de5fab7eac4d8d03c87f233
SHA170dd77e26e803239877b30439eb123454bc137cc
SHA256ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2
SHA512d132d2399c65b6b0083f7172c04d4708b28b3deceb93fd0c5dfc5bcfdfd9ee459c5b46853d176e08e99a2a8842945e6cd396e4137fac430c67abea388e83789c
-
memory/1208-41-0x0000000074D90000-0x000000007547E000-memory.dmpFilesize
6.9MB
-
memory/1208-23-0x0000000074D90000-0x000000007547E000-memory.dmpFilesize
6.9MB
-
memory/1208-45-0x0000000074D90000-0x000000007547E000-memory.dmpFilesize
6.9MB
-
memory/1208-44-0x0000000074D90000-0x000000007547E000-memory.dmpFilesize
6.9MB
-
memory/1208-6-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1208-12-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1208-8-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1724-3-0x0000000000410000-0x000000000044A000-memory.dmpFilesize
232KB
-
memory/1724-24-0x0000000074D90000-0x000000007547E000-memory.dmpFilesize
6.9MB
-
memory/1724-2-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/1724-0-0x0000000074D9E000-0x0000000074D9F000-memory.dmpFilesize
4KB
-
memory/1724-1-0x00000000001A0000-0x00000000001DC000-memory.dmpFilesize
240KB
-
memory/1724-5-0x0000000000460000-0x0000000000466000-memory.dmpFilesize
24KB
-
memory/1724-4-0x0000000074D90000-0x000000007547E000-memory.dmpFilesize
6.9MB