Analysis
-
max time kernel
59s -
max time network
64s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
02-07-2024 00:27
General
-
Target
SteamUDP.exe
-
Size
45KB
-
MD5
71f93439066552063011b27f448fc1ce
-
SHA1
afd983b5d3a34ba29ef18d7675e617b9a6da724f
-
SHA256
5379f50c0b4b3a28641354e048b51278dd10519f50e081a07bbe8f0d4f22a5ad
-
SHA512
ac56596bb93e61d240933353a1d3fd1d5a64dce97e13d381b94190f312ec57be856cd3fdd08c685d6960d734518514b7ecf69284e6371fe8fd96480ae1d76be3
-
SSDEEP
768:9dhO/poiiUcjlJInbzH9Xqk5nWEZ5SbTDa+WI7CPW5w:zw+jjgnXH9XqcnW85SbT/WIY
Malware Config
Extracted
xenorat
37.120.141.155
SteamUDP
-
delay
5000
-
install_path
temp
-
port
22914
-
startup_name
SteamUDPUpdater
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SteamUDP.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation SteamUDP.exe -
Executes dropped EXE 1 IoCs
Processes:
SteamUDP.exepid process 2304 SteamUDP.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
SteamUDP.exepid process 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe 2304 SteamUDP.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SteamUDP.exedescription pid process Token: SeDebugPrivilege 2304 SteamUDP.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
SteamUDP.exeSteamUDP.exedescription pid process target process PID 3404 wrote to memory of 2304 3404 SteamUDP.exe SteamUDP.exe PID 3404 wrote to memory of 2304 3404 SteamUDP.exe SteamUDP.exe PID 3404 wrote to memory of 2304 3404 SteamUDP.exe SteamUDP.exe PID 2304 wrote to memory of 2588 2304 SteamUDP.exe schtasks.exe PID 2304 wrote to memory of 2588 2304 SteamUDP.exe schtasks.exe PID 2304 wrote to memory of 2588 2304 SteamUDP.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SteamUDP.exe"C:\Users\Admin\AppData\Local\Temp\SteamUDP.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\SteamUDP.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\SteamUDP.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "SteamUDPUpdater" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6E3B.tmp" /F3⤵
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SteamUDP.exe.logFilesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\SteamUDP.exeFilesize
45KB
MD571f93439066552063011b27f448fc1ce
SHA1afd983b5d3a34ba29ef18d7675e617b9a6da724f
SHA2565379f50c0b4b3a28641354e048b51278dd10519f50e081a07bbe8f0d4f22a5ad
SHA512ac56596bb93e61d240933353a1d3fd1d5a64dce97e13d381b94190f312ec57be856cd3fdd08c685d6960d734518514b7ecf69284e6371fe8fd96480ae1d76be3
-
C:\Users\Admin\AppData\Local\Temp\tmp6E3B.tmpFilesize
1KB
MD53e416c7f65c19033c2c17e7f0bc2bfd8
SHA1edc2d8b19e94e8d29579baf5e01c5fe057425712
SHA256fb1d16435bee9ea3fa3d171f3d01818c1c1dd3ce5e47d9292c7b0089ad6f2773
SHA512debae6c61bcf8e34575d4eec2334c27b0205b5a6b428e9f17ff25a55bea845bb5131c68f0ba7384e781b2b9d2dfd1eb2ce93aef47d4fe2dee34a21c147973524
-
memory/2304-15-0x0000000075140000-0x00000000758F0000-memory.dmpFilesize
7.7MB
-
memory/2304-18-0x00000000056D0000-0x0000000005736000-memory.dmpFilesize
408KB
-
memory/2304-19-0x0000000075140000-0x00000000758F0000-memory.dmpFilesize
7.7MB
-
memory/2304-20-0x0000000075140000-0x00000000758F0000-memory.dmpFilesize
7.7MB
-
memory/2304-21-0x00000000056C0000-0x00000000056CA000-memory.dmpFilesize
40KB
-
memory/2304-22-0x0000000006040000-0x00000000065E4000-memory.dmpFilesize
5.6MB
-
memory/2304-23-0x0000000005B90000-0x0000000005C22000-memory.dmpFilesize
584KB
-
memory/3404-0-0x000000007514E000-0x000000007514F000-memory.dmpFilesize
4KB
-
memory/3404-1-0x0000000000240000-0x0000000000252000-memory.dmpFilesize
72KB