Malware Analysis Report

2024-08-06 18:12

Sample ID 240702-bv1tea1fnf
Target 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
SHA256 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab
Tags
xenorat rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab

Threat Level: Known bad

The file 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe was found to be: Known bad.

Malicious Activity Summary

xenorat rat spyware stealer trojan

XenorRat

Reads user/profile data of web browsers

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Program crash

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Scheduled Task/Job: Scheduled Task

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Persistence
TA0003
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Defense Evasion
TA0005
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-07-02 01:28

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-02 01:28

Reported

2024-07-02 01:31

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe"

Signatures

XenorRat

trojan rat xenorat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A

Reads user/profile data of web browsers

spyware stealer

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3900 set thread context of 4004 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 3900 set thread context of 1500 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 3900 set thread context of 1612 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 5088 set thread context of 3056 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 5088 set thread context of 872 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 5088 set thread context of 4324 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3900 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 3900 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 3900 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 3900 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 3900 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 3900 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 3900 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 3900 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 3900 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 3900 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 3900 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 3900 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 3900 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 3900 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 3900 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 3900 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 3900 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 3900 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 3900 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 3900 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 3900 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 3900 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 3900 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 3900 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 1500 wrote to memory of 5088 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 1500 wrote to memory of 5088 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 1500 wrote to memory of 5088 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 5088 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 5088 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 5088 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 5088 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 5088 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 5088 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 5088 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 5088 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 5088 wrote to memory of 872 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 5088 wrote to memory of 872 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 5088 wrote to memory of 872 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 5088 wrote to memory of 872 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 5088 wrote to memory of 872 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 5088 wrote to memory of 872 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 5088 wrote to memory of 872 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 5088 wrote to memory of 872 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 5088 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 5088 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 5088 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 5088 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 5088 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 5088 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 5088 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 5088 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 1612 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Windows\SysWOW64\schtasks.exe
PID 1612 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Windows\SysWOW64\schtasks.exe
PID 1612 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

"C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe"

C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

"C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe"

C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3056 -ip 3056

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 80

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "cms" /XML "C:\Users\Admin\AppData\Local\Temp\tmp31C9.tmp" /F

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 34.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
NL 91.92.248.167:1280 tcp
NL 91.92.248.167:1280 tcp
US 8.8.8.8:53 167.248.92.91.in-addr.arpa udp
NL 91.92.248.167:1280 tcp
NL 91.92.248.167:1280 tcp
US 52.111.229.48:443 tcp
US 8.8.8.8:53 91.65.42.20.in-addr.arpa udp

Files

memory/3900-0-0x000000007501E000-0x000000007501F000-memory.dmp

memory/3900-1-0x00000000002E0000-0x0000000000320000-memory.dmp

memory/3900-2-0x0000000000DB0000-0x0000000000DB6000-memory.dmp

memory/3900-3-0x0000000004E50000-0x0000000004E8E000-memory.dmp

memory/3900-4-0x0000000075010000-0x00000000757C0000-memory.dmp

memory/3900-5-0x000000000D970000-0x000000000DA0C000-memory.dmp

memory/3900-6-0x0000000000D10000-0x0000000000D16000-memory.dmp

memory/4004-7-0x0000000000400000-0x0000000000412000-memory.dmp

memory/4004-11-0x0000000075010000-0x00000000757C0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe.log

MD5 8334a471a4b492ece225b471b8ad2fc8
SHA1 1cb24640f32d23e8f7800bd0511b7b9c3011d992
SHA256 5612afe347d8549cc95a0c710602bcc7d7b224361b613c0a6ba362092300c169
SHA512 56ae2e83355c331b00d782797f5664c2f373eac240e811aab978732503ae05eb20b08730d2427ed90efa5a706d71b42b57153596a45a6b5592e3dd9128b81c36

memory/1500-15-0x0000000075010000-0x00000000757C0000-memory.dmp

memory/4004-14-0x0000000075010000-0x00000000757C0000-memory.dmp

memory/3900-16-0x0000000075010000-0x00000000757C0000-memory.dmp

memory/1612-17-0x0000000075010000-0x00000000757C0000-memory.dmp

C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

MD5 5f86d94893b47e542cf857749dfcd185
SHA1 7816d9af40a9e9265708df00af8137db67d8c7aa
SHA256 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab
SHA512 8cf9bb6ba985843d57f2a013e40d3243b89e5aa0af07d504e9bcc7a2b577028a9cf24258bab14e256b7cb11f75a9a5993eff920879ab11f24c926bce85fb4c7d

memory/1500-28-0x0000000075010000-0x00000000757C0000-memory.dmp

memory/1612-35-0x0000000075010000-0x00000000757C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp31C9.tmp

MD5 3d5fb318f0c4c844c417b4dd9ec02498
SHA1 b83b629d7a8f7a016e30cb3a9eb1b76de34bc78b
SHA256 981169aaa6f00dccdf0822989180d3bb96c6b45fa9b6a819935da76c24dd795e
SHA512 6c141efe1857b1d2ba74ea10fd766166161815d869b5217f79799c650ec2b87f44f36f278b9d1a3f4a754243c5ac4a3abe1aabd74fd3c61903db20403e915806

memory/1612-38-0x0000000005F60000-0x0000000005FC6000-memory.dmp

memory/1612-39-0x00000000055E0000-0x00000000056DA000-memory.dmp

memory/1612-40-0x00000000063A0000-0x0000000006562000-memory.dmp

memory/1612-41-0x0000000006250000-0x00000000062C6000-memory.dmp

memory/1612-42-0x00000000062D0000-0x0000000006320000-memory.dmp

memory/1612-43-0x0000000006AA0000-0x0000000006FCC000-memory.dmp

memory/1612-44-0x0000000006690000-0x00000000066AE000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-02 01:28

Reported

2024-07-02 01:31

Platform

win7-20240611-en

Max time kernel

149s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe"

Signatures

XenorRat

trojan rat xenorat

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A

Reads user/profile data of web browsers

spyware stealer

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2368 set thread context of 2524 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2368 set thread context of 2992 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2368 set thread context of 3044 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2300 set thread context of 2480 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2300 set thread context of 1560 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2300 set thread context of 2428 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2368 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2368 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2368 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2368 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2368 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2368 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2368 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2368 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2368 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2368 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2368 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2368 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2368 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2368 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2368 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2368 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2368 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2368 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2368 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2368 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2368 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2368 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2368 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2368 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2368 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2368 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2368 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 3044 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 3044 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 3044 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 3044 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2300 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2300 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2300 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2300 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2300 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2300 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2300 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2300 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2300 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2300 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2300 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2300 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2300 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2300 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2300 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2300 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2300 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2300 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2300 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2300 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2300 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2300 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2300 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2300 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2300 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2300 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2300 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
PID 2992 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Windows\SysWOW64\schtasks.exe
PID 2992 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Windows\SysWOW64\schtasks.exe
PID 2992 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Windows\SysWOW64\schtasks.exe
PID 2992 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

"C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe"

C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

"C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe"

C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "cms" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF99B.tmp" /F

Network

Country Destination Domain Proto
NL 91.92.248.167:1280 tcp
NL 91.92.248.167:1280 tcp
NL 91.92.248.167:1280 tcp
NL 91.92.248.167:1280 tcp

Files

memory/2368-0-0x00000000741DE000-0x00000000741DF000-memory.dmp

memory/2368-1-0x0000000000990000-0x00000000009D0000-memory.dmp

memory/2368-2-0x00000000004A0000-0x00000000004A6000-memory.dmp

memory/2368-3-0x0000000000920000-0x000000000095E000-memory.dmp

memory/2368-4-0x00000000741D0000-0x00000000748BE000-memory.dmp

memory/2368-5-0x00000000003F0000-0x00000000003F6000-memory.dmp

memory/2992-7-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2992-11-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2992-9-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2368-18-0x00000000741D0000-0x00000000748BE000-memory.dmp

memory/3044-20-0x00000000741D0000-0x00000000748BE000-memory.dmp

memory/2992-19-0x00000000741D0000-0x00000000748BE000-memory.dmp

\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

MD5 5f86d94893b47e542cf857749dfcd185
SHA1 7816d9af40a9e9265708df00af8137db67d8c7aa
SHA256 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab
SHA512 8cf9bb6ba985843d57f2a013e40d3243b89e5aa0af07d504e9bcc7a2b577028a9cf24258bab14e256b7cb11f75a9a5993eff920879ab11f24c926bce85fb4c7d

memory/3044-27-0x00000000741D0000-0x00000000748BE000-memory.dmp

memory/2300-28-0x00000000003E0000-0x0000000000420000-memory.dmp

memory/2992-35-0x00000000741D0000-0x00000000748BE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpF99B.tmp

MD5 3d5fb318f0c4c844c417b4dd9ec02498
SHA1 b83b629d7a8f7a016e30cb3a9eb1b76de34bc78b
SHA256 981169aaa6f00dccdf0822989180d3bb96c6b45fa9b6a819935da76c24dd795e
SHA512 6c141efe1857b1d2ba74ea10fd766166161815d869b5217f79799c650ec2b87f44f36f278b9d1a3f4a754243c5ac4a3abe1aabd74fd3c61903db20403e915806

memory/2992-38-0x00000000741D0000-0x00000000748BE000-memory.dmp

memory/2992-39-0x00000000060C0000-0x00000000061BA000-memory.dmp

memory/2992-45-0x00000000063E0000-0x0000000006660000-memory.dmp

memory/2992-56-0x00000000741D0000-0x00000000748BE000-memory.dmp