Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
03-07-2024 14:23
Static task
static1
Behavioral task
behavioral1
Sample
4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe
Resource
win7-20240419-en
General
-
Target
4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe
-
Size
235KB
-
MD5
edc793f85ad6e90c754a9f0799cc08e3
-
SHA1
c0a2e36283f9e20219b25dd4e15ec7dc73e7aa71
-
SHA256
4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb
-
SHA512
653ffa9b5f36afc61804354d74faf0d15e0ff3db4209a4d688de9c49917966a095b56108da1948e5011b262abd910259977f428d80e407d48a6af07579a6058a
-
SSDEEP
6144:OGKCONo00JeBH3onZ2q5YUUexxgKR63u9i24NnPdI:OBCy0J+XQZ1xgKR63u9i24NnPG
Malware Config
Extracted
xenorat
91.92.248.167
Wolid_rat_nd8859g
-
delay
60000
-
install_path
appdata
-
port
1280
-
startup_name
cms
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2620 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 2616 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 2508 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 2576 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe -
Loads dropped DLL 1 IoCs
pid Process 2824 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 2124 set thread context of 2824 2124 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 28 PID 2124 set thread context of 1776 2124 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 29 PID 2124 set thread context of 2688 2124 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 30 PID 2620 set thread context of 2616 2620 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 32 PID 2620 set thread context of 2508 2620 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 33 PID 2620 set thread context of 2576 2620 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 496 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2124 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe Token: SeDebugPrivilege 2620 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe -
Suspicious use of WriteProcessMemory 62 IoCs
description pid Process procid_target PID 2124 wrote to memory of 2824 2124 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 28 PID 2124 wrote to memory of 2824 2124 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 28 PID 2124 wrote to memory of 2824 2124 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 28 PID 2124 wrote to memory of 2824 2124 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 28 PID 2124 wrote to memory of 2824 2124 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 28 PID 2124 wrote to memory of 2824 2124 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 28 PID 2124 wrote to memory of 2824 2124 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 28 PID 2124 wrote to memory of 2824 2124 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 28 PID 2124 wrote to memory of 2824 2124 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 28 PID 2124 wrote to memory of 1776 2124 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 29 PID 2124 wrote to memory of 1776 2124 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 29 PID 2124 wrote to memory of 1776 2124 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 29 PID 2124 wrote to memory of 1776 2124 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 29 PID 2124 wrote to memory of 1776 2124 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 29 PID 2124 wrote to memory of 1776 2124 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 29 PID 2124 wrote to memory of 1776 2124 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 29 PID 2124 wrote to memory of 1776 2124 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 29 PID 2124 wrote to memory of 1776 2124 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 29 PID 2124 wrote to memory of 2688 2124 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 30 PID 2124 wrote to memory of 2688 2124 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 30 PID 2124 wrote to memory of 2688 2124 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 30 PID 2124 wrote to memory of 2688 2124 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 30 PID 2124 wrote to memory of 2688 2124 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 30 PID 2124 wrote to memory of 2688 2124 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 30 PID 2124 wrote to memory of 2688 2124 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 30 PID 2124 wrote to memory of 2688 2124 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 30 PID 2124 wrote to memory of 2688 2124 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 30 PID 2824 wrote to memory of 2620 2824 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 31 PID 2824 wrote to memory of 2620 2824 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 31 PID 2824 wrote to memory of 2620 2824 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 31 PID 2824 wrote to memory of 2620 2824 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 31 PID 2620 wrote to memory of 2616 2620 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 32 PID 2620 wrote to memory of 2616 2620 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 32 PID 2620 wrote to memory of 2616 2620 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 32 PID 2620 wrote to memory of 2616 2620 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 32 PID 2620 wrote to memory of 2616 2620 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 32 PID 2620 wrote to memory of 2616 2620 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 32 PID 2620 wrote to memory of 2616 2620 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 32 PID 2620 wrote to memory of 2616 2620 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 32 PID 2620 wrote to memory of 2616 2620 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 32 PID 2620 wrote to memory of 2508 2620 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 33 PID 2620 wrote to memory of 2508 2620 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 33 PID 2620 wrote to memory of 2508 2620 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 33 PID 2620 wrote to memory of 2508 2620 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 33 PID 2620 wrote to memory of 2508 2620 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 33 PID 2620 wrote to memory of 2508 2620 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 33 PID 2620 wrote to memory of 2508 2620 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 33 PID 2620 wrote to memory of 2508 2620 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 33 PID 2620 wrote to memory of 2508 2620 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 33 PID 2620 wrote to memory of 2576 2620 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 34 PID 2620 wrote to memory of 2576 2620 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 34 PID 2620 wrote to memory of 2576 2620 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 34 PID 2620 wrote to memory of 2576 2620 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 34 PID 2620 wrote to memory of 2576 2620 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 34 PID 2620 wrote to memory of 2576 2620 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 34 PID 2620 wrote to memory of 2576 2620 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 34 PID 2620 wrote to memory of 2576 2620 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 34 PID 2620 wrote to memory of 2576 2620 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 34 PID 1776 wrote to memory of 496 1776 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 37 PID 1776 wrote to memory of 496 1776 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 37 PID 1776 wrote to memory of 496 1776 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 37 PID 1776 wrote to memory of 496 1776 4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe"C:\Users\Admin\AppData\Local\Temp\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exeC:\Users\Admin\AppData\Local\Temp\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Roaming\XenoManager\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe"C:\Users\Admin\AppData\Roaming\XenoManager\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Roaming\XenoManager\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exeC:\Users\Admin\AppData\Roaming\XenoManager\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe4⤵
- Executes dropped EXE
PID:2616
-
-
C:\Users\Admin\AppData\Roaming\XenoManager\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exeC:\Users\Admin\AppData\Roaming\XenoManager\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe4⤵
- Executes dropped EXE
PID:2508
-
-
C:\Users\Admin\AppData\Roaming\XenoManager\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exeC:\Users\Admin\AppData\Roaming\XenoManager\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe4⤵
- Executes dropped EXE
PID:2576
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exeC:\Users\Admin\AppData\Local\Temp\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "cms" /XML "C:\Users\Admin\AppData\Local\Temp\tmp906.tmp" /F3⤵
- Scheduled Task/Job: Scheduled Task
PID:496
-
-
-
C:\Users\Admin\AppData\Local\Temp\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exeC:\Users\Admin\AppData\Local\Temp\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe2⤵PID:2688
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5cdbd829e6cd46e8a747214e62d6b9ba6
SHA12cc952d146a50e6e37de320d56aee66f6e328f5a
SHA25615dc6821efb09ad1b196f9c36322e252c5ddc10e80ee0f3ee0134d74bfea9b8d
SHA51259c9d58b86c2584ec5341b50344c5ab9e5a8ddd4e71e6d96b56e8d3033e262666393d9c821de73197d5388bd2e8818cc798ff083b6e99959777fcdf73be794d2
-
\Users\Admin\AppData\Roaming\XenoManager\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe
Filesize235KB
MD5edc793f85ad6e90c754a9f0799cc08e3
SHA1c0a2e36283f9e20219b25dd4e15ec7dc73e7aa71
SHA2564d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb
SHA512653ffa9b5f36afc61804354d74faf0d15e0ff3db4209a4d688de9c49917966a095b56108da1948e5011b262abd910259977f428d80e407d48a6af07579a6058a