Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
04-07-2024 11:42
Static task
static1
Behavioral task
behavioral1
Sample
odeme tarihleri.scr.exe
Resource
win7-20240221-en
General
-
Target
odeme tarihleri.scr.exe
-
Size
240KB
-
MD5
bb4b3fd0c725a96ba871f77f9604fa69
-
SHA1
0b3926a1a98b87938b94f8ffd511f7319a576990
-
SHA256
c3e5a543f13e20484325ba5a08fd8993880f8282ed5a40e30c97fcf2aea91fa1
-
SHA512
cce99d6730ba2de4bd530fca0f31c3d702fecc55370e135915dec69415484335879c0e07cb2a406266a4aed641e57c631b27ce7ff30198a23038f25ae0296a63
-
SSDEEP
6144:GVjndzqytMhsZAEO66joa7ZgVtgv5T7K9YWs1NExcl+Vk+jI:FyasZAEB6jo++VSv569YWs1NExcl+Vkt
Malware Config
Extracted
xenorat
91.92.248.167
Dolid_rat_nd8859g
-
delay
60000
-
install_path
appdata
-
port
1280
-
startup_name
dms
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
odeme tarihleri.scr.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation odeme tarihleri.scr.exe -
Executes dropped EXE 4 IoCs
Processes:
odeme tarihleri.scr.exeodeme tarihleri.scr.exeodeme tarihleri.scr.exeodeme tarihleri.scr.exepid process 4956 odeme tarihleri.scr.exe 1052 odeme tarihleri.scr.exe 1088 odeme tarihleri.scr.exe 3632 odeme tarihleri.scr.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 6 IoCs
Processes:
odeme tarihleri.scr.exeodeme tarihleri.scr.exedescription pid process target process PID 1568 set thread context of 2824 1568 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 1568 set thread context of 3264 1568 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 1568 set thread context of 5092 1568 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 4956 set thread context of 1052 4956 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 4956 set thread context of 1088 4956 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 4956 set thread context of 3632 4956 odeme tarihleri.scr.exe odeme tarihleri.scr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4916 3632 WerFault.exe odeme tarihleri.scr.exe 5100 1052 WerFault.exe odeme tarihleri.scr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
odeme tarihleri.scr.exepid process 5092 odeme tarihleri.scr.exe 5092 odeme tarihleri.scr.exe 5092 odeme tarihleri.scr.exe 5092 odeme tarihleri.scr.exe 5092 odeme tarihleri.scr.exe 5092 odeme tarihleri.scr.exe 5092 odeme tarihleri.scr.exe 5092 odeme tarihleri.scr.exe 5092 odeme tarihleri.scr.exe 5092 odeme tarihleri.scr.exe 5092 odeme tarihleri.scr.exe 5092 odeme tarihleri.scr.exe 5092 odeme tarihleri.scr.exe 5092 odeme tarihleri.scr.exe 5092 odeme tarihleri.scr.exe 5092 odeme tarihleri.scr.exe 5092 odeme tarihleri.scr.exe 5092 odeme tarihleri.scr.exe 5092 odeme tarihleri.scr.exe 5092 odeme tarihleri.scr.exe 5092 odeme tarihleri.scr.exe 5092 odeme tarihleri.scr.exe 5092 odeme tarihleri.scr.exe 5092 odeme tarihleri.scr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
odeme tarihleri.scr.exeodeme tarihleri.scr.exeodeme tarihleri.scr.exedescription pid process Token: SeDebugPrivilege 1568 odeme tarihleri.scr.exe Token: SeDebugPrivilege 4956 odeme tarihleri.scr.exe Token: SeDebugPrivilege 5092 odeme tarihleri.scr.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
odeme tarihleri.scr.exeodeme tarihleri.scr.exeodeme tarihleri.scr.exeodeme tarihleri.scr.exedescription pid process target process PID 1568 wrote to memory of 2824 1568 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 1568 wrote to memory of 2824 1568 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 1568 wrote to memory of 2824 1568 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 1568 wrote to memory of 2824 1568 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 1568 wrote to memory of 2824 1568 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 1568 wrote to memory of 2824 1568 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 1568 wrote to memory of 2824 1568 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 1568 wrote to memory of 2824 1568 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 1568 wrote to memory of 3264 1568 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 1568 wrote to memory of 3264 1568 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 1568 wrote to memory of 3264 1568 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 1568 wrote to memory of 3264 1568 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 1568 wrote to memory of 3264 1568 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 1568 wrote to memory of 3264 1568 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 1568 wrote to memory of 3264 1568 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 1568 wrote to memory of 3264 1568 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 1568 wrote to memory of 5092 1568 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 1568 wrote to memory of 5092 1568 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 1568 wrote to memory of 5092 1568 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 1568 wrote to memory of 5092 1568 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 1568 wrote to memory of 5092 1568 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 1568 wrote to memory of 5092 1568 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 1568 wrote to memory of 5092 1568 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 1568 wrote to memory of 5092 1568 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 3264 wrote to memory of 4956 3264 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 3264 wrote to memory of 4956 3264 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 3264 wrote to memory of 4956 3264 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 4956 wrote to memory of 1052 4956 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 4956 wrote to memory of 1052 4956 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 4956 wrote to memory of 1052 4956 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 4956 wrote to memory of 1052 4956 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 4956 wrote to memory of 1052 4956 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 4956 wrote to memory of 1052 4956 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 4956 wrote to memory of 1052 4956 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 4956 wrote to memory of 1052 4956 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 4956 wrote to memory of 1088 4956 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 4956 wrote to memory of 1088 4956 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 4956 wrote to memory of 1088 4956 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 4956 wrote to memory of 1088 4956 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 4956 wrote to memory of 1088 4956 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 4956 wrote to memory of 1088 4956 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 4956 wrote to memory of 1088 4956 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 4956 wrote to memory of 1088 4956 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 4956 wrote to memory of 3632 4956 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 4956 wrote to memory of 3632 4956 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 4956 wrote to memory of 3632 4956 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 4956 wrote to memory of 3632 4956 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 4956 wrote to memory of 3632 4956 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 4956 wrote to memory of 3632 4956 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 4956 wrote to memory of 3632 4956 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 4956 wrote to memory of 3632 4956 odeme tarihleri.scr.exe odeme tarihleri.scr.exe PID 5092 wrote to memory of 512 5092 odeme tarihleri.scr.exe schtasks.exe PID 5092 wrote to memory of 512 5092 odeme tarihleri.scr.exe schtasks.exe PID 5092 wrote to memory of 512 5092 odeme tarihleri.scr.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\odeme tarihleri.scr.exe"C:\Users\Admin\AppData\Local\Temp\odeme tarihleri.scr.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\odeme tarihleri.scr.exe"C:\Users\Admin\AppData\Local\Temp\odeme tarihleri.scr.exe"2⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\odeme tarihleri.scr.exe"C:\Users\Admin\AppData\Local\Temp\odeme tarihleri.scr.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Roaming\XenoManager\odeme tarihleri.scr.exe"C:\Users\Admin\AppData\Roaming\XenoManager\odeme tarihleri.scr.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Roaming\XenoManager\odeme tarihleri.scr.exe"C:\Users\Admin\AppData\Roaming\XenoManager\odeme tarihleri.scr.exe"4⤵
- Executes dropped EXE
PID:1052 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 805⤵
- Program crash
PID:5100 -
C:\Users\Admin\AppData\Roaming\XenoManager\odeme tarihleri.scr.exe"C:\Users\Admin\AppData\Roaming\XenoManager\odeme tarihleri.scr.exe"4⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Roaming\XenoManager\odeme tarihleri.scr.exe"C:\Users\Admin\AppData\Roaming\XenoManager\odeme tarihleri.scr.exe"4⤵
- Executes dropped EXE
PID:3632 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 805⤵
- Program crash
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\odeme tarihleri.scr.exe"C:\Users\Admin\AppData\Local\Temp\odeme tarihleri.scr.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "dms" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3767.tmp" /F3⤵
- Scheduled Task/Job: Scheduled Task
PID:512
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3632 -ip 36321⤵PID:4228
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1052 -ip 10521⤵PID:1444
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\odeme tarihleri.scr.exe.logFilesize
522B
MD58334a471a4b492ece225b471b8ad2fc8
SHA11cb24640f32d23e8f7800bd0511b7b9c3011d992
SHA2565612afe347d8549cc95a0c710602bcc7d7b224361b613c0a6ba362092300c169
SHA51256ae2e83355c331b00d782797f5664c2f373eac240e811aab978732503ae05eb20b08730d2427ed90efa5a706d71b42b57153596a45a6b5592e3dd9128b81c36
-
C:\Users\Admin\AppData\Local\Temp\tmp3767.tmpFilesize
1KB
MD537ec5267dd86eda7ede5ebd12f1e36f1
SHA144b076789f3b146b984bf38a80ede8a02af969c7
SHA256438b9d04247ca8bea31f6021570568582eb427bc258ad053a09c5c9dadfbfb22
SHA51223c79488911085bf39d31aa3e3be93681e7cc147e8853b88ab1fcee7b334895d575c2afe0d119993879aafdc020385aa7c96991567dd82498eef40061b1359ad
-
C:\Users\Admin\AppData\Roaming\XenoManager\odeme tarihleri.scr.exeFilesize
240KB
MD5bb4b3fd0c725a96ba871f77f9604fa69
SHA10b3926a1a98b87938b94f8ffd511f7319a576990
SHA256c3e5a543f13e20484325ba5a08fd8993880f8282ed5a40e30c97fcf2aea91fa1
SHA512cce99d6730ba2de4bd530fca0f31c3d702fecc55370e135915dec69415484335879c0e07cb2a406266a4aed641e57c631b27ce7ff30198a23038f25ae0296a63
-
memory/1568-6-0x0000000004BA0000-0x0000000004BA6000-memory.dmpFilesize
24KB
-
memory/1568-4-0x0000000004B60000-0x0000000004B9E000-memory.dmpFilesize
248KB
-
memory/1568-5-0x0000000005F30000-0x0000000005FCC000-memory.dmpFilesize
624KB
-
memory/1568-0-0x0000000074F5E000-0x0000000074F5F000-memory.dmpFilesize
4KB
-
memory/1568-3-0x0000000074F50000-0x0000000075700000-memory.dmpFilesize
7.7MB
-
memory/1568-17-0x0000000074F50000-0x0000000075700000-memory.dmpFilesize
7.7MB
-
memory/1568-1-0x0000000000130000-0x0000000000170000-memory.dmpFilesize
256KB
-
memory/1568-2-0x0000000004B50000-0x0000000004B56000-memory.dmpFilesize
24KB
-
memory/2824-7-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2824-11-0x0000000074F50000-0x0000000075700000-memory.dmpFilesize
7.7MB
-
memory/2824-15-0x0000000074F50000-0x0000000075700000-memory.dmpFilesize
7.7MB
-
memory/3264-14-0x0000000074F50000-0x0000000075700000-memory.dmpFilesize
7.7MB
-
memory/3264-29-0x0000000074F50000-0x0000000075700000-memory.dmpFilesize
7.7MB
-
memory/5092-18-0x0000000074F50000-0x0000000075700000-memory.dmpFilesize
7.7MB
-
memory/5092-36-0x0000000074F50000-0x0000000075700000-memory.dmpFilesize
7.7MB
-
memory/5092-16-0x0000000074F50000-0x0000000075700000-memory.dmpFilesize
7.7MB
-
memory/5092-39-0x00000000055D0000-0x0000000005636000-memory.dmpFilesize
408KB
-
memory/5092-40-0x0000000005C60000-0x0000000005D5A000-memory.dmpFilesize
1000KB
-
memory/5092-41-0x0000000005F30000-0x00000000060F2000-memory.dmpFilesize
1.8MB
-
memory/5092-43-0x0000000005E60000-0x0000000005EB0000-memory.dmpFilesize
320KB
-
memory/5092-42-0x0000000005DE0000-0x0000000005E56000-memory.dmpFilesize
472KB
-
memory/5092-44-0x0000000006630000-0x0000000006B5C000-memory.dmpFilesize
5.2MB
-
memory/5092-45-0x0000000006220000-0x000000000623E000-memory.dmpFilesize
120KB
-
memory/5092-54-0x0000000006B60000-0x0000000006DE0000-memory.dmpFilesize
2.5MB