Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe	N/A

Reads user/profile data of web browsers

spyware stealer

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 2160 set thread context of 2508	N/A	C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe	C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe
PID 2160 set thread context of 2612	N/A	C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe	C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe
PID 2160 set thread context of 2652	N/A	C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe	C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe
PID 2456 set thread context of 2272	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe
PID 2456 set thread context of 2444	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe
PID 2456 set thread context of 2872	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\schtasks.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe	N/A

Suspicious use of WriteProcessMemory

Processes

C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe

"C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe"

C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe

"C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe"

C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe

"C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe"

C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe

"C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe"

C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe

"C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe"

C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe

"C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe"

C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe

"C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe"

C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe

"C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "dms" /XML "C:\Users\Admin\AppData\Local\Temp\tmp11A.tmp" /F

Network

Country	Destination	Domain	Proto
NL	91.92.248.167:1280		tcp
NL	91.92.248.167:1280		tcp
NL	91.92.248.167:1280		tcp
NL	91.92.248.167:1280		tcp
NL	91.92.248.167:1280		tcp
NL	91.92.248.167:1280		tcp
NL	91.92.248.167:1280		tcp
NL	91.92.248.167:1280		tcp
NL	91.92.248.167:1280		tcp

Files

memory/2160-0-0x00000000744CE000-0x00000000744CF000-memory.dmp

memory/2160-1-0x0000000000160000-0x00000000001A0000-memory.dmp

memory/2160-2-0x0000000000590000-0x0000000000596000-memory.dmp

memory/2160-3-0x00000000744C0000-0x0000000074BAE000-memory.dmp

memory/2160-4-0x00000000006C0000-0x00000000006FE000-memory.dmp

memory/2160-5-0x0000000000500000-0x0000000000506000-memory.dmp

memory/2508-6-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2508-12-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2612-15-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2508-19-0x00000000744C0000-0x0000000074BAE000-memory.dmp

memory/2160-20-0x00000000744C0000-0x0000000074BAE000-memory.dmp

memory/2612-21-0x00000000744C0000-0x0000000074BAE000-memory.dmp

\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe

MD5	3464c6b50ffdf4e9cad35a423868fa17
SHA1	4911e2fd81a78c402c0638b6705e26af73deb3d1
SHA256	85eeb40d3c63e7452b85dd1f64ad8c6a959baf5f392719ee709d8093404782db
SHA512	86750a9c8b4221075fc133301502ebae2d138bc153463afd368afd0999661343d8e0585d72247e0ac000d0a7cf9e6d0e6a167a2eb7ab07abda030cdcc3214394

memory/2508-28-0x00000000744C0000-0x0000000074BAE000-memory.dmp

memory/2456-29-0x0000000000DF0000-0x0000000000E30000-memory.dmp

memory/2612-42-0x00000000744C0000-0x0000000074BAE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp11A.tmp

MD5	15353a3bb0a5c558a81376bcdfdc6ad6
SHA1	36156e5bd828094aacba26b60214420192009f01
SHA256	66d9195ec358a9736be2517f55b02206baa72c2d08512474f474773bbef6ef3a
SHA512	331585e484b39553b5bb51745db450f46b1b75c04610eb50d1824a3a25c29c1c235212b52b1772205ce5c80643a77ef78eba3c3999cf2828c3645862e06cabb4

memory/2612-45-0x00000000744C0000-0x0000000074BAE000-memory.dmp

memory/2612-46-0x00000000061C0000-0x00000000062BA000-memory.dmp

memory/2612-62-0x00000000744C0000-0x0000000074BAE000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-04 11:41

Reported

2024-07-04 11:43

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe"

Signatures

XenorRat

trojan rat xenorat

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A

Reads user/profile data of web browsers

spyware stealer

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 1812 set thread context of 2772	N/A	C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe	C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe
PID 1812 set thread context of 3908	N/A	C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe	C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe
PID 1812 set thread context of 1212	N/A	C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe	C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe
PID 4420 set thread context of 1444	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe
PID 4420 set thread context of 3772	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe
PID 4420 set thread context of 5052	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe

Enumerates physical storage devices

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe

Scheduled Task/Job: Scheduled Task

persistence execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\schtasks.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe	N/A

Suspicious use of WriteProcessMemory

Processes

C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe

"C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe"

C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe

"C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe"

C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe

"C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe"

C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe

"C:\Users\Admin\AppData\Local\Temp\fechas de pago.scr.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1212 -ip 1212

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3908 -ip 3908

C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe

"C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 80

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 80

C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe

"C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe"

C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe

"C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe"

C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe

"C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1444 -ip 1444

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4116,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:8

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "dms" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE877.tmp" /F

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	149.220.183.52.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	0.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	133.211.185.52.in-addr.arpa	udp
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	192.142.123.92.in-addr.arpa	udp
US	8.8.8.8:53	29.243.111.52.in-addr.arpa	udp
NL	91.92.248.167:1280		tcp
US	8.8.8.8:53	167.248.92.91.in-addr.arpa	udp
NL	91.92.248.167:1280		tcp
NL	91.92.248.167:1280		tcp
NL	91.92.248.167:1280		tcp
NL	91.92.248.167:1280		tcp
US	8.8.8.8:53	73.144.22.2.in-addr.arpa	udp
NL	91.92.248.167:1280		tcp
NL	91.92.248.167:1280		tcp
NL	91.92.248.167:1280		tcp
NL	91.92.248.167:1280		tcp
NL	91.92.248.167:1280		tcp
NL	91.92.248.167:1280		tcp
NL	91.92.248.167:1280		tcp
NL	91.92.248.167:1280		tcp

Files

memory/1812-0-0x000000007532E000-0x000000007532F000-memory.dmp

memory/1812-1-0x0000000000AF0000-0x0000000000B30000-memory.dmp

memory/1812-2-0x0000000002D60000-0x0000000002D66000-memory.dmp

memory/1812-3-0x0000000005420000-0x000000000545E000-memory.dmp

memory/1812-4-0x0000000075320000-0x0000000075AD0000-memory.dmp

memory/1812-5-0x00000000057A0000-0x000000000583C000-memory.dmp

memory/1812-6-0x0000000005460000-0x0000000005466000-memory.dmp

memory/2772-7-0x0000000000400000-0x0000000000412000-memory.dmp

memory/3908-8-0x0000000000400000-0x0000000000420000-memory.dmp

memory/2772-12-0x0000000075320000-0x0000000075AD0000-memory.dmp

memory/1812-13-0x0000000075320000-0x0000000075AD0000-memory.dmp

C:\Users\Admin\AppData\Roaming\XenoManager\fechas de pago.scr.exe

MD5	3464c6b50ffdf4e9cad35a423868fa17
SHA1	4911e2fd81a78c402c0638b6705e26af73deb3d1
SHA256	85eeb40d3c63e7452b85dd1f64ad8c6a959baf5f392719ee709d8093404782db
SHA512	86750a9c8b4221075fc133301502ebae2d138bc153463afd368afd0999661343d8e0585d72247e0ac000d0a7cf9e6d0e6a167a2eb7ab07abda030cdcc3214394

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fechas de pago.scr.exe.log

MD5	8334a471a4b492ece225b471b8ad2fc8
SHA1	1cb24640f32d23e8f7800bd0511b7b9c3011d992
SHA256	5612afe347d8549cc95a0c710602bcc7d7b224361b613c0a6ba362092300c169
SHA512	56ae2e83355c331b00d782797f5664c2f373eac240e811aab978732503ae05eb20b08730d2427ed90efa5a706d71b42b57153596a45a6b5592e3dd9128b81c36

memory/2772-25-0x0000000075320000-0x0000000075AD0000-memory.dmp

memory/4420-26-0x0000000075320000-0x0000000075AD0000-memory.dmp

memory/4420-27-0x0000000075320000-0x0000000075AD0000-memory.dmp

memory/3772-34-0x0000000075320000-0x0000000075AD0000-memory.dmp

memory/4420-35-0x0000000075320000-0x0000000075AD0000-memory.dmp

memory/3772-36-0x0000000075320000-0x0000000075AD0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpE877.tmp

MD5	8c9b557a6488ef9093caaccc60cc4223
SHA1	31a072f552d65a4d60ee025b8a70d654d3093009
SHA256	5a3ceafb68e10422476e8a783acd0b5881e6a21aa7f951841c54ad3cf138c357
SHA512	d07dabd8a01eebc2c10e3a82f157c300e5c2307a3aa5af69ddf8c47408a0f8db98e053204b69cace2da3314605de507b4ba54b010bafec6e8cf3c6de48cbb087

memory/3772-39-0x0000000005800000-0x0000000005866000-memory.dmp

memory/3772-40-0x0000000005A70000-0x0000000005B6A000-memory.dmp

memory/3772-41-0x0000000005D40000-0x0000000005F02000-memory.dmp

memory/3772-42-0x0000000005C30000-0x0000000005CA6000-memory.dmp

memory/3772-43-0x0000000005CB0000-0x0000000005D00000-memory.dmp

memory/3772-44-0x0000000006440000-0x000000000696C000-memory.dmp

memory/3772-45-0x0000000006040000-0x000000000605E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\esrcztgs.cvd

MD5	73bd1e15afb04648c24593e8ba13e983
SHA1	4dd85ca46fcdf9d93f6b324f8bb0b5bb512a1b91
SHA256	aab0b201f392fef9fdff09e56a9d0ac33d0f68be95da270e6dab89bb1f971d8b
SHA512	6eb58fb41691894045569085bd64a83acd62277575ab002cf73d729bda4b6d43c36643a5fa336342e87a493326337ed43b8e5eaeae32f53210714699cb8dfac7

C:\Users\Admin\AppData\Local\Temp\1jzjrpbe.dii

MD5	99f9e1d0e6242010707fea4814c5d1cc
SHA1	611cd9346a29f73337cc984f18885c34454e2689
SHA256	82d690db648e3899eaef9c74b934da29980758295be66edde20716ce3e108074
SHA512	aefcd24d55be3c50585d9c1afcdb05702fdbe08572fbab25e6a48e6ced3239cb7760afc286e6ee16e0fe3d961a9251a19926a34ec3ca81211bd369405a9bbdd4

Sample ID	240704-nte7jawfkk
Target	fechas de pago.scr.exe
SHA256	85eeb40d3c63e7452b85dd1f64ad8c6a959baf5f392719ee709d8093404782db
Tags	xenorat rat spyware stealer trojan

Malware Analysis Report

2024-08-06 18:11

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files