Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04-07-2024 16:54
Static task
static1
Behavioral task
behavioral1
Sample
6621fcab4de5fab7eac4d8d03c87f233.exe
Resource
win7-20240220-en
General
-
Target
6621fcab4de5fab7eac4d8d03c87f233.exe
-
Size
221KB
-
MD5
6621fcab4de5fab7eac4d8d03c87f233
-
SHA1
70dd77e26e803239877b30439eb123454bc137cc
-
SHA256
ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2
-
SHA512
d132d2399c65b6b0083f7172c04d4708b28b3deceb93fd0c5dfc5bcfdfd9ee459c5b46853d176e08e99a2a8842945e6cd396e4137fac430c67abea388e83789c
-
SSDEEP
6144:WdwDpybdvNg134Gnq2YZstYaGaqjWq9441D/Kv+I:/cE134GiZ4Ya7mWq9441D/Kvj
Malware Config
Extracted
xenorat
91.92.248.167
Wolid_rat_nd8859g
-
delay
60000
-
install_path
appdata
-
port
1280
-
startup_name
cms
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6621fcab4de5fab7eac4d8d03c87f233.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 6621fcab4de5fab7eac4d8d03c87f233.exe -
Executes dropped EXE 4 IoCs
Processes:
6621fcab4de5fab7eac4d8d03c87f233.exe6621fcab4de5fab7eac4d8d03c87f233.exe6621fcab4de5fab7eac4d8d03c87f233.exe6621fcab4de5fab7eac4d8d03c87f233.exepid process 4852 6621fcab4de5fab7eac4d8d03c87f233.exe 3752 6621fcab4de5fab7eac4d8d03c87f233.exe 4004 6621fcab4de5fab7eac4d8d03c87f233.exe 2968 6621fcab4de5fab7eac4d8d03c87f233.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
6621fcab4de5fab7eac4d8d03c87f233.exe6621fcab4de5fab7eac4d8d03c87f233.exedescription pid process target process PID 924 set thread context of 3552 924 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 924 set thread context of 1512 924 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 924 set thread context of 220 924 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 4852 set thread context of 3752 4852 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 4852 set thread context of 4004 4852 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 4852 set thread context of 2968 4852 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4116 3552 WerFault.exe 6621fcab4de5fab7eac4d8d03c87f233.exe 3784 2968 WerFault.exe 6621fcab4de5fab7eac4d8d03c87f233.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
6621fcab4de5fab7eac4d8d03c87f233.exe6621fcab4de5fab7eac4d8d03c87f233.exedescription pid process Token: SeDebugPrivilege 924 6621fcab4de5fab7eac4d8d03c87f233.exe Token: SeDebugPrivilege 4852 6621fcab4de5fab7eac4d8d03c87f233.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
6621fcab4de5fab7eac4d8d03c87f233.exe6621fcab4de5fab7eac4d8d03c87f233.exe6621fcab4de5fab7eac4d8d03c87f233.exe6621fcab4de5fab7eac4d8d03c87f233.exedescription pid process target process PID 924 wrote to memory of 3552 924 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 924 wrote to memory of 3552 924 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 924 wrote to memory of 3552 924 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 924 wrote to memory of 3552 924 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 924 wrote to memory of 3552 924 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 924 wrote to memory of 3552 924 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 924 wrote to memory of 3552 924 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 924 wrote to memory of 3552 924 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 924 wrote to memory of 1512 924 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 924 wrote to memory of 1512 924 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 924 wrote to memory of 1512 924 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 924 wrote to memory of 1512 924 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 924 wrote to memory of 1512 924 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 924 wrote to memory of 1512 924 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 924 wrote to memory of 1512 924 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 924 wrote to memory of 1512 924 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 924 wrote to memory of 220 924 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 924 wrote to memory of 220 924 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 924 wrote to memory of 220 924 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 924 wrote to memory of 220 924 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 924 wrote to memory of 220 924 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 924 wrote to memory of 220 924 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 924 wrote to memory of 220 924 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 924 wrote to memory of 220 924 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 220 wrote to memory of 4852 220 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 220 wrote to memory of 4852 220 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 220 wrote to memory of 4852 220 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 4852 wrote to memory of 3752 4852 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 4852 wrote to memory of 3752 4852 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 4852 wrote to memory of 3752 4852 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 4852 wrote to memory of 3752 4852 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 4852 wrote to memory of 3752 4852 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 4852 wrote to memory of 3752 4852 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 4852 wrote to memory of 3752 4852 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 4852 wrote to memory of 3752 4852 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 4852 wrote to memory of 4004 4852 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 4852 wrote to memory of 4004 4852 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 4852 wrote to memory of 4004 4852 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 4852 wrote to memory of 4004 4852 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 4852 wrote to memory of 4004 4852 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 4852 wrote to memory of 4004 4852 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 4852 wrote to memory of 4004 4852 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 4852 wrote to memory of 4004 4852 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 4852 wrote to memory of 2968 4852 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 4852 wrote to memory of 2968 4852 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 4852 wrote to memory of 2968 4852 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 4852 wrote to memory of 2968 4852 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 4852 wrote to memory of 2968 4852 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 4852 wrote to memory of 2968 4852 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 4852 wrote to memory of 2968 4852 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 4852 wrote to memory of 2968 4852 6621fcab4de5fab7eac4d8d03c87f233.exe 6621fcab4de5fab7eac4d8d03c87f233.exe PID 1512 wrote to memory of 964 1512 6621fcab4de5fab7eac4d8d03c87f233.exe schtasks.exe PID 1512 wrote to memory of 964 1512 6621fcab4de5fab7eac4d8d03c87f233.exe schtasks.exe PID 1512 wrote to memory of 964 1512 6621fcab4de5fab7eac4d8d03c87f233.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6621fcab4de5fab7eac4d8d03c87f233.exe"C:\Users\Admin\AppData\Local\Temp\6621fcab4de5fab7eac4d8d03c87f233.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\6621fcab4de5fab7eac4d8d03c87f233.exeC:\Users\Admin\AppData\Local\Temp\6621fcab4de5fab7eac4d8d03c87f233.exe2⤵PID:3552
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 803⤵
- Program crash
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\6621fcab4de5fab7eac4d8d03c87f233.exeC:\Users\Admin\AppData\Local\Temp\6621fcab4de5fab7eac4d8d03c87f233.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "cms" /XML "C:\Users\Admin\AppData\Local\Temp\tmp431F.tmp" /F3⤵
- Scheduled Task/Job: Scheduled Task
PID:964 -
C:\Users\Admin\AppData\Local\Temp\6621fcab4de5fab7eac4d8d03c87f233.exeC:\Users\Admin\AppData\Local\Temp\6621fcab4de5fab7eac4d8d03c87f233.exe2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Roaming\XenoManager\6621fcab4de5fab7eac4d8d03c87f233.exe"C:\Users\Admin\AppData\Roaming\XenoManager\6621fcab4de5fab7eac4d8d03c87f233.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Roaming\XenoManager\6621fcab4de5fab7eac4d8d03c87f233.exeC:\Users\Admin\AppData\Roaming\XenoManager\6621fcab4de5fab7eac4d8d03c87f233.exe4⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Roaming\XenoManager\6621fcab4de5fab7eac4d8d03c87f233.exeC:\Users\Admin\AppData\Roaming\XenoManager\6621fcab4de5fab7eac4d8d03c87f233.exe4⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Roaming\XenoManager\6621fcab4de5fab7eac4d8d03c87f233.exeC:\Users\Admin\AppData\Roaming\XenoManager\6621fcab4de5fab7eac4d8d03c87f233.exe4⤵
- Executes dropped EXE
PID:2968 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 805⤵
- Program crash
PID:3784
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3552 -ip 35521⤵PID:2400
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2968 -ip 29681⤵PID:2712
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\6621fcab4de5fab7eac4d8d03c87f233.exe.logFilesize
706B
MD5d95c58e609838928f0f49837cab7dfd2
SHA155e7139a1e3899195b92ed8771d1ca2c7d53c916
SHA2560407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339
SHA512405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d
-
C:\Users\Admin\AppData\Local\Temp\tmp431F.tmpFilesize
1KB
MD59bebe31e5ff2a5eae2b0cbbdb94e5a4f
SHA1731c8074c0b0d2280be5b1ff5d2ecdbaef82c803
SHA2564a7ceb2293c43dca1314f795c40bff88871639dc9db342b63841434ad691546e
SHA51274335ddfcb6b2bba86ecfb45a99ecfc85ec0d76ada26cb795346aab45b2190072147b6d7c345621a324db1ac1205bbb21698d5e23e71902857f92a02a946e05e
-
C:\Users\Admin\AppData\Roaming\XenoManager\6621fcab4de5fab7eac4d8d03c87f233.exeFilesize
221KB
MD56621fcab4de5fab7eac4d8d03c87f233
SHA170dd77e26e803239877b30439eb123454bc137cc
SHA256ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2
SHA512d132d2399c65b6b0083f7172c04d4708b28b3deceb93fd0c5dfc5bcfdfd9ee459c5b46853d176e08e99a2a8842945e6cd396e4137fac430c67abea388e83789c
-
memory/220-16-0x0000000074A50000-0x0000000075200000-memory.dmpFilesize
7.7MB
-
memory/220-29-0x0000000074A50000-0x0000000075200000-memory.dmpFilesize
7.7MB
-
memory/924-4-0x0000000074A50000-0x0000000075200000-memory.dmpFilesize
7.7MB
-
memory/924-3-0x000000000E3A0000-0x000000000E3DA000-memory.dmpFilesize
232KB
-
memory/924-7-0x000000000E5C0000-0x000000000E652000-memory.dmpFilesize
584KB
-
memory/924-8-0x00000000052E0000-0x00000000052E6000-memory.dmpFilesize
24KB
-
memory/924-1-0x0000000000F70000-0x0000000000FAC000-memory.dmpFilesize
240KB
-
memory/924-2-0x00000000019B0000-0x00000000019B6000-memory.dmpFilesize
24KB
-
memory/924-0-0x0000000074A5E000-0x0000000074A5F000-memory.dmpFilesize
4KB
-
memory/924-15-0x0000000074A50000-0x0000000075200000-memory.dmpFilesize
7.7MB
-
memory/924-6-0x000000000EAD0000-0x000000000F074000-memory.dmpFilesize
5.6MB
-
memory/924-5-0x000000000E480000-0x000000000E51C000-memory.dmpFilesize
624KB
-
memory/1512-17-0x0000000074A50000-0x0000000075200000-memory.dmpFilesize
7.7MB
-
memory/1512-13-0x0000000074A50000-0x0000000075200000-memory.dmpFilesize
7.7MB
-
memory/1512-38-0x0000000074A50000-0x0000000075200000-memory.dmpFilesize
7.7MB
-
memory/1512-10-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4852-30-0x0000000074A50000-0x0000000075200000-memory.dmpFilesize
7.7MB
-
memory/4852-37-0x0000000074A50000-0x0000000075200000-memory.dmpFilesize
7.7MB