Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
04-07-2024 16:56
Static task
static1
Behavioral task
behavioral1
Sample
697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
Resource
win7-20240220-en
General
-
Target
697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
-
Size
236KB
-
MD5
5f86d94893b47e542cf857749dfcd185
-
SHA1
7816d9af40a9e9265708df00af8137db67d8c7aa
-
SHA256
697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab
-
SHA512
8cf9bb6ba985843d57f2a013e40d3243b89e5aa0af07d504e9bcc7a2b577028a9cf24258bab14e256b7cb11f75a9a5993eff920879ab11f24c926bce85fb4c7d
-
SSDEEP
6144:wA0gX+3bpKthw8rZg+mr08M0O5wkoYfMJRNeUqNI:wA0gXgpKNknMX57ocMJRNeUq2
Malware Config
Extracted
xenorat
91.92.248.167
Wolid_rat_nd8859g
-
delay
60000
-
install_path
appdata
-
port
1280
-
startup_name
cms
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exepid process 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 2372 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 2504 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 2452 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe -
Loads dropped DLL 4 IoCs
Processes:
697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exepid process 2104 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exedescription pid process target process PID 2360 set thread context of 2104 2360 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2360 set thread context of 3004 2360 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2360 set thread context of 2560 2360 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2588 set thread context of 2372 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2588 set thread context of 2504 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2588 set thread context of 2452 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exedescription pid process Token: SeDebugPrivilege 2360 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe Token: SeDebugPrivilege 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe -
Suspicious use of WriteProcessMemory 62 IoCs
Processes:
697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exedescription pid process target process PID 2360 wrote to memory of 2104 2360 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2360 wrote to memory of 2104 2360 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2360 wrote to memory of 2104 2360 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2360 wrote to memory of 2104 2360 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2360 wrote to memory of 2104 2360 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2360 wrote to memory of 2104 2360 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2360 wrote to memory of 2104 2360 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2360 wrote to memory of 2104 2360 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2360 wrote to memory of 2104 2360 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2360 wrote to memory of 3004 2360 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2360 wrote to memory of 3004 2360 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2360 wrote to memory of 3004 2360 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2360 wrote to memory of 3004 2360 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2360 wrote to memory of 3004 2360 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2360 wrote to memory of 3004 2360 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2360 wrote to memory of 3004 2360 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2360 wrote to memory of 3004 2360 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2360 wrote to memory of 3004 2360 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2360 wrote to memory of 2560 2360 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2360 wrote to memory of 2560 2360 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2360 wrote to memory of 2560 2360 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2360 wrote to memory of 2560 2360 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2360 wrote to memory of 2560 2360 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2360 wrote to memory of 2560 2360 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2360 wrote to memory of 2560 2360 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2360 wrote to memory of 2560 2360 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2360 wrote to memory of 2560 2360 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2104 wrote to memory of 2588 2104 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2104 wrote to memory of 2588 2104 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2104 wrote to memory of 2588 2104 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2104 wrote to memory of 2588 2104 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2588 wrote to memory of 2372 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2588 wrote to memory of 2372 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2588 wrote to memory of 2372 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2588 wrote to memory of 2372 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2588 wrote to memory of 2372 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2588 wrote to memory of 2372 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2588 wrote to memory of 2372 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2588 wrote to memory of 2372 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2588 wrote to memory of 2372 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2588 wrote to memory of 2504 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2588 wrote to memory of 2504 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2588 wrote to memory of 2504 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2588 wrote to memory of 2504 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2588 wrote to memory of 2504 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2588 wrote to memory of 2504 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2588 wrote to memory of 2504 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2588 wrote to memory of 2504 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2588 wrote to memory of 2504 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2588 wrote to memory of 2452 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2588 wrote to memory of 2452 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2588 wrote to memory of 2452 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2588 wrote to memory of 2452 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2588 wrote to memory of 2452 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2588 wrote to memory of 2452 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2588 wrote to memory of 2452 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2588 wrote to memory of 2452 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 2588 wrote to memory of 2452 2588 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe PID 3004 wrote to memory of 2432 3004 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe schtasks.exe PID 3004 wrote to memory of 2432 3004 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe schtasks.exe PID 3004 wrote to memory of 2432 3004 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe schtasks.exe PID 3004 wrote to memory of 2432 3004 697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe"C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exeC:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe"C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exeC:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe4⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exeC:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe4⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exeC:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe4⤵
- Executes dropped EXE
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exeC:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe2⤵
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "cms" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF75A.tmp" /F3⤵
- Scheduled Task/Job: Scheduled Task
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exeC:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe2⤵PID:2560
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpF75A.tmpFilesize
1KB
MD53d5fb318f0c4c844c417b4dd9ec02498
SHA1b83b629d7a8f7a016e30cb3a9eb1b76de34bc78b
SHA256981169aaa6f00dccdf0822989180d3bb96c6b45fa9b6a819935da76c24dd795e
SHA5126c141efe1857b1d2ba74ea10fd766166161815d869b5217f79799c650ec2b87f44f36f278b9d1a3f4a754243c5ac4a3abe1aabd74fd3c61903db20403e915806
-
\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exeFilesize
236KB
MD55f86d94893b47e542cf857749dfcd185
SHA17816d9af40a9e9265708df00af8137db67d8c7aa
SHA256697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab
SHA5128cf9bb6ba985843d57f2a013e40d3243b89e5aa0af07d504e9bcc7a2b577028a9cf24258bab14e256b7cb11f75a9a5993eff920879ab11f24c926bce85fb4c7d
-
memory/2104-6-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2104-28-0x0000000074550000-0x0000000074C3E000-memory.dmpFilesize
6.9MB
-
memory/2104-19-0x0000000074550000-0x0000000074C3E000-memory.dmpFilesize
6.9MB
-
memory/2104-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2104-9-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2360-4-0x00000000003C0000-0x00000000003FE000-memory.dmpFilesize
248KB
-
memory/2360-5-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/2360-0-0x000000007455E000-0x000000007455F000-memory.dmpFilesize
4KB
-
memory/2360-3-0x0000000074550000-0x0000000074C3E000-memory.dmpFilesize
6.9MB
-
memory/2360-2-0x00000000002B0000-0x00000000002B6000-memory.dmpFilesize
24KB
-
memory/2360-24-0x0000000074550000-0x0000000074C3E000-memory.dmpFilesize
6.9MB
-
memory/2360-1-0x0000000000A40000-0x0000000000A80000-memory.dmpFilesize
256KB
-
memory/2588-29-0x0000000000B60000-0x0000000000BA0000-memory.dmpFilesize
256KB
-
memory/3004-25-0x0000000074550000-0x0000000074C3E000-memory.dmpFilesize
6.9MB
-
memory/3004-45-0x0000000074550000-0x0000000074C3E000-memory.dmpFilesize
6.9MB
-
memory/3004-48-0x0000000074550000-0x0000000074C3E000-memory.dmpFilesize
6.9MB
-
memory/3004-49-0x0000000074550000-0x0000000074C3E000-memory.dmpFilesize
6.9MB