Analysis
-
max time kernel
143s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-07-2024 16:59
Static task
static1
Behavioral task
behavioral1
Sample
792c34fea9fdbebd00ccb3e2c82bd3a5.exe
Resource
win7-20240221-en
General
-
Target
792c34fea9fdbebd00ccb3e2c82bd3a5.exe
-
Size
221KB
-
MD5
792c34fea9fdbebd00ccb3e2c82bd3a5
-
SHA1
d50a4769a2fca48504e9535a598f1e812d003c2f
-
SHA256
dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a
-
SHA512
f68beb38b7c68432211531d7a6f95626f388089098c878aee956def1e6de96744fa6459064ebd04df01316092cc018ad8321691cdc57265da889f030bf77e606
-
SSDEEP
3072:chp584YL4TWFxVvaZAUOQDMwutBq17PTPlw92Vr5/6PSr2k5fsPI:chMmSFxhaZQsmBq1bTPlwq/Vr2k5fAI
Malware Config
Extracted
xenorat
91.92.248.167
Wolid_rat_nd8859g
-
delay
60000
-
install_path
appdata
-
port
1280
-
startup_name
cms
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
792c34fea9fdbebd00ccb3e2c82bd3a5.exe792c34fea9fdbebd00ccb3e2c82bd3a5.exe792c34fea9fdbebd00ccb3e2c82bd3a5.exe792c34fea9fdbebd00ccb3e2c82bd3a5.exepid process 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 2416 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 2796 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 2880 792c34fea9fdbebd00ccb3e2c82bd3a5.exe -
Loads dropped DLL 4 IoCs
Processes:
792c34fea9fdbebd00ccb3e2c82bd3a5.exe792c34fea9fdbebd00ccb3e2c82bd3a5.exepid process 2508 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
792c34fea9fdbebd00ccb3e2c82bd3a5.exe792c34fea9fdbebd00ccb3e2c82bd3a5.exedescription pid process target process PID 1912 set thread context of 2508 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 1912 set thread context of 2472 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 1912 set thread context of 2600 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2500 set thread context of 2416 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2500 set thread context of 2796 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2500 set thread context of 2880 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
792c34fea9fdbebd00ccb3e2c82bd3a5.exe792c34fea9fdbebd00ccb3e2c82bd3a5.exedescription pid process Token: SeDebugPrivilege 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe Token: SeDebugPrivilege 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe -
Suspicious use of WriteProcessMemory 62 IoCs
Processes:
792c34fea9fdbebd00ccb3e2c82bd3a5.exe792c34fea9fdbebd00ccb3e2c82bd3a5.exe792c34fea9fdbebd00ccb3e2c82bd3a5.exe792c34fea9fdbebd00ccb3e2c82bd3a5.exedescription pid process target process PID 1912 wrote to memory of 2508 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 1912 wrote to memory of 2508 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 1912 wrote to memory of 2508 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 1912 wrote to memory of 2508 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 1912 wrote to memory of 2508 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 1912 wrote to memory of 2508 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 1912 wrote to memory of 2508 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 1912 wrote to memory of 2508 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 1912 wrote to memory of 2508 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 1912 wrote to memory of 2472 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 1912 wrote to memory of 2472 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 1912 wrote to memory of 2472 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 1912 wrote to memory of 2472 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 1912 wrote to memory of 2472 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 1912 wrote to memory of 2472 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 1912 wrote to memory of 2472 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 1912 wrote to memory of 2472 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 1912 wrote to memory of 2472 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 1912 wrote to memory of 2600 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 1912 wrote to memory of 2600 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 1912 wrote to memory of 2600 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 1912 wrote to memory of 2600 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 1912 wrote to memory of 2600 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 1912 wrote to memory of 2600 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 1912 wrote to memory of 2600 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 1912 wrote to memory of 2600 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 1912 wrote to memory of 2600 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2508 wrote to memory of 2500 2508 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2508 wrote to memory of 2500 2508 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2508 wrote to memory of 2500 2508 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2508 wrote to memory of 2500 2508 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2500 wrote to memory of 2416 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2500 wrote to memory of 2416 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2500 wrote to memory of 2416 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2500 wrote to memory of 2416 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2500 wrote to memory of 2416 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2500 wrote to memory of 2416 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2500 wrote to memory of 2416 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2500 wrote to memory of 2416 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2500 wrote to memory of 2416 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2500 wrote to memory of 2796 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2500 wrote to memory of 2796 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2500 wrote to memory of 2796 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2500 wrote to memory of 2796 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2500 wrote to memory of 2796 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2500 wrote to memory of 2796 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2500 wrote to memory of 2796 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2500 wrote to memory of 2796 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2500 wrote to memory of 2796 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2500 wrote to memory of 2880 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2500 wrote to memory of 2880 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2500 wrote to memory of 2880 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2500 wrote to memory of 2880 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2500 wrote to memory of 2880 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2500 wrote to memory of 2880 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2500 wrote to memory of 2880 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2500 wrote to memory of 2880 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2500 wrote to memory of 2880 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 792c34fea9fdbebd00ccb3e2c82bd3a5.exe PID 2472 wrote to memory of 1204 2472 792c34fea9fdbebd00ccb3e2c82bd3a5.exe schtasks.exe PID 2472 wrote to memory of 1204 2472 792c34fea9fdbebd00ccb3e2c82bd3a5.exe schtasks.exe PID 2472 wrote to memory of 1204 2472 792c34fea9fdbebd00ccb3e2c82bd3a5.exe schtasks.exe PID 2472 wrote to memory of 1204 2472 792c34fea9fdbebd00ccb3e2c82bd3a5.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\792c34fea9fdbebd00ccb3e2c82bd3a5.exe"C:\Users\Admin\AppData\Local\Temp\792c34fea9fdbebd00ccb3e2c82bd3a5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\792c34fea9fdbebd00ccb3e2c82bd3a5.exeC:\Users\Admin\AppData\Local\Temp\792c34fea9fdbebd00ccb3e2c82bd3a5.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Roaming\XenoManager\792c34fea9fdbebd00ccb3e2c82bd3a5.exe"C:\Users\Admin\AppData\Roaming\XenoManager\792c34fea9fdbebd00ccb3e2c82bd3a5.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Roaming\XenoManager\792c34fea9fdbebd00ccb3e2c82bd3a5.exeC:\Users\Admin\AppData\Roaming\XenoManager\792c34fea9fdbebd00ccb3e2c82bd3a5.exe4⤵
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Roaming\XenoManager\792c34fea9fdbebd00ccb3e2c82bd3a5.exeC:\Users\Admin\AppData\Roaming\XenoManager\792c34fea9fdbebd00ccb3e2c82bd3a5.exe4⤵
- Executes dropped EXE
PID:2796 -
C:\Users\Admin\AppData\Roaming\XenoManager\792c34fea9fdbebd00ccb3e2c82bd3a5.exeC:\Users\Admin\AppData\Roaming\XenoManager\792c34fea9fdbebd00ccb3e2c82bd3a5.exe4⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\792c34fea9fdbebd00ccb3e2c82bd3a5.exeC:\Users\Admin\AppData\Local\Temp\792c34fea9fdbebd00ccb3e2c82bd3a5.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "cms" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF8A1.tmp" /F3⤵
- Scheduled Task/Job: Scheduled Task
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\792c34fea9fdbebd00ccb3e2c82bd3a5.exeC:\Users\Admin\AppData\Local\Temp\792c34fea9fdbebd00ccb3e2c82bd3a5.exe2⤵PID:2600
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpF8A1.tmpFilesize
1KB
MD54e5246e7abef1fefc0f54218c98badf2
SHA16fc50eec3f46acb1f2129d27e8b006463cad2e44
SHA2562234cdda018017ab71809b5acc4c6a75b1a086552566ec742ae46461a42dace3
SHA51279fc972aee63493401fd0419e642684a6b82cf931b42c93e77c231f7b6cd91e00c457b7f52d5cce40bfd4389fa16b8ec9a87555e449a84330d8fa6a6e07b23cb
-
C:\Users\Admin\AppData\Roaming\XenoManager\792c34fea9fdbebd00ccb3e2c82bd3a5.exeFilesize
221KB
MD5792c34fea9fdbebd00ccb3e2c82bd3a5
SHA1d50a4769a2fca48504e9535a598f1e812d003c2f
SHA256dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a
SHA512f68beb38b7c68432211531d7a6f95626f388089098c878aee956def1e6de96744fa6459064ebd04df01316092cc018ad8321691cdc57265da889f030bf77e606
-
memory/1912-4-0x0000000074790000-0x0000000074E7E000-memory.dmpFilesize
6.9MB
-
memory/1912-30-0x0000000074790000-0x0000000074E7E000-memory.dmpFilesize
6.9MB
-
memory/1912-0-0x000000007479E000-0x000000007479F000-memory.dmpFilesize
4KB
-
memory/1912-5-0x0000000000360000-0x0000000000366000-memory.dmpFilesize
24KB
-
memory/1912-1-0x0000000001190000-0x00000000011CC000-memory.dmpFilesize
240KB
-
memory/1912-3-0x00000000004B0000-0x00000000004EA000-memory.dmpFilesize
232KB
-
memory/1912-2-0x0000000000330000-0x0000000000336000-memory.dmpFilesize
24KB
-
memory/2472-49-0x0000000074790000-0x0000000074E7E000-memory.dmpFilesize
6.9MB
-
memory/2472-24-0x0000000074790000-0x0000000074E7E000-memory.dmpFilesize
6.9MB
-
memory/2472-52-0x0000000074790000-0x0000000074E7E000-memory.dmpFilesize
6.9MB
-
memory/2472-53-0x0000000074790000-0x0000000074E7E000-memory.dmpFilesize
6.9MB
-
memory/2500-33-0x00000000000F0000-0x000000000012C000-memory.dmpFilesize
240KB
-
memory/2508-18-0x0000000074790000-0x0000000074E7E000-memory.dmpFilesize
6.9MB
-
memory/2508-8-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2508-32-0x0000000074790000-0x0000000074E7E000-memory.dmpFilesize
6.9MB
-
memory/2508-12-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2508-6-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB