Analysis
-
max time kernel
77s -
max time network
78s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
07/07/2024, 18:10
Behavioral task
behavioral1
Sample
SolaraBoostrapper.exe
Resource
win7-20240705-en
windows7-x64
11 signatures
150 seconds
General
-
Target
SolaraBoostrapper.exe
-
Size
46KB
-
MD5
b70eccec2079ce0b1ef1a1701349f387
-
SHA1
0f7a61968c427a8cd78ff161c908a2e8f4ae6138
-
SHA256
6491cb2ff9451e79f5ba5a621165c68b12ed8a170dcbbcec1c5b188986f04e27
-
SHA512
cc9d137e587498fdb96437dc0d919e6bb1c0131e594d99dcafb063a28bc40cca9958a99b45f4f62bb7b6b20049ec25ba747e59f9816ccd2d643ccfdc04255c6a
-
SSDEEP
768:0dhO/poiiUcjlJInwHqH9Xqk5nWEZ5SbTDaSWI7CPW5j:Ow+jjgnHH9XqcnW85SbTTWIb
Malware Config
Extracted
Family
xenorat
C2
192.168.56.1
Mutex
Xeno_rat_nd8912d
Attributes
-
delay
5000
-
install_path
appdata
-
port
4444
-
startup_name
Windows Defender
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2400 SolaraBoostrapper.exe -
Loads dropped DLL 1 IoCs
pid Process 1460 SolaraBoostrapper.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2716 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2728 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2728 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1460 wrote to memory of 2400 1460 SolaraBoostrapper.exe 30 PID 1460 wrote to memory of 2400 1460 SolaraBoostrapper.exe 30 PID 1460 wrote to memory of 2400 1460 SolaraBoostrapper.exe 30 PID 1460 wrote to memory of 2400 1460 SolaraBoostrapper.exe 30 PID 2400 wrote to memory of 2716 2400 SolaraBoostrapper.exe 31 PID 2400 wrote to memory of 2716 2400 SolaraBoostrapper.exe 31 PID 2400 wrote to memory of 2716 2400 SolaraBoostrapper.exe 31 PID 2400 wrote to memory of 2716 2400 SolaraBoostrapper.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\SolaraBoostrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBoostrapper.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Roaming\XenoManager\SolaraBoostrapper.exe"C:\Users\Admin\AppData\Roaming\XenoManager\SolaraBoostrapper.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "Windows Defender" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBD18.tmp" /F3⤵
- Scheduled Task/Job: Scheduled Task
PID:2716
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2728
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b393c4330be8f2e9206beb22c39863eb
SHA1da2d1dcba1e0c63f68036f76c7d5285e7e97ce0b
SHA256982d0409fdc9b775d3b4896da91d1791d8dcea1e79b5c0c884dbe3c7e81df833
SHA512ef5acee3debf9f88a9b86b2834a0848e6ab60ec75e7c14a0242bdaf3aeb5278ddf9d089fc52c55451382d3c7c4369e4e5f0e653f8be230e9c0b9bea616d816be
-
Filesize
46KB
MD5b70eccec2079ce0b1ef1a1701349f387
SHA10f7a61968c427a8cd78ff161c908a2e8f4ae6138
SHA2566491cb2ff9451e79f5ba5a621165c68b12ed8a170dcbbcec1c5b188986f04e27
SHA512cc9d137e587498fdb96437dc0d919e6bb1c0131e594d99dcafb063a28bc40cca9958a99b45f4f62bb7b6b20049ec25ba747e59f9816ccd2d643ccfdc04255c6a