Analysis
-
max time kernel
61s -
max time network
63s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
07-07-2024 18:10
Behavioral task
behavioral1
Sample
SolaraBoostrapper.exe
Resource
win7-20240705-en
windows7-x64
General
-
Target
SolaraBoostrapper.exe
-
Size
46KB
-
MD5
b70eccec2079ce0b1ef1a1701349f387
-
SHA1
0f7a61968c427a8cd78ff161c908a2e8f4ae6138
-
SHA256
6491cb2ff9451e79f5ba5a621165c68b12ed8a170dcbbcec1c5b188986f04e27
-
SHA512
cc9d137e587498fdb96437dc0d919e6bb1c0131e594d99dcafb063a28bc40cca9958a99b45f4f62bb7b6b20049ec25ba747e59f9816ccd2d643ccfdc04255c6a
-
SSDEEP
768:0dhO/poiiUcjlJInwHqH9Xqk5nWEZ5SbTDaSWI7CPW5j:Ow+jjgnHH9XqcnW85SbTTWIb
Malware Config
Extracted
xenorat
192.168.56.1
Xeno_rat_nd8912d
-
delay
5000
-
install_path
appdata
-
port
4444
-
startup_name
Windows Defender
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3642458265-1901903390-453309326-1000\Control Panel\International\Geo\Nation SolaraBoostrapper.exe -
Executes dropped EXE 1 IoCs
pid Process 852 SolaraBoostrapper.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1028 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 49 IoCs
pid Process 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3372 taskmgr.exe Token: SeSystemProfilePrivilege 3372 taskmgr.exe Token: SeCreateGlobalPrivilege 3372 taskmgr.exe -
Suspicious use of FindShellTrayWindow 61 IoCs
pid Process 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe -
Suspicious use of SendNotifyMessage 27 IoCs
pid Process 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe 3372 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1444 wrote to memory of 852 1444 SolaraBoostrapper.exe 86 PID 1444 wrote to memory of 852 1444 SolaraBoostrapper.exe 86 PID 1444 wrote to memory of 852 1444 SolaraBoostrapper.exe 86 PID 852 wrote to memory of 1028 852 SolaraBoostrapper.exe 88 PID 852 wrote to memory of 1028 852 SolaraBoostrapper.exe 88 PID 852 wrote to memory of 1028 852 SolaraBoostrapper.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\SolaraBoostrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBoostrapper.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Roaming\XenoManager\SolaraBoostrapper.exe"C:\Users\Admin\AppData\Roaming\XenoManager\SolaraBoostrapper.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "Windows Defender" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAF5A.tmp" /F3⤵
- Scheduled Task/Job: Scheduled Task
PID:1028
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3372
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b393c4330be8f2e9206beb22c39863eb
SHA1da2d1dcba1e0c63f68036f76c7d5285e7e97ce0b
SHA256982d0409fdc9b775d3b4896da91d1791d8dcea1e79b5c0c884dbe3c7e81df833
SHA512ef5acee3debf9f88a9b86b2834a0848e6ab60ec75e7c14a0242bdaf3aeb5278ddf9d089fc52c55451382d3c7c4369e4e5f0e653f8be230e9c0b9bea616d816be
-
Filesize
46KB
MD5b70eccec2079ce0b1ef1a1701349f387
SHA10f7a61968c427a8cd78ff161c908a2e8f4ae6138
SHA2566491cb2ff9451e79f5ba5a621165c68b12ed8a170dcbbcec1c5b188986f04e27
SHA512cc9d137e587498fdb96437dc0d919e6bb1c0131e594d99dcafb063a28bc40cca9958a99b45f4f62bb7b6b20049ec25ba747e59f9816ccd2d643ccfdc04255c6a