Overview

overview

10

Static

static

10

Pornosy z ...em.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    93s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-07-2024 14:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Pornosy z matejkiem.exe

  • Size

    45KB

  • MD5

    29dbc7b31dbf7dcb4289d07be9da47f2

  • SHA1

    03ab7ceda224b198edafb070140b6421df8c37d3

  • SHA256

    215751b1b39deb885cefda6cdb03691226177a692e3404193c6ea8ecd3ea98f1

  • SHA512

    026ad8ad03619ad34b3f6796889581ec7d24387a1f1d2d671ad0106fd942ae8d6a3cdf34e3d374ccfa3aa3289d4467975c7e386483bba95a18f9ebaf1a7836d0

  • SSDEEP

    768:9dhO/poiiUcjlJInwwH9Xqk5nWEZ5SbTDaUWI7CPW59:zw+jjgnZH9XqcnW85SbTNWI1

Score
10/10
xenoratrattrojan

Malware Config

Extracted

Family

xenorat

C2

147.185.221.19

Mutex

Wiiindowss Deffender

Attributes
  • delay

    5000

  • install_path

    appdata

  • port

    33365

  • startup_name

    Windows Defender

Signatures

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Pornosy z matejkiem.exe
    "C:\Users\Admin\AppData\Local\Temp\Pornosy z matejkiem.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2356
    • C:\Users\Admin\AppData\Roaming\XenoManager\Pornosy z matejkiem.exe
      "C:\Users\Admin\AppData\Roaming\XenoManager\Pornosy z matejkiem.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3988
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks.exe" /Create /TN "Windows Defender" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBD16.tmp" /F
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4104
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks.exe" /query /v /fo csv
        3⤵
          PID:1180
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks.exe" /delete /tn "\Windows Defender" /f
          3⤵
            PID:1608
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\XenoManager\Pornosy z matejkiem.exe"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2564
            • C:\Windows\SysWOW64\choice.exe
              choice /C Y /N /D Y /T 3
              4⤵
                PID:3076

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Pornosy z matejkiem.exe.log
          Filesize

          226B

          MD5

          916851e072fbabc4796d8916c5131092

          SHA1

          d48a602229a690c512d5fdaf4c8d77547a88e7a2

          SHA256

          7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

          SHA512

          07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\tmpBD16.tmp
          Filesize

          1KB

          MD5

          1245b94f259c52066a8c537a88643660

          SHA1

          8b9c39dac7427499ca4ef6dbd79db9a0e350c1cb

          SHA256

          e9254da4f4435aad4d58bfd26e081c0d1df28c82d17b479d06159baee7cedf8c

          SHA512

          3b4e3fa49917b5b30d62fd85dcce543de2c1a69653fb05bbc65979f0afd6bfa8bf0524c666d104f56612c502f3efb1eec895d4ba0f4686f6d7546793d43f9af0

          Download Submit

        • C:\Users\Admin\AppData\Roaming\XenoManager\Pornosy z matejkiem.exe
          Filesize

          45KB

          MD5

          29dbc7b31dbf7dcb4289d07be9da47f2

          SHA1

          03ab7ceda224b198edafb070140b6421df8c37d3

          SHA256

          215751b1b39deb885cefda6cdb03691226177a692e3404193c6ea8ecd3ea98f1

          SHA512

          026ad8ad03619ad34b3f6796889581ec7d24387a1f1d2d671ad0106fd942ae8d6a3cdf34e3d374ccfa3aa3289d4467975c7e386483bba95a18f9ebaf1a7836d0

          Download Submit

        • memory/2356-0-0x0000000074C3E000-0x0000000074C3F000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2356-1-0x0000000000500000-0x0000000000512000-memory.dmp

          Filesize

          72KB

          Download

        • memory/3988-15-0x0000000074C30000-0x00000000753E0000-memory.dmp

          Filesize

          7.7MB

          Download

        • memory/3988-18-0x0000000006020000-0x0000000006086000-memory.dmp

          Filesize

          408KB

          Download

        • memory/3988-19-0x0000000074C30000-0x00000000753E0000-memory.dmp

          Filesize

          7.7MB

          Download

        • memory/3988-20-0x0000000074C30000-0x00000000753E0000-memory.dmp

          Filesize

          7.7MB

          Download

        • memory/3988-21-0x0000000074C30000-0x00000000753E0000-memory.dmp

          Filesize

          7.7MB

          Download