Analysis
-
max time kernel
132s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
09-07-2024 14:38
Behavioral task
behavioral1
Sample
56b6c2ebd23727dd8d58648db3114ef88dd1561dd8e92f082b9ad3874cc1d93e.exe
Resource
win7-20240705-en
General
-
Target
56b6c2ebd23727dd8d58648db3114ef88dd1561dd8e92f082b9ad3874cc1d93e.exe
-
Size
45KB
-
MD5
c256e2fb6c6111d1bbaa46bd2f081be2
-
SHA1
fdbc207fd0dc681e13e68effd8fa9a372bea9052
-
SHA256
56b6c2ebd23727dd8d58648db3114ef88dd1561dd8e92f082b9ad3874cc1d93e
-
SHA512
0ccde1e1c13c764d184b097218282c4b9dfde70c1bb2b1be737f01b46e1f4a824850531f8ab2e9ba99837c9b552f4fbfc53cdda03c09f82dc3c19ee3e321eca9
-
SSDEEP
768:9dhO/poiiUcjlJInlaH9Xqk5nWEZ5SbTDabuI7CPW59:zw+jjgnsH9XqcnW85SbTmuI1
Malware Config
Extracted
xenorat
192.168.100.200
Wiiindowss Deffender
-
delay
5000
-
install_path
appdata
-
port
8848
-
startup_name
Windows Defender
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2748 56b6c2ebd23727dd8d58648db3114ef88dd1561dd8e92f082b9ad3874cc1d93e.exe -
Loads dropped DLL 1 IoCs
pid Process 2692 56b6c2ebd23727dd8d58648db3114ef88dd1561dd8e92f082b9ad3874cc1d93e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2876 schtasks.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2748 2692 56b6c2ebd23727dd8d58648db3114ef88dd1561dd8e92f082b9ad3874cc1d93e.exe 30 PID 2692 wrote to memory of 2748 2692 56b6c2ebd23727dd8d58648db3114ef88dd1561dd8e92f082b9ad3874cc1d93e.exe 30 PID 2692 wrote to memory of 2748 2692 56b6c2ebd23727dd8d58648db3114ef88dd1561dd8e92f082b9ad3874cc1d93e.exe 30 PID 2692 wrote to memory of 2748 2692 56b6c2ebd23727dd8d58648db3114ef88dd1561dd8e92f082b9ad3874cc1d93e.exe 30 PID 2748 wrote to memory of 2876 2748 56b6c2ebd23727dd8d58648db3114ef88dd1561dd8e92f082b9ad3874cc1d93e.exe 31 PID 2748 wrote to memory of 2876 2748 56b6c2ebd23727dd8d58648db3114ef88dd1561dd8e92f082b9ad3874cc1d93e.exe 31 PID 2748 wrote to memory of 2876 2748 56b6c2ebd23727dd8d58648db3114ef88dd1561dd8e92f082b9ad3874cc1d93e.exe 31 PID 2748 wrote to memory of 2876 2748 56b6c2ebd23727dd8d58648db3114ef88dd1561dd8e92f082b9ad3874cc1d93e.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\56b6c2ebd23727dd8d58648db3114ef88dd1561dd8e92f082b9ad3874cc1d93e.exe"C:\Users\Admin\AppData\Local\Temp\56b6c2ebd23727dd8d58648db3114ef88dd1561dd8e92f082b9ad3874cc1d93e.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Roaming\XenoManager\56b6c2ebd23727dd8d58648db3114ef88dd1561dd8e92f082b9ad3874cc1d93e.exe"C:\Users\Admin\AppData\Roaming\XenoManager\56b6c2ebd23727dd8d58648db3114ef88dd1561dd8e92f082b9ad3874cc1d93e.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "Windows Defender" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3A14.tmp" /F3⤵
- Scheduled Task/Job: Scheduled Task
PID:2876
-
-
Network
- No results found
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD518fddb1f976ba171f5e23f68a1681dd6
SHA1ceb98f0bdfa77690b0d5ae9aa3db0fb88eac076f
SHA256cb78b9b10a4a349fc5069336188819d0d1424893f57425f607b8102450aa8c4d
SHA51235130bd5fabf0436efd21423c4d41bb938180baf1a8f9658be1243baa5c78166b14234006306e841e26d7acb54b2d4cc881876cca2e9599d30ae58b5de38af1b
-
\Users\Admin\AppData\Roaming\XenoManager\56b6c2ebd23727dd8d58648db3114ef88dd1561dd8e92f082b9ad3874cc1d93e.exe
Filesize45KB
MD5c256e2fb6c6111d1bbaa46bd2f081be2
SHA1fdbc207fd0dc681e13e68effd8fa9a372bea9052
SHA25656b6c2ebd23727dd8d58648db3114ef88dd1561dd8e92f082b9ad3874cc1d93e
SHA5120ccde1e1c13c764d184b097218282c4b9dfde70c1bb2b1be737f01b46e1f4a824850531f8ab2e9ba99837c9b552f4fbfc53cdda03c09f82dc3c19ee3e321eca9