Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
09-07-2024 14:55
General
-
Target
sdfnie.exe
-
Size
45KB
-
MD5
29dbc7b31dbf7dcb4289d07be9da47f2
-
SHA1
03ab7ceda224b198edafb070140b6421df8c37d3
-
SHA256
215751b1b39deb885cefda6cdb03691226177a692e3404193c6ea8ecd3ea98f1
-
SHA512
026ad8ad03619ad34b3f6796889581ec7d24387a1f1d2d671ad0106fd942ae8d6a3cdf34e3d374ccfa3aa3289d4467975c7e386483bba95a18f9ebaf1a7836d0
-
SSDEEP
768:9dhO/poiiUcjlJInwwH9Xqk5nWEZ5SbTDaUWI7CPW59:zw+jjgnZH9XqcnW85SbTNWI1
Malware Config
Extracted
Family
xenorat
C2
147.185.221.19
Mutex
Wiiindowss Deffender
Attributes
-
delay
5000
-
install_path
appdata
-
port
33365
-
startup_name
Windows Defender
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation sdfnie.exe -
Executes dropped EXE 1 IoCs
pid Process 3572 sdfnie.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Local Settings taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3352 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 3572 sdfnie.exe 3572 sdfnie.exe 3572 sdfnie.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5032 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3572 sdfnie.exe Token: SeDebugPrivilege 5032 taskmgr.exe Token: SeSystemProfilePrivilege 5032 taskmgr.exe Token: SeCreateGlobalPrivilege 5032 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3572 sdfnie.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2464 wrote to memory of 3572 2464 sdfnie.exe 92 PID 2464 wrote to memory of 3572 2464 sdfnie.exe 92 PID 2464 wrote to memory of 3572 2464 sdfnie.exe 92 PID 3572 wrote to memory of 3352 3572 sdfnie.exe 95 PID 3572 wrote to memory of 3352 3572 sdfnie.exe 95 PID 3572 wrote to memory of 3352 3572 sdfnie.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\sdfnie.exe"C:\Users\Admin\AppData\Local\Temp\sdfnie.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Roaming\XenoManager\sdfnie.exe"C:\Users\Admin\AppData\Roaming\XenoManager\sdfnie.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "Windows Defender" /XML "C:\Users\Admin\AppData\Local\Temp\tmp555E.tmp" /F3⤵
- Scheduled Task/Job: Scheduled Task
PID:3352
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4168,i,8550138573348074061,7308779696487990535,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:81⤵PID:1072
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5032
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1948
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD592cfe8b53667361fbb9615d666904907
SHA100ba83429e09d280c1d07b9bb2c99863bae626c8
SHA256621efe393a771413dcc62950e565a17090be41e4b2139ceb034173df8fd62cbb
SHA512f6cdb185eb694c060199587b1fcb00b94589b6048007f7a70dafad2d59d876fee781d11706c135d7a2cd16969c00f8e0e8e9b7e7d7b13e3a495cff8d3996b835
-
Filesize
45KB
MD529dbc7b31dbf7dcb4289d07be9da47f2
SHA103ab7ceda224b198edafb070140b6421df8c37d3
SHA256215751b1b39deb885cefda6cdb03691226177a692e3404193c6ea8ecd3ea98f1
SHA512026ad8ad03619ad34b3f6796889581ec7d24387a1f1d2d671ad0106fd942ae8d6a3cdf34e3d374ccfa3aa3289d4467975c7e386483bba95a18f9ebaf1a7836d0