Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
12-07-2024 13:15
General
-
Target
rat.exe
-
Size
45KB
-
MD5
652e746bd24f89a2d08fd6cdddff1e66
-
SHA1
9762ff799ada4f1a4c2da27d2e403db63dd86ba3
-
SHA256
c5f773352e72b43cd0a77de21f84d757724c38614080803cfb573f7d61295afa
-
SHA512
c08a43333c718e02664e3e46ca9d792138c5b6a9ed549ecf1b8779157c480c178b0b129c8f9d7526eaaf5ba06678547efe5a19a0052ea57ed67fc39337afe79a
-
SSDEEP
768:iWdhO/poiiUcjlJInEeH9Xqk5nWEZ5SbTDaNWI7CPW5I:pw+jjgnDH9XqcnW85SbTsWIA
Malware Config
Extracted
Family
xenorat
C2
127.0.0.1
Mutex
opengl
Attributes
-
delay
5000
-
install_path
nothingset
-
port
4444
-
startup_name
nothingset
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1676 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3112 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3112 taskmgr.exe Token: SeSystemProfilePrivilege 3112 taskmgr.exe Token: SeCreateGlobalPrivilege 3112 taskmgr.exe Token: 33 3112 taskmgr.exe Token: SeIncBasePriorityPrivilege 3112 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe 3112 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3292 wrote to memory of 1676 3292 rat.exe 91 PID 3292 wrote to memory of 1676 3292 rat.exe 91 PID 3292 wrote to memory of 1676 3292 rat.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\rat.exe"C:\Users\Admin\AppData\Local\Temp\rat.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "XenoUpdateManager" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCAB2.tmp" /F2⤵
- Scheduled Task/Job: Scheduled Task
PID:1676
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3112
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4984
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD5652e746bd24f89a2d08fd6cdddff1e66
SHA19762ff799ada4f1a4c2da27d2e403db63dd86ba3
SHA256c5f773352e72b43cd0a77de21f84d757724c38614080803cfb573f7d61295afa
SHA512c08a43333c718e02664e3e46ca9d792138c5b6a9ed549ecf1b8779157c480c178b0b129c8f9d7526eaaf5ba06678547efe5a19a0052ea57ed67fc39337afe79a
-
Filesize
1KB
MD5ffe1859109dc1d24de2b1c5cde7c643c
SHA1e30c7ff8e1f00f85d840b25391eb2a2925d1a8cd
SHA256ca870aba5c3441cd614dabb860e0d7b960ab69ffbd19529be248efd2f0faf3a0
SHA512678c5074e40c962a3b6d06d7fcecfc183e3db229a9f0894f07230a805a78d9c21fac4b957b21d5aacd30c086d14c8c964214b1950000c4ff768c50367518f124