Analysis
-
max time kernel
300s -
max time network
300s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
18-07-2024 06:21
General
-
Target
1.exe
-
Size
45KB
-
MD5
031ef44f772d9b20762d5b7d8c6ce141
-
SHA1
370ca1a7c78171b55daef91cf827df72bcc3e741
-
SHA256
631713b09731f14b5397059d6358bb580525fbef98bfd2f16321b12677e14ce5
-
SHA512
bd224cf4afef381350d096137e60ed31a83b70d3e2320a4896f38aa0e69117c9ab0d8b594214911ace1aaa8a7ec28f2da44aa17e71ec7ad31efa8794512120a6
-
SSDEEP
768:qdhO/poiiUcjlJIn5wzH9Xqk5nWEZ5SbTDaMWI7CPW5N:Mw+jjgn5yH9XqcnW85SbT9WIl
Malware Config
Extracted
Family
xenorat
C2
176.113.115.177
Mutex
RGHEHTJ4GEJHTJSHJAJHAJHA
Attributes
-
install_path
nothingset
-
port
4404
-
startup_name
nothingset
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe 2500 1.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2500 1.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2500 1.exe