Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
30-07-2024 23:35
Behavioral task
behavioral1
Sample
f81185426901a3519e4d8d030d677ecf8a50d873fecfdd3980ef3ccfac785707_dump.exe
Resource
win7-20240705-en
General
-
Target
f81185426901a3519e4d8d030d677ecf8a50d873fecfdd3980ef3ccfac785707_dump.exe
-
Size
45KB
-
MD5
15b8e2ef54c276964ff060b418efe7ef
-
SHA1
44c15cfbcd468be279a6fc87f173215ff1f6e7a1
-
SHA256
84ab5607a472d325b4128bf0012fe9253e09a694b57bac657abf54973c9b6312
-
SHA512
565ee7fb24a42a5c0435db3a07df15e5be5ff936383257038fd13c9d02c25d3a0db0241effc6b0c64f949f83d274d2d1e926e929dd9b2c104340fc15f45d2a57
-
SSDEEP
768:WSisJmceOo5DHoMspLfFpyT7QHbtm+6EyqnN+8N4:AsJmfOmDILprj4QHbt+EH4U4
Malware Config
Extracted
xenorat
45.66.231.63
Tolid_rat_nd8889j
-
delay
40000
-
install_path
temp
-
port
1353
-
startup_name
vplayer
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3774859476-2260090144-3466365324-1000\Control Panel\International\Geo\Nation f81185426901a3519e4d8d030d677ecf8a50d873fecfdd3980ef3ccfac785707_dump.exe -
Executes dropped EXE 1 IoCs
pid Process 1116 f81185426901a3519e4d8d030d677ecf8a50d873fecfdd3980ef3ccfac785707_dump.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f81185426901a3519e4d8d030d677ecf8a50d873fecfdd3980ef3ccfac785707_dump.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f81185426901a3519e4d8d030d677ecf8a50d873fecfdd3980ef3ccfac785707_dump.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5084 schtasks.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3776 wrote to memory of 1116 3776 f81185426901a3519e4d8d030d677ecf8a50d873fecfdd3980ef3ccfac785707_dump.exe 84 PID 3776 wrote to memory of 1116 3776 f81185426901a3519e4d8d030d677ecf8a50d873fecfdd3980ef3ccfac785707_dump.exe 84 PID 3776 wrote to memory of 1116 3776 f81185426901a3519e4d8d030d677ecf8a50d873fecfdd3980ef3ccfac785707_dump.exe 84 PID 1116 wrote to memory of 5084 1116 f81185426901a3519e4d8d030d677ecf8a50d873fecfdd3980ef3ccfac785707_dump.exe 86 PID 1116 wrote to memory of 5084 1116 f81185426901a3519e4d8d030d677ecf8a50d873fecfdd3980ef3ccfac785707_dump.exe 86 PID 1116 wrote to memory of 5084 1116 f81185426901a3519e4d8d030d677ecf8a50d873fecfdd3980ef3ccfac785707_dump.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\f81185426901a3519e4d8d030d677ecf8a50d873fecfdd3980ef3ccfac785707_dump.exe"C:\Users\Admin\AppData\Local\Temp\f81185426901a3519e4d8d030d677ecf8a50d873fecfdd3980ef3ccfac785707_dump.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\XenoManager\f81185426901a3519e4d8d030d677ecf8a50d873fecfdd3980ef3ccfac785707_dump.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\f81185426901a3519e4d8d030d677ecf8a50d873fecfdd3980ef3ccfac785707_dump.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "vplayer" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3208.tmp" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:5084
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\f81185426901a3519e4d8d030d677ecf8a50d873fecfdd3980ef3ccfac785707_dump.exe.log
Filesize226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\f81185426901a3519e4d8d030d677ecf8a50d873fecfdd3980ef3ccfac785707_dump.exe
Filesize45KB
MD515b8e2ef54c276964ff060b418efe7ef
SHA144c15cfbcd468be279a6fc87f173215ff1f6e7a1
SHA25684ab5607a472d325b4128bf0012fe9253e09a694b57bac657abf54973c9b6312
SHA512565ee7fb24a42a5c0435db3a07df15e5be5ff936383257038fd13c9d02c25d3a0db0241effc6b0c64f949f83d274d2d1e926e929dd9b2c104340fc15f45d2a57
-
Filesize
1KB
MD55a006761f0cebe419f591ef13fb45b0d
SHA1e2cabcf8b11122e544f26bbdbf05140732916529
SHA256056a63298da2870b17077eb8d1760469c61831dac8bdf9ed71720b1b36ccf16c
SHA5124397e31f88af77eb26d1cae0c67aea0c39e97a6235bc80c6756a8ee6c283e7d87c260be949159d58e7223aa45854a5ea96ba5de530ebe9700470c3c7c22f3668