xenorat | e7b275d70655db9cb43fa606bbe2e4f22478ca4962bbf9f299d66eda567d63cd

Analysis

max time kernel
300s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-08-2024 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

xeno rat server.exe
Size

2.0MB
MD5

3987ee127f2a2cf8a29573d4e111a8e8
SHA1

fc253131e832297967f93190217f0ce403e38cb0
SHA256

3d00a800474ddf382212e003222805bd74665b69cec43b554f91c3cd9edf04c4
SHA512

69d5ac7a691dde1a3ed7f495e9b9180e63152ddaaa3d1b596ad9cbeb4d7b088f3fc4b138ecf87070014cdfa9047be18940b720de60642389921a10053250787b
SSDEEP

49152:EnxkNTRWjxoJochWQI3kqXfd+/9AManGhR0vNgtIeGWtOc5Q:ExkNTcaJhDI3kqXf0FtWykQDCiQ

Score

10^/10

xenorat credential_access discovery rat spyware stealer trojan

Malware Config

Extracted

Family

xenorat

127.0.0.1

Mutex

BLACK

Attributes

delay
5000
install_path
appdata
port
8888
startup_name
windows

Signatures

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	die.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	die.exe

Executes dropped EXE 5 IoCs

pid	Process
1612	die.exe
116	die.exe
2120	die.exe
4944	die.exe
4184	die.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xeno rat server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	die.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	die.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	die.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	die.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	die.exe

Modifies registry class 52 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\ms-settings\Shell\Open\command	die.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 7e003100000000000259966d11004465736b746f7000680009000400efbe025984630259966d2e0000008ae101000000010000000000000000003e0000000000f205d6004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\ms-settings\Shell	die.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\ms-settings	die.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\NodeSlot = "1"	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = ffffffff	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	xeno rat server.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\ms-settings\Shell\Open	die.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7800310000000000025984631100557365727300640009000400efbe874f77480d59d4722e000000c70500000000010000000000000000003a000000000051291b0155007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	xeno rat server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	xeno rat server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	xeno rat server.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\ms-settings\Shell	die.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	xeno rat server.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\ms-settings\Shell\Open\command	die.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	xeno rat server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute	die.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\ms-settings\Shell\Open\command\ = "\"C:\\Users\\Admin\\Desktop\\die.exe\""	die.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\ms-settings\Shell\Open	die.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	xeno rat server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	xeno rat server.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\ms-settings	die.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000000259396e100041646d696e003c0009000400efbe025984630d59d4722e00000080e10100000001000000000000000000000000000000172aae00410064006d0069006e00000014000000	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	xeno rat server.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2704	schtasks.exe
3568	schtasks.exe
3048	schtasks.exe
3384	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
116	die.exe
116	die.exe
116	die.exe
116	die.exe
116	die.exe
116	die.exe
116	die.exe
116	die.exe
116	die.exe
116	die.exe
116	die.exe
116	die.exe
2120	die.exe
2120	die.exe
2120	die.exe
116	die.exe
116	die.exe
116	die.exe
2120	die.exe
2120	die.exe
2120	die.exe
116	die.exe
116	die.exe
116	die.exe
2120	die.exe
2120	die.exe
2120	die.exe
116	die.exe
116	die.exe
116	die.exe
2120	die.exe
2120	die.exe
2120	die.exe
116	die.exe
116	die.exe
116	die.exe
2120	die.exe
2120	die.exe
2120	die.exe
116	die.exe
116	die.exe
116	die.exe
2120	die.exe
2120	die.exe
2120	die.exe
116	die.exe
116	die.exe
116	die.exe
2120	die.exe
2120	die.exe
2120	die.exe
116	die.exe
116	die.exe
116	die.exe
2120	die.exe
2120	die.exe
2120	die.exe
116	die.exe
116	die.exe
116	die.exe
2120	die.exe
2120	die.exe
2120	die.exe
116	die.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3880	xeno rat server.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	116	die.exe
Token: SeDebugPrivilege	2120	die.exe
Token: SeDebugPrivilege	4944	die.exe
Token: SeDebugPrivilege	4184	die.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3880	xeno rat server.exe
3880	xeno rat server.exe
3880	xeno rat server.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3880	xeno rat server.exe
3880	xeno rat server.exe
3880	xeno rat server.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 116	1612	die.exe	94
PID 1612 wrote to memory of 116	1612	die.exe	94
PID 1612 wrote to memory of 116	1612	die.exe	94
PID 116 wrote to memory of 2704	116	die.exe	98
PID 116 wrote to memory of 2704	116	die.exe	98
PID 116 wrote to memory of 2704	116	die.exe	98
PID 2120 wrote to memory of 3568	2120	die.exe	107
PID 2120 wrote to memory of 3568	2120	die.exe	107
PID 2120 wrote to memory of 3568	2120	die.exe	107
PID 2120 wrote to memory of 4840	2120	die.exe	109
PID 2120 wrote to memory of 4840	2120	die.exe	109
PID 4840 wrote to memory of 4132	4840	cmd.exe	111
PID 4840 wrote to memory of 4132	4840	cmd.exe	111
PID 4132 wrote to memory of 4944	4132	fodhelper.exe	112
PID 4132 wrote to memory of 4944	4132	fodhelper.exe	112
PID 4132 wrote to memory of 4944	4132	fodhelper.exe	112
PID 4944 wrote to memory of 3048	4944	die.exe	117
PID 4944 wrote to memory of 3048	4944	die.exe	117
PID 4944 wrote to memory of 3048	4944	die.exe	117
PID 2120 wrote to memory of 4184	2120	die.exe	120
PID 2120 wrote to memory of 4184	2120	die.exe	120
PID 2120 wrote to memory of 4184	2120	die.exe	120
PID 4184 wrote to memory of 3384	4184	die.exe	122
PID 4184 wrote to memory of 3384	4184	die.exe	122
PID 4184 wrote to memory of 3384	4184	die.exe	122

C:\Users\Admin\AppData\Local\Temp\xeno rat server.exe
"C:\Users\Admin\AppData\Local\Temp\xeno rat server.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3880

C:\Users\Admin\Desktop\die.exe
"C:\Users\Admin\Desktop\die.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Users\Admin\AppData\Roaming\XenoManager\die.exe
  "C:\Users\Admin\AppData\Roaming\XenoManager\die.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:116
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /Create /TN "windows" /XML "C:\Users\Admin\AppData\Local\Temp\tmp43C6.tmp" /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2704

C:\Users\Admin\Desktop\die.exe
"C:\Users\Admin\Desktop\die.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /Create /TN "windows" /XML "C:\Users\Admin\AppData\Local\Temp\tmp66DE.tmp" /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3568
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c start "" "%windir%\system32\fodhelper.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\system32\fodhelper.exe
    "C:\Windows\system32\fodhelper.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4132
  - - C:\Users\Admin\Desktop\die.exe
      "C:\Users\Admin\Desktop\die.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4944
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks.exe" /Create /TN "windows" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB387.tmp" /F
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3048
- C:\Users\Admin\Desktop\die.exe
  "C:\Users\Admin\Desktop\die.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /Create /TN "windows" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD93F.tmp" /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\die.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp43C6.tmp

Filesize
1KB

MD5
e74313e3560514e08520bf3e68c8f022

SHA1
7aa0b9c044970e0c62fdefd3f0a68fd16455cf44

SHA256
eb4e925135a76337f45795562600d60868c9d1f70baaea0fed7d0e136dfc3dd1

SHA512
7d6a821c227227ac50faeeff4a194ac10780c667877028024d8b0563e838a14c23ff7565c2189bb2d19d2945ab9947aceede4c8860b48d8b33b7eef46917fe71

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp66DE.tmp

Filesize
1KB

MD5
2e5ac93d4c8858833080baa5bd7918ec

SHA1
feecb7c588f9f731ff749752c5103f34257a780d

SHA256
1a140e864da2ef3de5017299a798f4b3fadf94d72348fa8c3fb389813378212e

SHA512
432afebd234058311c51e8c50141b9b9eddb229ce1990a4b65c399c193ecb01f89a32e2d5c9eb274fa1fae7141250a500cc6acf0e9b1192e00991b3cb61bf95e

Download Submit
C:\Users\Admin\Desktop\die.exe

Filesize
45KB

MD5
facf67d96edad6ea939bdcbc104fab68

SHA1
33f02dfe3b6593bcc5dca7d48b2519d0e34b3a14

SHA256
3c7e514191f1576bd8fcb8e150d46a4cf3426477a078c9c266cc59b41cd1917c

SHA512
a9a490a5ee75b556aff3313858b603c6a2f975efb18ccc5198d0174c355b50f44ed3001932ae0561cb330ad76540fcfd3046018fa381474fc50aaec7bbafe5a9

Download Submit
memory/116-52-0x0000000006190000-0x00000000061F6000-memory.dmp

Filesize
408KB

Download
memory/1612-49-0x0000000074A00000-0x00000000751B0000-memory.dmp

Filesize
7.7MB

Download
memory/1612-36-0x0000000074A00000-0x00000000751B0000-memory.dmp

Filesize
7.7MB

Download
memory/1612-34-0x0000000000AB0000-0x0000000000AC2000-memory.dmp

Filesize
72KB

Download
memory/2120-65-0x0000000000F20000-0x0000000000F2A000-memory.dmp

Filesize
40KB

Download
memory/2120-64-0x0000000006310000-0x0000000006322000-memory.dmp

Filesize
72KB

Download
memory/2120-57-0x0000000005CB0000-0x0000000005CBC000-memory.dmp

Filesize
48KB

Download
memory/3880-10-0x0000000009B00000-0x0000000009BB2000-memory.dmp

Filesize
712KB

Download
memory/3880-4-0x0000000004FD0000-0x0000000004FDA000-memory.dmp

Filesize
40KB

Download
memory/3880-15-0x0000000074A0E000-0x0000000074A0F000-memory.dmp

Filesize
4KB

Download
memory/3880-16-0x0000000074A00000-0x00000000751B0000-memory.dmp

Filesize
7.7MB

Download
memory/3880-18-0x0000000074A00000-0x00000000751B0000-memory.dmp

Filesize
7.7MB

Download
memory/3880-21-0x0000000000B50000-0x0000000000C74000-memory.dmp

Filesize
1.1MB

Download
memory/3880-22-0x0000000000C90000-0x0000000000CAA000-memory.dmp

Filesize
104KB

Download
memory/3880-11-0x0000000007A80000-0x0000000007DD4000-memory.dmp

Filesize
3.3MB

Download
memory/3880-0-0x0000000074A0E000-0x0000000074A0F000-memory.dmp

Filesize
4KB

Download
memory/3880-9-0x0000000009920000-0x0000000009942000-memory.dmp

Filesize
136KB

Download
memory/3880-8-0x0000000007A20000-0x0000000007A32000-memory.dmp

Filesize
72KB

Download
memory/3880-7-0x0000000007A00000-0x0000000007A1A000-memory.dmp

Filesize
104KB

Download
memory/3880-6-0x0000000005620000-0x0000000005634000-memory.dmp

Filesize
80KB

Download
memory/3880-5-0x0000000074A00000-0x00000000751B0000-memory.dmp

Filesize
7.7MB

Download
memory/3880-54-0x000000000C1A0000-0x000000000C1B2000-memory.dmp

Filesize
72KB

Download
memory/3880-13-0x0000000074A00000-0x00000000751B0000-memory.dmp

Filesize
7.7MB

Download
memory/3880-3-0x0000000004F10000-0x0000000004FA2000-memory.dmp

Filesize
584KB

Download
memory/3880-2-0x0000000005670000-0x0000000005C14000-memory.dmp

Filesize
5.6MB

Download
memory/3880-1-0x0000000000320000-0x0000000000522000-memory.dmp

Filesize
2.0MB

Download
memory/4184-66-0x00000000015C0000-0x00000000015D2000-memory.dmp

Filesize
72KB

Download
memory/4184-67-0x00000000067C0000-0x00000000068BA000-memory.dmp

Filesize
1000KB

Download
memory/4184-68-0x0000000006A90000-0x0000000006C52000-memory.dmp

Filesize
1.8MB

Download
memory/4184-69-0x0000000006910000-0x0000000006960000-memory.dmp

Filesize
320KB

Download
memory/4184-70-0x00000000069E0000-0x0000000006A56000-memory.dmp

Filesize
472KB

Download
memory/4184-71-0x0000000007190000-0x00000000076BC000-memory.dmp

Filesize
5.2MB

Download
memory/4184-72-0x0000000006C90000-0x0000000006CAE000-memory.dmp

Filesize
120KB

Download
memory/4184-74-0x0000000006E60000-0x0000000006EFC000-memory.dmp

Filesize
624KB

Download
memory/4184-95-0x0000000006740000-0x000000000674A000-memory.dmp

Filesize
40KB

Download
memory/4184-96-0x0000000006750000-0x000000000675A000-memory.dmp

Filesize
40KB

Download