xenorat | e7b275d70655db9cb43fa606bbe2e4f22478ca4962bbf9f299d66eda567d63cd

Analysis

max time kernel
300s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/08/2024, 14:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xeno rat server.exe
Size 2.0MB
Sample240813-rn2ecsybph
SHA256 3d00a800474ddf382212e003222805bd74665b69cec43b554f91c3cd9edf04c4
MD5 3987ee127f2a2cf8a29573d4e111a8e8
SHA1 fc253131e832297967f93190217f0ce403e38cb0
SHA512 69d5ac7a691dde1a3ed7f495e9b9180e63152ddaaa3d1b596ad9cbeb4d7b088f3fc4b138ecf87070014cdfa9047be18940b720de60642389921a10053250787b
SSDEEP 49152:EnxkNTRWjxoJochWQI3kqXfd+/9AManGhR0vNgtIeGWtOc5Q:ExkNTcaJhDI3kqXf0FtWykQDCiQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xenorat credential_access discovery rat spyware stealer trojan

Malware Config

Extracted

Family

xenorat

127.0.0.1

Mutex

BLACK

Attributes

delay
5000
install_path
appdata
port
8888
startup_name
windows

Signatures

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	die.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	die.exe

Executes dropped EXE 5 IoCs

pid	Process
1612	die.exe
116	die.exe
2120	die.exe
4944	die.exe
4184	die.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xeno rat server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	die.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	die.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	die.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	die.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	die.exe

Modifies registry class 52 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\ms-settings\Shell\Open\command	die.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 7e003100000000000259966d11004465736b746f7000680009000400efbe025984630259966d2e0000008ae101000000010000000000000000003e0000000000f205d6004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\ms-settings\Shell	die.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\ms-settings	die.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\NodeSlot = "1"	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = ffffffff	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	xeno rat server.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\ms-settings\Shell\Open	die.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7800310000000000025984631100557365727300640009000400efbe874f77480d59d4722e000000c70500000000010000000000000000003a000000000051291b0155007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	xeno rat server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	xeno rat server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	xeno rat server.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\ms-settings\Shell	die.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	xeno rat server.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\ms-settings\Shell\Open\command	die.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	xeno rat server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute	die.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\ms-settings\Shell\Open\command\ = "\"C:\\Users\\Admin\\Desktop\\die.exe\""	die.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\ms-settings\Shell\Open	die.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	xeno rat server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	xeno rat server.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\ms-settings	die.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000000259396e100041646d696e003c0009000400efbe025984630d59d4722e00000080e10100000001000000000000000000000000000000172aae00410064006d0069006e00000014000000	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	xeno rat server.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2704	schtasks.exe
3568	schtasks.exe
3048	schtasks.exe
3384	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
116	die.exe
116	die.exe
116	die.exe
116	die.exe
116	die.exe
116	die.exe
116	die.exe
116	die.exe
116	die.exe
116	die.exe
116	die.exe
116	die.exe
2120	die.exe
2120	die.exe
2120	die.exe
116	die.exe
116	die.exe
116	die.exe
2120	die.exe
2120	die.exe
2120	die.exe
116	die.exe
116	die.exe
116	die.exe
2120	die.exe
2120	die.exe
2120	die.exe
116	die.exe
116	die.exe
116	die.exe
2120	die.exe
2120	die.exe
2120	die.exe
116	die.exe
116	die.exe
116	die.exe
2120	die.exe
2120	die.exe
2120	die.exe
116	die.exe
116	die.exe
116	die.exe
2120	die.exe
2120	die.exe
2120	die.exe
116	die.exe
116	die.exe
116	die.exe
2120	die.exe
2120	die.exe
2120	die.exe
116	die.exe
116	die.exe
116	die.exe
2120	die.exe
2120	die.exe
2120	die.exe
116	die.exe
116	die.exe
116	die.exe
2120	die.exe
2120	die.exe
2120	die.exe
116	die.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3880	xeno rat server.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	116	die.exe
Token: SeDebugPrivilege	2120	die.exe
Token: SeDebugPrivilege	4944	die.exe
Token: SeDebugPrivilege	4184	die.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3880	xeno rat server.exe
3880	xeno rat server.exe
3880	xeno rat server.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3880	xeno rat server.exe
3880	xeno rat server.exe
3880	xeno rat server.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 116	1612	die.exe	94
PID 1612 wrote to memory of 116	1612	die.exe	94
PID 1612 wrote to memory of 116	1612	die.exe	94
PID 116 wrote to memory of 2704	116	die.exe	98
PID 116 wrote to memory of 2704	116	die.exe	98
PID 116 wrote to memory of 2704	116	die.exe	98
PID 2120 wrote to memory of 3568	2120	die.exe	107
PID 2120 wrote to memory of 3568	2120	die.exe	107
PID 2120 wrote to memory of 3568	2120	die.exe	107
PID 2120 wrote to memory of 4840	2120	die.exe	109
PID 2120 wrote to memory of 4840	2120	die.exe	109
PID 4840 wrote to memory of 4132	4840	cmd.exe	111
PID 4840 wrote to memory of 4132	4840	cmd.exe	111
PID 4132 wrote to memory of 4944	4132	fodhelper.exe	112
PID 4132 wrote to memory of 4944	4132	fodhelper.exe	112
PID 4132 wrote to memory of 4944	4132	fodhelper.exe	112
PID 4944 wrote to memory of 3048	4944	die.exe	117
PID 4944 wrote to memory of 3048	4944	die.exe	117
PID 4944 wrote to memory of 3048	4944	die.exe	117
PID 2120 wrote to memory of 4184	2120	die.exe	120
PID 2120 wrote to memory of 4184	2120	die.exe	120
PID 2120 wrote to memory of 4184	2120	die.exe	120
PID 4184 wrote to memory of 3384	4184	die.exe	122
PID 4184 wrote to memory of 3384	4184	die.exe	122
PID 4184 wrote to memory of 3384	4184	die.exe	122

C:\Users\Admin\AppData\Local\Temp\xeno rat server.exe
"C:\Users\Admin\AppData\Local\Temp\xeno rat server.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3880

C:\Users\Admin\Desktop\die.exe
"C:\Users\Admin\Desktop\die.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Users\Admin\AppData\Roaming\XenoManager\die.exe
  "C:\Users\Admin\AppData\Roaming\XenoManager\die.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:116
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /Create /TN "windows" /XML "C:\Users\Admin\AppData\Local\Temp\tmp43C6.tmp" /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2704

C:\Users\Admin\Desktop\die.exe
"C:\Users\Admin\Desktop\die.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /Create /TN "windows" /XML "C:\Users\Admin\AppData\Local\Temp\tmp66DE.tmp" /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3568
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c start "" "%windir%\system32\fodhelper.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\system32\fodhelper.exe
    "C:\Windows\system32\fodhelper.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4132
  - - C:\Users\Admin\Desktop\die.exe
      "C:\Users\Admin\Desktop\die.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4944
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks.exe" /Create /TN "windows" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB387.tmp" /F
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3048
- C:\Users\Admin\Desktop\die.exe
  "C:\Users\Admin\Desktop\die.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /Create /TN "windows" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD93F.tmp" /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

die.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\die.exe.log
Size 226B
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
MD5 SHA1 SHA512

Submit Download

tmp43C6.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp43C6.tmp
Size 1KB
SHA256 eb4e925135a76337f45795562600d60868c9d1f70baaea0fed7d0e136dfc3dd1
MD5 e74313e3560514e08520bf3e68c8f022
SHA1 7aa0b9c044970e0c62fdefd3f0a68fd16455cf44
SHA512 7d6a821c227227ac50faeeff4a194ac10780c667877028024d8b0563e838a14c23ff7565c2189bb2d19d2945ab9947aceede4c8860b48d8b33b7eef46917fe71
MD5 SHA1 SHA512

Submit Download

tmp66DE.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp66DE.tmp
Size 1KB
SHA256 1a140e864da2ef3de5017299a798f4b3fadf94d72348fa8c3fb389813378212e
MD5 2e5ac93d4c8858833080baa5bd7918ec
SHA1 feecb7c588f9f731ff749752c5103f34257a780d
SHA512 432afebd234058311c51e8c50141b9b9eddb229ce1990a4b65c399c193ecb01f89a32e2d5c9eb274fa1fae7141250a500cc6acf0e9b1192e00991b3cb61bf95e
MD5 SHA1 SHA512

Submit Download

die.exe

Path C:\Users\Admin\Desktop\die.exe
Size 45KB
SHA256 3c7e514191f1576bd8fcb8e150d46a4cf3426477a078c9c266cc59b41cd1917c
MD5 facf67d96edad6ea939bdcbc104fab68
SHA1 33f02dfe3b6593bcc5dca7d48b2519d0e34b3a14
SHA512 a9a490a5ee75b556aff3313858b603c6a2f975efb18ccc5198d0174c355b50f44ed3001932ae0561cb330ad76540fcfd3046018fa381474fc50aaec7bbafe5a9
SSDEEP 768:KdhO/poiiUcjlJInV3H9Xqk5nWEZ5SbTDapuI7CPW55:sw+jjgnRH9XqcnW85SbTMuIh
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/116-52-0x0000000006190000-0x00000000061F6000-memory.dmp

Download

memory/1612-49-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/1612-36-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/1612-34-0x0000000000AB0000-0x0000000000AC2000-memory.dmp

Download

memory/2120-65-0x0000000000F20000-0x0000000000F2A000-memory.dmp

Download

memory/2120-64-0x0000000006310000-0x0000000006322000-memory.dmp

Download

memory/2120-57-0x0000000005CB0000-0x0000000005CBC000-memory.dmp

Download

memory/3880-10-0x0000000009B00000-0x0000000009BB2000-memory.dmp

Download

memory/3880-4-0x0000000004FD0000-0x0000000004FDA000-memory.dmp

Download

memory/3880-15-0x0000000074A0E000-0x0000000074A0F000-memory.dmp

Download

memory/3880-16-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/3880-18-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/3880-21-0x0000000000B50000-0x0000000000C74000-memory.dmp

Download

memory/3880-22-0x0000000000C90000-0x0000000000CAA000-memory.dmp

Download

memory/3880-11-0x0000000007A80000-0x0000000007DD4000-memory.dmp

Download

memory/3880-0-0x0000000074A0E000-0x0000000074A0F000-memory.dmp

Download

memory/3880-9-0x0000000009920000-0x0000000009942000-memory.dmp

Download

memory/3880-8-0x0000000007A20000-0x0000000007A32000-memory.dmp

Download

memory/3880-7-0x0000000007A00000-0x0000000007A1A000-memory.dmp

Download

memory/3880-6-0x0000000005620000-0x0000000005634000-memory.dmp

Download

memory/3880-5-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/3880-54-0x000000000C1A0000-0x000000000C1B2000-memory.dmp

Download

memory/3880-13-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/3880-3-0x0000000004F10000-0x0000000004FA2000-memory.dmp

Download

memory/3880-2-0x0000000005670000-0x0000000005C14000-memory.dmp

Download

memory/3880-1-0x0000000000320000-0x0000000000522000-memory.dmp

Download

memory/4184-66-0x00000000015C0000-0x00000000015D2000-memory.dmp

Download

memory/4184-67-0x00000000067C0000-0x00000000068BA000-memory.dmp

Download

memory/4184-68-0x0000000006A90000-0x0000000006C52000-memory.dmp

Download

memory/4184-69-0x0000000006910000-0x0000000006960000-memory.dmp

Download

memory/4184-70-0x00000000069E0000-0x0000000006A56000-memory.dmp

Download

memory/4184-71-0x0000000007190000-0x00000000076BC000-memory.dmp

Download

memory/4184-72-0x0000000006C90000-0x0000000006CAE000-memory.dmp

Download

memory/4184-74-0x0000000006E60000-0x0000000006EFC000-memory.dmp

Download

memory/4184-95-0x0000000006740000-0x000000000674A000-memory.dmp

Download

memory/4184-96-0x0000000006750000-0x000000000675A000-memory.dmp

Download