Malware Analysis Report

2024-10-23 20:25

Sample ID 240902-113ydszcjg
Target GCclientV1.exe
SHA256 6bed3b85a45853d8b4ce39d2db9ffbb2d54f90c15bde96caf9b08245e653fcec
Tags
xenorat discovery rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6bed3b85a45853d8b4ce39d2db9ffbb2d54f90c15bde96caf9b08245e653fcec

Threat Level: Known bad

The file GCclientV1.exe was found to be: Known bad.

Malicious Activity Summary

xenorat discovery rat trojan

XenorRat

Xenorat family

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-02 22:07

Signatures

Xenorat family

xenorat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-02 22:07

Reported

2024-09-02 22:10

Platform

win7-20240705-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\GCclientV1.exe"

Signatures

XenorRat

trojan rat xenorat

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\GCclientV1.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\choice.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\GCclientV1.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2512 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\GCclientV1.exe C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe
PID 2512 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\GCclientV1.exe C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe
PID 2512 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\GCclientV1.exe C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe
PID 2512 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\GCclientV1.exe C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe
PID 3052 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe C:\Windows\SysWOW64\schtasks.exe
PID 3052 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe C:\Windows\SysWOW64\schtasks.exe
PID 3052 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe C:\Windows\SysWOW64\schtasks.exe
PID 3052 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe C:\Windows\SysWOW64\schtasks.exe
PID 3052 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe C:\Windows\SysWOW64\schtasks.exe
PID 3052 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe C:\Windows\SysWOW64\schtasks.exe
PID 3052 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe C:\Windows\SysWOW64\schtasks.exe
PID 3052 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe C:\Windows\SysWOW64\schtasks.exe
PID 3052 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe C:\Windows\SysWOW64\schtasks.exe
PID 3052 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe C:\Windows\SysWOW64\schtasks.exe
PID 3052 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe C:\Windows\SysWOW64\schtasks.exe
PID 3052 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe C:\Windows\SysWOW64\schtasks.exe
PID 3052 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe C:\Windows\SysWOW64\cmd.exe
PID 3052 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe C:\Windows\SysWOW64\cmd.exe
PID 3052 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe C:\Windows\SysWOW64\cmd.exe
PID 3052 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe C:\Windows\SysWOW64\cmd.exe
PID 1696 wrote to memory of 2828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\choice.exe
PID 1696 wrote to memory of 2828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\choice.exe
PID 1696 wrote to memory of 2828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\choice.exe
PID 1696 wrote to memory of 2828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\choice.exe

Processes

C:\Users\Admin\AppData\Local\Temp\GCclientV1.exe

"C:\Users\Admin\AppData\Local\Temp\GCclientV1.exe"

C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe

"C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "Client" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD308.tmp" /F

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /query /v /fo csv

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /delete /tn "\Client" /f

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe"

C:\Windows\SysWOW64\choice.exe

choice /C Y /N /D Y /T 3

Network

Country Destination Domain Proto
US 108.234.74.132:5129 tcp
US 108.234.74.132:5129 tcp
US 108.234.74.132:5129 tcp

Files

memory/2512-0-0x0000000074D2E000-0x0000000074D2F000-memory.dmp

memory/2512-1-0x0000000000F50000-0x0000000000F62000-memory.dmp

\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe

MD5 6c0987679747dfe56c8a4bc28860cb2f
SHA1 00ff1ad0b4000be73188c8b6a8d91a4a99c48b57
SHA256 6bed3b85a45853d8b4ce39d2db9ffbb2d54f90c15bde96caf9b08245e653fcec
SHA512 4970b77b4f67de3d6731085f762daf10ebe751449671ccb7fea31076bdc941488f79136fbd697fc3e363d7a2b727604eff676012f0c75602e22b5f5411bb50c5

memory/3052-9-0x00000000010D0000-0x00000000010E2000-memory.dmp

memory/3052-10-0x0000000074D20000-0x000000007540E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpD308.tmp

MD5 a1e9c508509e964318440cf83a8a0b98
SHA1 0f575d72430d1da2ba1154ec2273d1a355099093
SHA256 f68ad25ac7180efd22da431ac63ed59ad9fe9c9866fceb86d430e40c52a1b771
SHA512 e1d1b1d121d2fc71f766784e463da13b21ec1756eb7de16edcac1182f1bf851ff5fb57431c2bd903b19f931237df5a1e1d5ff071ce2020398c44b49cc7646432

memory/3052-13-0x0000000074D20000-0x000000007540E000-memory.dmp

memory/3052-14-0x0000000074D20000-0x000000007540E000-memory.dmp

memory/3052-15-0x0000000074D20000-0x000000007540E000-memory.dmp

memory/3052-16-0x0000000074D20000-0x000000007540E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-02 22:07

Reported

2024-09-02 22:10

Platform

win10v2004-20240802-en

Max time kernel

78s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\GCclientV1.exe"

Signatures

XenorRat

trojan rat xenorat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\GCclientV1.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\choice.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\GCclientV1.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3856 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\GCclientV1.exe C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe
PID 3856 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\GCclientV1.exe C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe
PID 3856 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\GCclientV1.exe C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe
PID 2708 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe C:\Windows\SysWOW64\schtasks.exe
PID 2708 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe C:\Windows\SysWOW64\schtasks.exe
PID 2708 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe C:\Windows\SysWOW64\schtasks.exe
PID 2708 wrote to memory of 824 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe C:\Windows\SysWOW64\schtasks.exe
PID 2708 wrote to memory of 824 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe C:\Windows\SysWOW64\schtasks.exe
PID 2708 wrote to memory of 824 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe C:\Windows\SysWOW64\schtasks.exe
PID 2708 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe C:\Windows\SysWOW64\schtasks.exe
PID 2708 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe C:\Windows\SysWOW64\schtasks.exe
PID 2708 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe C:\Windows\SysWOW64\schtasks.exe
PID 2708 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe C:\Windows\SysWOW64\cmd.exe
PID 2256 wrote to memory of 1928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\choice.exe
PID 2256 wrote to memory of 1928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\choice.exe
PID 2256 wrote to memory of 1928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\choice.exe

Processes

C:\Users\Admin\AppData\Local\Temp\GCclientV1.exe

"C:\Users\Admin\AppData\Local\Temp\GCclientV1.exe"

C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe

"C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "Client" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC9C8.tmp" /F

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /query /v /fo csv

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /delete /tn "\Client" /f

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe"

C:\Windows\SysWOW64\choice.exe

choice /C Y /N /D Y /T 3

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 108.234.74.132:5129 tcp
US 108.234.74.132:5129 tcp
US 108.234.74.132:5129 tcp
US 8.8.8.8:53 132.74.234.108.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

memory/3856-0-0x0000000074FBE000-0x0000000074FBF000-memory.dmp

memory/3856-1-0x0000000000410000-0x0000000000422000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe

MD5 6c0987679747dfe56c8a4bc28860cb2f
SHA1 00ff1ad0b4000be73188c8b6a8d91a4a99c48b57
SHA256 6bed3b85a45853d8b4ce39d2db9ffbb2d54f90c15bde96caf9b08245e653fcec
SHA512 4970b77b4f67de3d6731085f762daf10ebe751449671ccb7fea31076bdc941488f79136fbd697fc3e363d7a2b727604eff676012f0c75602e22b5f5411bb50c5

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\GCclientV1.exe.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/2708-15-0x0000000074FB0000-0x0000000075760000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpC9C8.tmp

MD5 a1e9c508509e964318440cf83a8a0b98
SHA1 0f575d72430d1da2ba1154ec2273d1a355099093
SHA256 f68ad25ac7180efd22da431ac63ed59ad9fe9c9866fceb86d430e40c52a1b771
SHA512 e1d1b1d121d2fc71f766784e463da13b21ec1756eb7de16edcac1182f1bf851ff5fb57431c2bd903b19f931237df5a1e1d5ff071ce2020398c44b49cc7646432

memory/2708-18-0x0000000006230000-0x0000000006296000-memory.dmp

memory/2708-19-0x0000000074FB0000-0x0000000075760000-memory.dmp

memory/2708-20-0x0000000074FB0000-0x0000000075760000-memory.dmp

memory/2708-21-0x0000000074FB0000-0x0000000075760000-memory.dmp