Analysis
-
max time kernel
299s -
max time network
293s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04-09-2024 22:57
General
-
Target
MemoryReduct.exe
-
Size
45KB
-
MD5
caed2f9a1430222267c829424048a584
-
SHA1
22efb3b0d0bef8ded5920b053b3bb318eb1c2c3f
-
SHA256
f000c7fb9844e917eb223f1a1a8035fc2f95df89625441e18e9666f405d72b20
-
SHA512
983a371077305af97c46f30da531e4fe88181451496956d6b6871896e858568249bad33a69905a40c7619056dd6a4d2820c1bc3f88379dfee80577b2274231ba
-
SSDEEP
768:BdhO/poiiUcjlJInxQH9Xqk5nWEZ5SbTDan0WI7CPW5h:/w+jjgnqH9XqcnW85SbTG0WIJ
Malware Config
Extracted
Family
xenorat
C2
syfhnuc714-20814.portmap.host
Mutex
Celex_Cracked
Attributes
-
delay
5000
-
install_path
temp
-
port
8080
-
startup_name
Steam_Service
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation MemoryReduct.exe -
Executes dropped EXE 1 IoCs
pid Process 2280 MemoryReduct.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MemoryReduct.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MemoryReduct.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe -
Modifies data under HKEY_USERS 18 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3988 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4988 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 4988 taskmgr.exe Token: SeSystemProfilePrivilege 4988 taskmgr.exe Token: SeCreateGlobalPrivilege 4988 taskmgr.exe Token: SeCreateGlobalPrivilege 532 dwm.exe Token: SeChangeNotifyPrivilege 532 dwm.exe Token: 33 532 dwm.exe Token: SeIncBasePriorityPrivilege 532 dwm.exe Token: SeShutdownPrivilege 532 dwm.exe Token: SeCreatePagefilePrivilege 532 dwm.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe 4988 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2740 wrote to memory of 2280 2740 MemoryReduct.exe 89 PID 2740 wrote to memory of 2280 2740 MemoryReduct.exe 89 PID 2740 wrote to memory of 2280 2740 MemoryReduct.exe 89 PID 2280 wrote to memory of 3988 2280 MemoryReduct.exe 94 PID 2280 wrote to memory of 3988 2280 MemoryReduct.exe 94 PID 2280 wrote to memory of 3988 2280 MemoryReduct.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\MemoryReduct.exe"C:\Users\Admin\AppData\Local\Temp\MemoryReduct.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\XenoManager\MemoryReduct.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\MemoryReduct.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "Steam_Service" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCC39.tmp" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3988
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4988
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:532
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
Filesize
45KB
MD5caed2f9a1430222267c829424048a584
SHA122efb3b0d0bef8ded5920b053b3bb318eb1c2c3f
SHA256f000c7fb9844e917eb223f1a1a8035fc2f95df89625441e18e9666f405d72b20
SHA512983a371077305af97c46f30da531e4fe88181451496956d6b6871896e858568249bad33a69905a40c7619056dd6a4d2820c1bc3f88379dfee80577b2274231ba
-
Filesize
1KB
MD5f19f1842080f84c0f1143a3295fb8f4a
SHA1b8848554a4038ce61c1296b41f9df46e1dcd4b9b
SHA256922964968966fd11df7b407f053b644b0c6a39ae4f52bb27b17ad429a9d339bf
SHA512b380dec30742065ab749430841df1f65fcd7235ebbf97fb73ddfe315faa20a11941c17e755de5cdbae48ce1f598b045c3cad7057cd800c548b6f1ee2ed7e329c