Analysis
-
max time kernel
19s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04-09-2024 23:21
Behavioral task
behavioral1
Sample
Spoofer.exe
Resource
win7-20240903-en
General
-
Target
Spoofer.exe
-
Size
45KB
-
MD5
9cd971f0e65470ce291b479f21347ec0
-
SHA1
1ddb30a4c205cd84854798ca74ca09ac5d745233
-
SHA256
8a498dbf2e73ee2a5920ff22582eb0bc07721ea62c1d70dcfbaf7e41979a1da4
-
SHA512
b28792401069c0ae200fc41f2e86caacc4f604ba921482ad8a230ad12fcba9126d9b6b019e196869f5b935f0966defd2438aca5773becc7c7b4610c1c8fbe2a2
-
SSDEEP
768:udhO/poiiUcjlJIns3EH9Xqk5nWEZ5SbTDaauI7CPW5e:4w+jjgn+EH9XqcnW85SbT/uI2
Malware Config
Extracted
xenorat
127.0.0.1
Celex
-
delay
5000
-
install_path
appdata
-
port
8080
-
startup_name
Steam_service
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2800 Spoofer.exe -
Loads dropped DLL 1 IoCs
pid Process 2196 Spoofer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Spoofer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Spoofer.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2744 schtasks.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2800 2196 Spoofer.exe 30 PID 2196 wrote to memory of 2800 2196 Spoofer.exe 30 PID 2196 wrote to memory of 2800 2196 Spoofer.exe 30 PID 2196 wrote to memory of 2800 2196 Spoofer.exe 30 PID 2800 wrote to memory of 2744 2800 Spoofer.exe 31 PID 2800 wrote to memory of 2744 2800 Spoofer.exe 31 PID 2800 wrote to memory of 2744 2800 Spoofer.exe 31 PID 2800 wrote to memory of 2744 2800 Spoofer.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\Spoofer.exe"C:\Users\Admin\AppData\Local\Temp\Spoofer.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Roaming\XenoManager\Spoofer.exe"C:\Users\Admin\AppData\Roaming\XenoManager\Spoofer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "Steam_service" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2F5A.tmp" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2744
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD509fbaabc7b71c07e7a69ad642ad06e6f
SHA1476a704478db683f543761791888ffcbff864d01
SHA256a51a98dfcc8710229d9c733ca72180add31445baae9cecd1ddf162af6dea0c8c
SHA51274ca867319a4fe2c7dd6bcfb7da85c49fb33d0e7afec8bbc0373a6308f648025d08a2b60912e387ba921ea9164e3c3524627f020ea4ae0e7a696bea633869a7a
-
Filesize
45KB
MD59cd971f0e65470ce291b479f21347ec0
SHA11ddb30a4c205cd84854798ca74ca09ac5d745233
SHA2568a498dbf2e73ee2a5920ff22582eb0bc07721ea62c1d70dcfbaf7e41979a1da4
SHA512b28792401069c0ae200fc41f2e86caacc4f604ba921482ad8a230ad12fcba9126d9b6b019e196869f5b935f0966defd2438aca5773becc7c7b4610c1c8fbe2a2