Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29-09-2024 18:42
Behavioral task
behavioral1
Sample
Sleezy Perm Spoofer.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
General
-
Target
Sleezy Perm Spoofer.exe
-
Size
78KB
-
MD5
7628121165d4796f1ead2df63225b7e2
-
SHA1
56e0300ef52e9ef736d266a07cabf9b5bdee3c3e
-
SHA256
a10ceb030849738fb5c0c2b03b63428979b2f14047cbf1501fa7ff626f0e30a1
-
SHA512
fe9808eb871ed5ac7a08be5ec19532ddd2148c3ad4b179b7e51a378bc6ad656f5d0aafaed3837f6f0b9ef7fc361ccd8e3937cc1a4e8a33e2220fe81b8f20f0f8
-
SSDEEP
1536:QNo/jOtwwm0ZvHTPkorpS/WEQ55HL6VG28SPCYbxfE:QRm09dP5HLfSKYbxfE
Malware Config
Signatures
-
Detect XenoRat Payload 2 IoCs
resource yara_rule behavioral2/memory/4448-1-0x00000000005E0000-0x00000000005FA000-memory.dmp family_xenorat behavioral2/files/0x00070000000234bd-7.dat family_xenorat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation Sleezy Perm Spoofer.exe -
Executes dropped EXE 1 IoCs
pid Process 2440 Sleezy Perm Spoofer.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
flow ioc 30 4.tcp.eu.ngrok.io 66 4.tcp.eu.ngrok.io 68 4.tcp.eu.ngrok.io 70 4.tcp.eu.ngrok.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sleezy Perm Spoofer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sleezy Perm Spoofer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2080 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1296 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1296 taskmgr.exe Token: SeSystemProfilePrivilege 1296 taskmgr.exe Token: SeCreateGlobalPrivilege 1296 taskmgr.exe Token: SeSecurityPrivilege 1296 taskmgr.exe Token: SeTakeOwnershipPrivilege 1296 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe 1296 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4448 wrote to memory of 2440 4448 Sleezy Perm Spoofer.exe 86 PID 4448 wrote to memory of 2440 4448 Sleezy Perm Spoofer.exe 86 PID 4448 wrote to memory of 2440 4448 Sleezy Perm Spoofer.exe 86 PID 2440 wrote to memory of 2080 2440 Sleezy Perm Spoofer.exe 88 PID 2440 wrote to memory of 2080 2440 Sleezy Perm Spoofer.exe 88 PID 2440 wrote to memory of 2080 2440 Sleezy Perm Spoofer.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sleezy Perm Spoofer.exe"C:\Users\Admin\AppData\Local\Temp\Sleezy Perm Spoofer.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\XenoManager\Sleezy Perm Spoofer.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\Sleezy Perm Spoofer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "svchost.exe" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF7C.tmp" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2080
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1296
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
425B
MD54eaca4566b22b01cd3bc115b9b0b2196
SHA1e743e0792c19f71740416e7b3c061d9f1336bf94
SHA25634ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
-
Filesize
78KB
MD57628121165d4796f1ead2df63225b7e2
SHA156e0300ef52e9ef736d266a07cabf9b5bdee3c3e
SHA256a10ceb030849738fb5c0c2b03b63428979b2f14047cbf1501fa7ff626f0e30a1
SHA512fe9808eb871ed5ac7a08be5ec19532ddd2148c3ad4b179b7e51a378bc6ad656f5d0aafaed3837f6f0b9ef7fc361ccd8e3937cc1a4e8a33e2220fe81b8f20f0f8
-
Filesize
1KB
MD5f91d13e2a2b21b6180819b1879a069e4
SHA194280d71b40b72773000b4f0f4dceb9c2bc9a279
SHA256772dd443b70d8ac62e89de9e3040d1b436aaa60cf28a8b245ec5414ae15c6860
SHA512963086710d642f4b90881a3d0fe43475c53f00ef5a7c6a4ddc087bb5c94c484ce57260305e9c92425d64a663154632cbd40442dbc07e9a9ba5644028b08fd3b2