Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-10-2024 14:54
General
-
Target
2.exe
-
Size
282KB
-
MD5
2a73d33b40a0b8f18d6a814c6299fd01
-
SHA1
05c6a7254a485745467b6488321b887ef4c44b81
-
SHA256
43deac03fa50ed30cb74e3882573d90df257539d21e92f142f9d82d41f397513
-
SHA512
366771ed993254d883bd5ca43cf0c145f53bff2b8db6b6f49270a03761473a1a43dfe35461b301b1e4313c40a99cae4a55fdd6d607777a9e12c0bc5dfa857c20
-
SSDEEP
1536:nw+jjgn6H9XqcnW85SbTEuIO7tMuBtzGulxuJVZ2eY7WHpqiH:nw+jq091UbTESt7leZ2eWNo
Malware Config
Extracted
Family
xenorat
C2
192.168.244.1
Mutex
Blue.cc Temp Woofer
Attributes
-
delay
10
-
install_path
nothingset
-
port
4444
-
startup_name
nothingset
Signatures
-
Detect XenoRat Payload 1 IoCs
resource yara_rule behavioral1/memory/3728-1-0x0000000000B80000-0x0000000000BCC000-memory.dmp family_xenorat -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5104 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 5104 taskmgr.exe Token: SeSystemProfilePrivilege 5104 taskmgr.exe Token: SeCreateGlobalPrivilege 5104 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe 5104 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"1⤵
- System Location Discovery: System Language Discovery
PID:3728
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5104