Analysis
-
max time kernel
137s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 22:18
General
-
Target
XtasyExecutor.exe
-
Size
202KB
-
MD5
20bd0480bb862bd1d073477a87aede81
-
SHA1
3c7c72fc3c1bec023386ac6ed14ad5cb785fe4ce
-
SHA256
548529c38438f4a9aea915448e183f24d4ddbe793a86090075775a154d59f067
-
SHA512
6b4817a7921bb62bbaf6835a3948a1811914f652f5f6ad86fe0b52376b6347d180488c3de4f02ba8ec962c45c5b4d6ad91eba11441989bbb42dab2863dfaa766
-
SSDEEP
6144:gLV6Bta6dtJmakIM5E/hBp4OnvF3ZO2hdi:gLV6BtpmkJBprnvF3AWi
Malware Config
Signatures
-
Nanocore family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Subsystem = "C:\\Program Files (x86)\\SCSI Subsystem\\scsiss.exe" XtasyExecutor.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA XtasyExecutor.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\SCSI Subsystem\scsiss.exe XtasyExecutor.exe File opened for modification C:\Program Files (x86)\SCSI Subsystem\scsiss.exe XtasyExecutor.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XtasyExecutor.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 596 XtasyExecutor.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 596 XtasyExecutor.exe 580 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 596 XtasyExecutor.exe Token: SeDebugPrivilege 580 taskmgr.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe -
Suspicious use of SendNotifyMessage 33 IoCs
pid Process 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe 580 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XtasyExecutor.exe"C:\Users\Admin\AppData\Local\Temp\XtasyExecutor.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:596
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:580