Resubmissions
19-12-2024 16:07
241219-tkqjssvrer 10Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 16:07
Behavioral task
behavioral1
Sample
asdd.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
asdd.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
asdd.exe
Resource
android-x64-20240624-en
android-10-x64
General
-
Target
asdd.exe
-
Size
45KB
-
MD5
7c0981b33bb05e403e6dafbfb15f245e
-
SHA1
0d85fd3a8c5de8bce1e9e5595d2882491cab3e51
-
SHA256
d54bd79976a9cfef49e8ae530437fd657e3c2125623b8c26049f95a77da9b0ea
-
SHA512
bb57ef8f6489b4fe0c2f8f02d2fde38c5398c80296af53c2c34909e02a5a0e042dcd22d0a08c36b40c4e5816cb5334b55e802e67a8cb699df25a183b435dd96a
-
SSDEEP
768:xdhO/poiiUcjlJInlzH9Xqk5nWEZ5SbTDaYWI7CPW5V:vw+jjgndH9XqcnW85SbTZWId
Malware Config
Extracted
xenorat
192.168.1.129
MERRYCHEESEMAS
-
delay
5000
-
install_path
appdata
-
port
8888
-
startup_name
Windows
Signatures
-
Detect XenoRat Payload 2 IoCs
resource yara_rule behavioral2/memory/3052-1-0x0000000000EA0000-0x0000000000EB2000-memory.dmp family_xenorat behavioral2/files/0x0007000000023cb8-6.dat family_xenorat -
Xenorat family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation asdd.exe -
Executes dropped EXE 1 IoCs
pid Process 4428 asdd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language asdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language asdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4176 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2116 taskmgr.exe Token: SeSystemProfilePrivilege 2116 taskmgr.exe Token: SeCreateGlobalPrivilege 2116 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3052 wrote to memory of 4428 3052 asdd.exe 84 PID 3052 wrote to memory of 4428 3052 asdd.exe 84 PID 3052 wrote to memory of 4428 3052 asdd.exe 84 PID 4428 wrote to memory of 4176 4428 asdd.exe 86 PID 4428 wrote to memory of 4176 4428 asdd.exe 86 PID 4428 wrote to memory of 4176 4428 asdd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\asdd.exe"C:\Users\Admin\AppData\Local\Temp\asdd.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Roaming\XenoManager\asdd.exe"C:\Users\Admin\AppData\Roaming\XenoManager\asdd.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "Windows" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA690.tmp" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4176
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2116
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
Filesize
1KB
MD508f70d53eecc94b4aaacd5a49f0e03a5
SHA1ad2b400060e2aaf260ef75682031a18504ebb7df
SHA256891f1b6cf9e44d6692cb59ce2bc03481987a11f631830862208d355c2acf86cc
SHA512a6e56b6bef3373a5bf8cea522899cd635c356d4b2e0e83356ab25f46e1b5e3e4346b4ab7ced5a2994d3eab36a584c2259966dd8240d43205fc2afc3a975d7204
-
Filesize
45KB
MD57c0981b33bb05e403e6dafbfb15f245e
SHA10d85fd3a8c5de8bce1e9e5595d2882491cab3e51
SHA256d54bd79976a9cfef49e8ae530437fd657e3c2125623b8c26049f95a77da9b0ea
SHA512bb57ef8f6489b4fe0c2f8f02d2fde38c5398c80296af53c2c34909e02a5a0e042dcd22d0a08c36b40c4e5816cb5334b55e802e67a8cb699df25a183b435dd96a