Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
19/12/2024, 16:07
Behavioral task
behavioral1
Sample
asdd.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
asdd.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral3
Sample
asdd.exe
Resource
android-x64-20240624-en
android-10-x64
0 signatures
150 seconds
General
- Target asdd.exe
- Size 45KB
- Sample241219-tkqjssvrer
- SHA256 d54bd79976a9cfef49e8ae530437fd657e3c2125623b8c26049f95a77da9b0ea
- MD5 7c0981b33bb05e403e6dafbfb15f245e
- SHA1 0d85fd3a8c5de8bce1e9e5595d2882491cab3e51
- SHA512 bb57ef8f6489b4fe0c2f8f02d2fde38c5398c80296af53c2c34909e02a5a0e042dcd22d0a08c36b40c4e5816cb5334b55e802e67a8cb699df25a183b435dd96a
- SSDEEP 768:xdhO/poiiUcjlJInlzH9Xqk5nWEZ5SbTDaYWI7CPW5V:vw+jjgndH9XqcnW85SbTZWId
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
xenorat
C2
-
192.168.1.129
Mutex
-
MERRYCHEESEMAS
Attributes
-
delay
5000
-
install_path
appdata
-
port
8888
-
startup_name
Windows
Signatures
- Detect XenoRat Payload 2 IoCs
resource yara_rule behavioral2/memory/3052-1-0x0000000000EA0000-0x0000000000EB2000-memory.dmp family_xenorat behavioral2/files/0x0007000000023cb8-6.dat family_xenorat - Xenorat family
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation asdd.exe - Executes dropped EXE 1 IoCs
pid Process 4428 asdd.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language asdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language asdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4176 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2116 taskmgr.exe Token: SeSystemProfilePrivilege 2116 taskmgr.exe Token: SeCreateGlobalPrivilege 2116 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe 2116 taskmgr.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3052 wrote to memory of 4428 3052 asdd.exe 84 PID 3052 wrote to memory of 4428 3052 asdd.exe 84 PID 3052 wrote to memory of 4428 3052 asdd.exe 84 PID 4428 wrote to memory of 4176 4428 asdd.exe 86 PID 4428 wrote to memory of 4176 4428 asdd.exe 86 PID 4428 wrote to memory of 4176 4428 asdd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\asdd.exe"C:\Users\Admin\AppData\Local\Temp\asdd.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Roaming\XenoManager\asdd.exe"C:\Users\Admin\AppData\Roaming\XenoManager\asdd.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "Windows" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA690.tmp" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4176
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2116
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\asdd.exe.log
- Size 226B
- SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
- MD5 916851e072fbabc4796d8916c5131092
- SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
- SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\tmpA690.tmp
- Size 1KB
- SHA256 891f1b6cf9e44d6692cb59ce2bc03481987a11f631830862208d355c2acf86cc
- MD5 08f70d53eecc94b4aaacd5a49f0e03a5
- SHA1 ad2b400060e2aaf260ef75682031a18504ebb7df
- SHA512 a6e56b6bef3373a5bf8cea522899cd635c356d4b2e0e83356ab25f46e1b5e3e4346b4ab7ced5a2994d3eab36a584c2259966dd8240d43205fc2afc3a975d7204
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\XenoManager\asdd.exe
- Size 45KB
- SHA256 d54bd79976a9cfef49e8ae530437fd657e3c2125623b8c26049f95a77da9b0ea
- MD5 7c0981b33bb05e403e6dafbfb15f245e
- SHA1 0d85fd3a8c5de8bce1e9e5595d2882491cab3e51
- SHA512 bb57ef8f6489b4fe0c2f8f02d2fde38c5398c80296af53c2c34909e02a5a0e042dcd22d0a08c36b40c4e5816cb5334b55e802e67a8cb699df25a183b435dd96a
- SSDEEP 768:xdhO/poiiUcjlJInlzH9Xqk5nWEZ5SbTDaYWI7CPW5V:vw+jjgndH9XqcnW85SbTZWId
- MD5 SHA1 SHA512 SSDEEP