Analysis
-
max time kernel
72s -
max time network
71s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 19:22
General
-
Target
ezrat.exe
-
Size
45KB
-
MD5
7f00594ebf0e0e5361af2fe16d7a9563
-
SHA1
74c12835e6ba635238d5265adbc4665d84c0b998
-
SHA256
0dbfc7c0dbd273fe095e87a41264c9dbbfad5796bf548a4732e442a5350db12f
-
SHA512
9016085b81a42c3510be7fde84e1bc76c433650a1b8982c758e942f252cb2147f1da7e34fa1c0889c5f7b1b3fd971a16652b94ff4efc5d057bbcd8459f6aabf3
-
SSDEEP
768:/dhO/poiiUcjlJIn5SH9Xqk5nWEZ5SbTDaOuI7CPW5x:1w+jjgnUH9XqcnW85SbTjuIp
Malware Config
Extracted
Family
xenorat
C2
127.0.0.1
Mutex
Roblox.exe
Attributes
-
delay
5000
-
install_path
nothingset
-
port
4444
-
startup_name
fake
Signatures
-
Detect XenoRat Payload 1 IoCs
resource yara_rule behavioral1/memory/1440-1-0x0000000000980000-0x0000000000992000-memory.dmp family_xenorat -
Xenorat family
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ezrat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 756 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2004 taskmgr.exe Token: SeSystemProfilePrivilege 2004 taskmgr.exe Token: SeCreateGlobalPrivilege 2004 taskmgr.exe Token: 33 2004 taskmgr.exe Token: SeIncBasePriorityPrivilege 2004 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1440 wrote to memory of 756 1440 ezrat.exe 86 PID 1440 wrote to memory of 756 1440 ezrat.exe 86 PID 1440 wrote to memory of 756 1440 ezrat.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\ezrat.exe"C:\Users\Admin\AppData\Local\Temp\ezrat.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "fake" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC786.tmp" /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:756
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2004
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD52b57e12bc500815201cf5759ad5698f0
SHA18675ca8127dc6d934d123c7b70b24bb17401fa6d
SHA256e692b58fa762bd01db3bc6dd7077a1132231c90caee6c199f663bda9a108f7b4
SHA512784593629cc8b21b703cb2147206108115c4435ffeed3744e90c92b700fbc3b33b2d434ac6759a325972e56286de66f374071e601213395792f2e65c3bbef43b