Analysis
-
max time kernel
135s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05-01-2025 14:07
Behavioral task
behavioral1
Sample
Efi spoofer.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
General
-
Target
Efi spoofer.exe
-
Size
45KB
-
MD5
d243bb6440d8a27c86e9e3a3b14261f0
-
SHA1
0be4a0a10d0f882d12bc943c7e3fbe3bb85cd34c
-
SHA256
9f5fc80c61b163a400acb871ecd08865a07ea9869cfd33845f4450a219779964
-
SHA512
7b5775134e234955a825cf8ee85e608e4ada7282afccc9304afb7dcd305100f927ed051c405db393395c6fd7e661632b6a7e5d03bd787679f176884b13a632ed
-
SSDEEP
768:tdhO/poiiUcjlJInWYH9Xqk5nWEZ5SbTDalYuI7CPW57:jw+jjgnjH9XqcnW85SbTPuIz
Malware Config
Extracted
Family
xenorat
C2
128.78.132.78
Mutex
Xeno_rat_nd8912d
Attributes
-
delay
5000
-
install_path
nothingset
-
port
4444
-
startup_name
Efi spoofer auto spoof
Signatures
-
Detect XenoRat Payload 1 IoCs
resource yara_rule behavioral1/memory/2976-1-0x0000000000170000-0x0000000000182000-memory.dmp family_xenorat -
Xenorat family
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Efi spoofer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2752 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2156 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2156 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe 2156 taskmgr.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2976 wrote to memory of 2752 2976 Efi spoofer.exe 30 PID 2976 wrote to memory of 2752 2976 Efi spoofer.exe 30 PID 2976 wrote to memory of 2752 2976 Efi spoofer.exe 30 PID 2976 wrote to memory of 2752 2976 Efi spoofer.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Efi spoofer.exe"C:\Users\Admin\AppData\Local\Temp\Efi spoofer.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "Efi spoofer auto spoof" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9CDB.tmp" /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2752
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2156
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58e62f5a2def2179999e69556a6a7e7eb
SHA17ac12efc543258969b7fb81dbc04f7a4497eed5e
SHA256be7331e94e3b4ab4f48e2a7eca3387ba505697249ae73b8d5cf33ab243e5fa70
SHA512fbf014fe65e88b98afea8a5ced0f69c09f930f69478a5f0bbd51fd8516a264266f8b18cb23a6f7c0aef49a9b4be1759a97cddb27aa5d34efdf7bc5e5d3092f6d