Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250207-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250207-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
16-02-2025 01:39
Behavioral task
behavioral1
Sample
BootstrapperNew1.exe
Resource
win10v2004-20250211-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
BootstrapperNew1.exe
Resource
win10ltsc2021-20250207-en
windows10-ltsc 2021-x64
General
-
Target
BootstrapperNew1.exe
-
Size
50KB
-
MD5
2db839a013bb2742e80cdcf4edc63f39
-
SHA1
8b94a91e13f1ff30a3ca2627d3b43affacbb66b0
-
SHA256
47497f110de244113679de02a3eefc50a9831c13e7c86b45ea3e0ce8d0072f7d
-
SHA512
3f0210b4a1245d67c96f563a191b4c11455137afee436ec2b41d2b672a93aed4ebeb5ac0814217ef9fc3c1706c371028670583876d829bccc244206af34e324a
-
SSDEEP
768:UdhO/poiiUcjlJIn8aH9Xqk5nWEZ5SbTDaCuI7CPW5ispt:uw+jjgnfH9XqcnW85SbTvuIqspt
Malware Config
Extracted
xenorat
193.161.193.99
Xeno_rat_nd8912d
-
delay
5000
-
install_path
appdata
-
port
4444
-
startup_name
Solara Bootstrapper Dependinces
Signatures
-
Detect XenoRat Payload 2 IoCs
resource yara_rule behavioral2/memory/4076-1-0x00000000008A0000-0x00000000008B2000-memory.dmp family_xenorat behavioral2/files/0x000c000000027e96-2.dat family_xenorat -
Xenorat family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-67687450-2252871228-2016797368-1000\Control Panel\International\Geo\Nation BootstrapperNew1.exe -
Executes dropped EXE 1 IoCs
pid Process 5588 BootstrapperNew1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BootstrapperNew1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BootstrapperNew1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3300 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 640 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 640 taskmgr.exe Token: SeSystemProfilePrivilege 640 taskmgr.exe Token: SeCreateGlobalPrivilege 640 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe 640 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4076 wrote to memory of 5588 4076 BootstrapperNew1.exe 90 PID 4076 wrote to memory of 5588 4076 BootstrapperNew1.exe 90 PID 4076 wrote to memory of 5588 4076 BootstrapperNew1.exe 90 PID 5588 wrote to memory of 3300 5588 BootstrapperNew1.exe 91 PID 5588 wrote to memory of 3300 5588 BootstrapperNew1.exe 91 PID 5588 wrote to memory of 3300 5588 BootstrapperNew1.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\BootstrapperNew1.exe"C:\Users\Admin\AppData\Local\Temp\BootstrapperNew1.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Roaming\XenoManager\BootstrapperNew1.exe"C:\Users\Admin\AppData\Roaming\XenoManager\BootstrapperNew1.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "Solara Bootstrapper Dependinces" /XML "C:\Users\Admin\AppData\Local\Temp\tmp901A.tmp" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3300
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:640
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226B
MD566aea5e724c4a224d092067c3381783b
SHA1ee3cc64c4370a255391bdfeef2883d5b7a6e6230
SHA25604b17cab961f973464bba8924f764edef6451d1774f2405d27ef33d164296923
SHA5125d719e303f491d1443cb7c7e8946481e90532522a422c98f82466e1eddcd1ef24a4505dcbf75f2191fbb66825d3550566d7f408a3854edeb4c1a192c8c9a6d06
-
Filesize
1KB
MD54f1a3f65c726a5d1b6738fc85f4a9925
SHA1e207b950c2f65eb9e4f59967afefa139748f4a6f
SHA2564820306e4bbf03801fb906ef2fcdd956b9d8a5949870ece25ac21244e3285d93
SHA512fc836daa24cf6245f3fb6261c06e6735925a17149e7297ea4c24b297ea91eb4d9f17d8b090f0e24e970d58ba797498c390735192c5352e32ac88b1312e665339
-
Filesize
50KB
MD52db839a013bb2742e80cdcf4edc63f39
SHA18b94a91e13f1ff30a3ca2627d3b43affacbb66b0
SHA25647497f110de244113679de02a3eefc50a9831c13e7c86b45ea3e0ce8d0072f7d
SHA5123f0210b4a1245d67c96f563a191b4c11455137afee436ec2b41d2b672a93aed4ebeb5ac0814217ef9fc3c1706c371028670583876d829bccc244206af34e324a