Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
27/03/2025, 14:00
General
-
Target
xlib86.exe
-
Size
624KB
-
MD5
15d1f00d56be9a75ef838df7296fd36e
-
SHA1
eaecc49bebee74cd142af04ba5047acfc1c10db2
-
SHA256
0295fc7acaed48393649e69a4a604a682afd9fa832d6c69ba5a0ed6f15471fe4
-
SHA512
9f61f4350ef961b9ef29930f9fcfca0b756cb8fe1b48707b6be591cdfd71f1347996566bfb89cdb543ee39d2ad899019a7638429f340f6351d5043258933e437
-
SSDEEP
12288:URZ+IoG/n9IQxW3OBseUUT+tcYbga2N7O+WJu/Z9kBTdxFZA:u2G/nvxW3WieCga2LGMkLxFi
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 34 IoCs
-
Suspicious use of SendNotifyMessage 34 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\xlib86.exe"C:\Users\Admin\AppData\Local\Temp\xlib86.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Surrogatewinhostmonitordhcp\pMePjNUURw4Ot6IwNhicgojYWDsEz7.vbe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
222B
MD54c50c05f5f29b843d193aada8904def2
SHA17a2fda1bd825504e53778699cff394e8743135e0
SHA256ca5ad7488b13ef487e396935d7c9fc873f57b5e0a704ca1c8a62e12cab603b3f
SHA5122acd62e4969c79158a549e98049f4f16b23f4935d1c738eac28fbdcf438c37d9898e851a70b95e6cc370af4f4358e76305de5becb0f629c90060cf60f8742893
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB