Overview

overview

10

Static

static

Xenos/Xenos.exe

windows7_x64

10

Xenos/Xenos.exe

windows10_x64

10

Xenos/Xenos64.exe

windows7_x64

10

Xenos/Xenos64.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    17-04-2021 12:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Xenos/Xenos64.exe

Score
10/10
njratevasionpersistencetrojan

Malware Config

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Executes dropped EXE 3 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of SetWindowsHookEx 29 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Xenos\Xenos64.exe
    "C:\Users\Admin\AppData\Local\Temp\Xenos\Xenos64.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Users\Admin\AppData\Local\Temp\Xenos64.exe
      "C:\Users\Admin\AppData\Local\Temp\Xenos64.exe"
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1424
    • C:\Users\Admin\AppData\Local\Temp\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1744
      • C:\Users\Admin\AppData\Local\Temp\svhost.exe
        "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
        3⤵
        • Executes dropped EXE
        • Drops startup file
        • Adds Run key to start application
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3948
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svhost.exe" "svhost.exe" ENABLE
          4⤵
            PID:2136
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:932
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1160
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\920832307\payload.dat
          2⤵
          • Opens file in notepad (likely ransom note)
          PID:1248

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\Xenos64.exe
        MD5

        6f0dd4150efddfc20b70401479964211

        SHA1

        e97c802a8013b13fb91a831b779ade7c3ca6870b

        SHA256

        0e6d59fcdf8f143e23b076cc8380d6d23324839ae4f91793133b600e7eb76eb9

        SHA512

        d8e823876507cd10b8c176e502c99bb80d52742eaa7c0e319b2a5c1f605de962505bf09950418a461fde427db34a59dbb67cbb4a6045f44d243c77945aebd0fb

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Xenos64.exe
        MD5

        6f0dd4150efddfc20b70401479964211

        SHA1

        e97c802a8013b13fb91a831b779ade7c3ca6870b

        SHA256

        0e6d59fcdf8f143e23b076cc8380d6d23324839ae4f91793133b600e7eb76eb9

        SHA512

        d8e823876507cd10b8c176e502c99bb80d52742eaa7c0e319b2a5c1f605de962505bf09950418a461fde427db34a59dbb67cbb4a6045f44d243c77945aebd0fb

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        MD5

        ed0b19f0b25d20c2ca2d7ddd9b51fafb

        SHA1

        9cc4d137b50d2653782bd6e4793452ac393e0fa3

        SHA256

        87429a3c6557a11a1e83398d65f54e1fe12945ed3df86d67762bb0e29ad492fb

        SHA512

        561ec87adec4833b29bb6d8061125656a9db4c0371f66f608deb75806525d01a987b1a42c1c43f3f3d1eebc88ebc684fd6189008ee5f4d1edd7cd07fe092ed0f

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        MD5

        ed0b19f0b25d20c2ca2d7ddd9b51fafb

        SHA1

        9cc4d137b50d2653782bd6e4793452ac393e0fa3

        SHA256

        87429a3c6557a11a1e83398d65f54e1fe12945ed3df86d67762bb0e29ad492fb

        SHA512

        561ec87adec4833b29bb6d8061125656a9db4c0371f66f608deb75806525d01a987b1a42c1c43f3f3d1eebc88ebc684fd6189008ee5f4d1edd7cd07fe092ed0f

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\svhost.exe
        MD5

        ed0b19f0b25d20c2ca2d7ddd9b51fafb

        SHA1

        9cc4d137b50d2653782bd6e4793452ac393e0fa3

        SHA256

        87429a3c6557a11a1e83398d65f54e1fe12945ed3df86d67762bb0e29ad492fb

        SHA512

        561ec87adec4833b29bb6d8061125656a9db4c0371f66f608deb75806525d01a987b1a42c1c43f3f3d1eebc88ebc684fd6189008ee5f4d1edd7cd07fe092ed0f

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\svhost.exe
        MD5

        ed0b19f0b25d20c2ca2d7ddd9b51fafb

        SHA1

        9cc4d137b50d2653782bd6e4793452ac393e0fa3

        SHA256

        87429a3c6557a11a1e83398d65f54e1fe12945ed3df86d67762bb0e29ad492fb

        SHA512

        561ec87adec4833b29bb6d8061125656a9db4c0371f66f608deb75806525d01a987b1a42c1c43f3f3d1eebc88ebc684fd6189008ee5f4d1edd7cd07fe092ed0f

        Download Submit
      • memory/1248-129-0x0000000000000000-mapping.dmp
        Download
      • memory/1424-116-0x0000000000000000-mapping.dmp
        Download
      • memory/1744-119-0x0000000000000000-mapping.dmp
        Download
      • memory/1744-123-0x0000000004101000-0x0000000004102000-memory.dmp
        Filesize

        4KB

        Download
      • memory/2016-120-0x0000000000AF0000-0x0000000000AF2000-memory.dmp
        Filesize

        8KB

        Download
      • memory/2016-114-0x0000000000130000-0x0000000000131000-memory.dmp
        Filesize

        4KB

        Download
      • memory/2136-128-0x0000000000000000-mapping.dmp
        Download
      • memory/3948-124-0x0000000000000000-mapping.dmp
        Download
      • memory/3948-127-0x0000000003C60000-0x0000000003C61000-memory.dmp
        Filesize

        4KB

        Download