Overview

overview

10

Static

static

10

AuthClient.exe

windows10-1703-x64

10

AuthClient.exe

windows10-2004-x64

10

AuthClient.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    24-03-2024 16:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    AuthClient.exe

  • Size

    45KB

  • MD5

    9f3540bc47fad7d3e44b77bd7d393cb9

  • SHA1

    75a3c191551c6e2383a889e19944999dcaca082e

  • SHA256

    13f183db5e4f7cbdef0673b81f35e99b712c08c6c545152ab0f8ee1ac140a8b5

  • SHA512

    465a5b0f1ddaee38fd5c28cbcc9d69489146a816d3420ed1a7ea2c0f0816b0f9a0b8f40fe88680af324404ed97db95ad8e236d06a2ea144d1c5fc8791f7226c7

  • SSDEEP

    768:7dhO/poiiUcjlJInkwH9Xqk5nWEZ5SbTDaHWI7CPW5p:pw+jjgnFH9XqcnW85SbTOWIh

Score
10/10
xenoratpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

xenorat

C2

Vallithebest-32755.portmap.host

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    2000

  • install_path

    temp

  • port

    32755

  • startup_name

    AuthClient

Signatures

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 29 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 20 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AuthClient.exe
    "C:\Users\Admin\AppData\Local\Temp\AuthClient.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3064
    • C:\Users\Admin\AppData\Local\Temp\XenoManager\AuthClient.exe
      "C:\Users\Admin\AppData\Local\Temp\XenoManager\AuthClient.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1296
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks.exe" /Create /TN "AuthClient" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6B5C.tmp" /F
        3⤵
        • Creates scheduled task(s)
        PID:2368
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\System32\rundll32.exe shell32.dll,#61
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1516
        • C:\Windows\SysWOW64\ctfmon.exe
          ctfmon.exe
          4⤵
            PID:4784
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe
          3⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies registry class
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:4112
        • C:\Windows\SysWOW64\rundll32.exe
          C:\Windows\System32\rundll32.exe shell32.dll,#61
          3⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          PID:4276
    • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
      1⤵
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3568

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AuthClient.exe.log
      Filesize

      226B

      MD5

      957779c42144282d8cd83192b8fbc7cf

      SHA1

      de83d08d2cca06b9ff3d1ef239d6b60b705d25fe

      SHA256

      0d7ca7ba65e2b465e4878e324ceab8f8981f5ec06dcf5bc32559a4467a9c7d51

      SHA512

      f1549c61b4f2906d13b2aabb74772c2bc826cd42373d7bb6c48cbb125d5aa2ec17617e6b5e67e8aae3bb5790cc831cdba48a45008ed01df4fba8be448cce39fd

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\XenoManager\AuthClient.exe
      Filesize

      45KB

      MD5

      9f3540bc47fad7d3e44b77bd7d393cb9

      SHA1

      75a3c191551c6e2383a889e19944999dcaca082e

      SHA256

      13f183db5e4f7cbdef0673b81f35e99b712c08c6c545152ab0f8ee1ac140a8b5

      SHA512

      465a5b0f1ddaee38fd5c28cbcc9d69489146a816d3420ed1a7ea2c0f0816b0f9a0b8f40fe88680af324404ed97db95ad8e236d06a2ea144d1c5fc8791f7226c7

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\tmp6B5C.tmp
      Filesize

      1KB

      MD5

      9d60ef385e8562d61fef048cc05ad99f

      SHA1

      1f752c67fd59dfe50e2f7b06d3109a7a6d3a6270

      SHA256

      8d53562b932443a99514ff45ffa0be0b542638327c1b8c8f09553064517733c8

      SHA512

      e7145d9fc1866469c0a3ca494a89bcd08641810d816944ee45356465833df55e3d0a5dfb88e285d51d927943f6db9b3811fc11331c546432ba90f997c20bb37f

      Download Submit

    • memory/1296-18-0x00000000739E0000-0x00000000740CE000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/1296-20-0x0000000006F60000-0x0000000007122000-memory.dmp

      Filesize

      1.8MB

      Download

    • memory/1296-10-0x00000000739E0000-0x00000000740CE000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/1296-11-0x0000000005500000-0x0000000005510000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1296-44-0x0000000005CF0000-0x0000000005D02000-memory.dmp

      Filesize

      72KB

      Download

    • memory/1296-14-0x0000000005EA0000-0x0000000005F06000-memory.dmp

      Filesize

      408KB

      Download

    • memory/1296-15-0x00000000059D0000-0x00000000059DA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/1296-16-0x00000000062F0000-0x0000000006382000-memory.dmp

      Filesize

      584KB

      Download

    • memory/1296-17-0x0000000006890000-0x0000000006D8E000-memory.dmp

      Filesize

      5.0MB

      Download

    • memory/1296-43-0x0000000007570000-0x000000000757A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/1296-19-0x0000000005BB0000-0x0000000005CAA000-memory.dmp

      Filesize

      1000KB

      Download

    • memory/1296-42-0x0000000006790000-0x000000000679C000-memory.dmp

      Filesize

      48KB

      Download

    • memory/1296-21-0x00000000062A0000-0x00000000062F0000-memory.dmp

      Filesize

      320KB

      Download

    • memory/1296-22-0x00000000066D0000-0x0000000006746000-memory.dmp

      Filesize

      472KB

      Download

    • memory/1296-23-0x0000000007660000-0x0000000007B8C000-memory.dmp

      Filesize

      5.2MB

      Download

    • memory/1296-24-0x00000000067B0000-0x00000000067CE000-memory.dmp

      Filesize

      120KB

      Download

    • memory/1296-26-0x0000000006D90000-0x0000000006E2C000-memory.dmp

      Filesize

      624KB

      Download

    • memory/1296-41-0x0000000005500000-0x0000000005510000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3064-9-0x00000000739E0000-0x00000000740CE000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/3064-0-0x00000000003F0000-0x0000000000402000-memory.dmp

      Filesize

      72KB

      Download

    • memory/3064-1-0x00000000739E0000-0x00000000740CE000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/3568-55-0x0000018407130000-0x0000018407150000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3568-58-0x00000184072B0000-0x00000184072D0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4112-46-0x0000000002650000-0x0000000002651000-memory.dmp

      Filesize

      4KB

      Download