Analysis
-
max time kernel
308s -
max time network
302s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2024 04:13
Behavioral task
behavioral1
Sample
XenoLauncher.exe
Resource
win7-20240215-en
General
-
Target
XenoLauncher.exe
-
Size
45KB
-
MD5
2d24883f3fb3ff9ea58f372da291070a
-
SHA1
d2fdd563387cfaaabaa681297a49f26a7ce43d0f
-
SHA256
8fd932b34f74af94e07d3b2ed14b8a3630a30f3c19ebe987fead0e63ae2a4a9b
-
SHA512
6ee0cbe3da9d2d88ce3269c56009217408ea6e73641f4b691b17a2903a2532347ce3666439ece77f7d868d3daa5028133dfd27f4a4beb6024e97e5ac5c32279e
-
SSDEEP
768:SdhO/poiiUcjlJIn/sWH9Xqk5nWEZ5SbTDauuI7CPW5h:0w+jjgnPH9XqcnW85SbTDuIp
Malware Config
Extracted
xenorat
127.0.0.1
XenoLauncher
-
delay
5000
-
install_path
temp
-
port
4444
-
startup_name
Discord
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation XenoLauncher.exe -
Executes dropped EXE 1 IoCs
pid Process 1940 XenoLauncher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4548 schtasks.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4752 wrote to memory of 1940 4752 XenoLauncher.exe 91 PID 4752 wrote to memory of 1940 4752 XenoLauncher.exe 91 PID 4752 wrote to memory of 1940 4752 XenoLauncher.exe 91 PID 1940 wrote to memory of 4548 1940 XenoLauncher.exe 95 PID 1940 wrote to memory of 4548 1940 XenoLauncher.exe 95 PID 1940 wrote to memory of 4548 1940 XenoLauncher.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\XenoLauncher.exe"C:\Users\Admin\AppData\Local\Temp\XenoLauncher.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\XenoManager\XenoLauncher.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\XenoLauncher.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "Discord" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4188.tmp" /F3⤵
- Creates scheduled task(s)
PID:4548
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
Filesize
45KB
MD52d24883f3fb3ff9ea58f372da291070a
SHA1d2fdd563387cfaaabaa681297a49f26a7ce43d0f
SHA2568fd932b34f74af94e07d3b2ed14b8a3630a30f3c19ebe987fead0e63ae2a4a9b
SHA5126ee0cbe3da9d2d88ce3269c56009217408ea6e73641f4b691b17a2903a2532347ce3666439ece77f7d868d3daa5028133dfd27f4a4beb6024e97e5ac5c32279e
-
Filesize
1KB
MD5c1ca01e27b201d9e2dcfd94089f30279
SHA1b005c1d1a2110c55cd16379d745fde185f1e7d00
SHA256f4a3cb5790a61b097587c918b376a82bc7e9b393079e1663ed8a7aa43a71e4a0
SHA51236339257ac0c937eac75ff8f0037821ea633ac9eca52f01d9e14f5afe7592ee0c98b34950c87d13442c3dfdf0ef477103930b27a1f95254fd921ac389d0c9c8a