Overview

overview

10

Static

static

10

RegistryHelper.exe

windows10-1703-x64

RegistryHelper.exe

windows10-2004-x64

Analysis

  • max time kernel
    227s
  • max time network
    229s
  • platform
    windows10-1703_x64
  • resource
    win10-20240214-en
  • resource tags

    arch:x64arch:x86image:win10-20240214-enlocale:en-usos:windows10-1703-x64system
  • submitted
    02-04-2024 13:47

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    RegistryHelper.exe

  • Size

    46KB

  • MD5

    d7916e968a167b3054cb3078debb1fc4

  • SHA1

    35b69b95699451453715b8f6963b18c5909ee665

  • SHA256

    8fc30212418d834f5072dea6843fac92a080d10c33fc2a108bdc0d1183dc3c90

  • SHA512

    3a9bb21e887cc2a0d5d7ebd04698287100d66173cbe199537a2bc47a6f632da6e5f1db9f95597bb68836614d435da100f7196edc435eb2d97a04187d8bbc4487

  • SSDEEP

    768:fdhO/poiiUcjlJIn3sPH9Xqk5nWEZ5SbTDanuI7CPW5S:Vw+jjgn8PH9XqcnW85SbT6uIa

Score
10/10
xenoratpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

xenorat

C2

3.66.38.117

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    5000

  • install_path

    appdata

  • port

    11671

  • startup_name

    Microsoft Windows Core Process

Signatures

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of FindShellTrayWindow 39 IoCs
  • Suspicious use of SendNotifyMessage 26 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\RegistryHelper.exe
    "C:\Users\Admin\AppData\Local\Temp\RegistryHelper.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4148
    • C:\Users\Admin\AppData\Roaming\XenoManager\RegistryHelper.exe
      "C:\Users\Admin\AppData\Roaming\XenoManager\RegistryHelper.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1140
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks.exe" /Create /TN "Microsoft Windows Core Process" /XML "C:\Users\Admin\AppData\Local\Temp\tmp902A.tmp" /F
        3⤵
        • Creates scheduled task(s)
        PID:5040
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe
        3⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:5088
        • C:\Windows\system32\ctfmon.exe
          ctfmon.exe
          4⤵
            PID:2108
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:6556
        • C:\Windows\SysWOW64\shutdown.exe
          "C:\Windows\System32\shutdown.exe" /s /t 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:6848
    • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
      1⤵
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2276
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x0 /state0:0xa3afc055 /state1:0x41c64e6d
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:6928

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegistryHelper.exe.log
      Filesize

      226B

      MD5

      957779c42144282d8cd83192b8fbc7cf

      SHA1

      de83d08d2cca06b9ff3d1ef239d6b60b705d25fe

      SHA256

      0d7ca7ba65e2b465e4878e324ceab8f8981f5ec06dcf5bc32559a4467a9c7d51

      SHA512

      f1549c61b4f2906d13b2aabb74772c2bc826cd42373d7bb6c48cbb125d5aa2ec17617e6b5e67e8aae3bb5790cc831cdba48a45008ed01df4fba8be448cce39fd

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_arpxyftn.rda.ps1
      Filesize

      1B

      MD5

      c4ca4238a0b923820dcc509a6f75849b

      SHA1

      356a192b7913b04c54574d18c28d46e6395428ab

      SHA256

      6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

      SHA512

      4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\em3c0lh0.iek
      Filesize

      148KB

      MD5

      90a1d4b55edf36fa8b4cc6974ed7d4c4

      SHA1

      aba1b8d0e05421e7df5982899f626211c3c4b5c1

      SHA256

      7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

      SHA512

      ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\tmp902A.tmp
      Filesize

      1KB

      MD5

      e3514ad7e570cfe068b7d975b605024a

      SHA1

      7ca2cd816e5c5a41307e93b7b5b4b6c38573a71e

      SHA256

      811daca0de2ee20be21c89bfca253565d81e5fc8234eaef6fee4e161674eef96

      SHA512

      0e49bd0939affae0a2a08998271deeedabe652e898421775feb59d911a8bf259ff498e5543085ec87574de46e74132a65a4d04889cae8f36fe4fd0660d2e7e99

      Download Submit

    • C:\Users\Admin\AppData\Roaming\XenoManager\RegistryHelper.exe
      Filesize

      46KB

      MD5

      d7916e968a167b3054cb3078debb1fc4

      SHA1

      35b69b95699451453715b8f6963b18c5909ee665

      SHA256

      8fc30212418d834f5072dea6843fac92a080d10c33fc2a108bdc0d1183dc3c90

      SHA512

      3a9bb21e887cc2a0d5d7ebd04698287100d66173cbe199537a2bc47a6f632da6e5f1db9f95597bb68836614d435da100f7196edc435eb2d97a04187d8bbc4487

      Download Submit

    • memory/1140-45-0x0000000005210000-0x0000000005220000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1140-14-0x0000000005CD0000-0x0000000005D36000-memory.dmp

      Filesize

      408KB

      Download

    • memory/1140-10-0x0000000073D80000-0x000000007446E000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/1140-186-0x0000000073D80000-0x000000007446E000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/1140-15-0x00000000061C0000-0x00000000062BA000-memory.dmp

      Filesize

      1000KB

      Download

    • memory/1140-16-0x0000000006490000-0x0000000006652000-memory.dmp

      Filesize

      1.8MB

      Download

    • memory/1140-17-0x0000000006320000-0x0000000006370000-memory.dmp

      Filesize

      320KB

      Download

    • memory/1140-18-0x00000000063F0000-0x0000000006466000-memory.dmp

      Filesize

      472KB

      Download

    • memory/1140-19-0x0000000006B90000-0x00000000070BC000-memory.dmp

      Filesize

      5.2MB

      Download

    • memory/1140-20-0x00000000058E0000-0x00000000058FE000-memory.dmp

      Filesize

      120KB

      Download

    • memory/1140-185-0x0000000005100000-0x0000000005108000-memory.dmp

      Filesize

      32KB

      Download

    • memory/1140-37-0x0000000073D80000-0x000000007446E000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/1140-168-0x00000000059E0000-0x00000000059EA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/1140-39-0x0000000005860000-0x000000000586A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/1140-40-0x0000000007880000-0x0000000007D7E000-memory.dmp

      Filesize

      5.0MB

      Download

    • memory/1140-41-0x00000000067A0000-0x0000000006832000-memory.dmp

      Filesize

      584KB

      Download

    • memory/1140-42-0x0000000001150000-0x000000000115A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/1140-43-0x00000000011A0000-0x00000000011AA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/1140-44-0x0000000000BB0000-0x0000000000BC2000-memory.dmp

      Filesize

      72KB

      Download

    • memory/1140-163-0x0000000001140000-0x0000000001152000-memory.dmp

      Filesize

      72KB

      Download

    • memory/1140-22-0x00000000068C0000-0x000000000695C000-memory.dmp

      Filesize

      624KB

      Download

    • memory/1140-11-0x0000000005210000-0x0000000005220000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1140-38-0x0000000005210000-0x0000000005220000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1140-101-0x0000000005210000-0x0000000005220000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2276-53-0x00000224F4AE0000-0x00000224F4B00000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2276-55-0x00000224F4F10000-0x00000224F4F30000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4148-0-0x0000000000060000-0x0000000000072000-memory.dmp

      Filesize

      72KB

      Download

    • memory/4148-9-0x0000000073D80000-0x000000007446E000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/4148-1-0x0000000073D80000-0x000000007446E000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/5088-47-0x0000000001000000-0x0000000001001000-memory.dmp

      Filesize

      4KB

      Download

    • memory/6556-107-0x0000000006800000-0x0000000006810000-memory.dmp

      Filesize

      64KB

      Download

    • memory/6556-167-0x0000000073D80000-0x000000007446E000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/6556-112-0x0000000007CB0000-0x0000000007CCC000-memory.dmp

      Filesize

      112KB

      Download

    • memory/6556-106-0x0000000006810000-0x0000000006846000-memory.dmp

      Filesize

      216KB

      Download

    • memory/6556-103-0x0000000073D80000-0x000000007446E000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/6556-105-0x0000000006800000-0x0000000006810000-memory.dmp

      Filesize

      64KB

      Download

    • memory/6556-110-0x0000000007700000-0x0000000007766000-memory.dmp

      Filesize

      408KB

      Download

    • memory/6556-111-0x0000000007940000-0x0000000007C90000-memory.dmp

      Filesize

      3.3MB

      Download

    • memory/6556-109-0x0000000007560000-0x0000000007582000-memory.dmp

      Filesize

      136KB

      Download

    • memory/6556-169-0x0000000006800000-0x0000000006810000-memory.dmp

      Filesize

      64KB

      Download

    • memory/6556-108-0x0000000006E80000-0x00000000074A8000-memory.dmp

      Filesize

      6.2MB

      Download

    • memory/6556-132-0x0000000008250000-0x000000000828C000-memory.dmp

      Filesize

      240KB

      Download

    • memory/6556-113-0x0000000007CF0000-0x0000000007D3B000-memory.dmp

      Filesize

      300KB

      Download

    • memory/6556-187-0x0000000073D80000-0x000000007446E000-memory.dmp

      Filesize

      6.9MB

      Download