Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
17-04-2024 11:35
General
-
Target
a2eea60f1991928460eca53fb86f127b.exe
-
Size
45KB
-
MD5
a2eea60f1991928460eca53fb86f127b
-
SHA1
b5d31c9b199a9754a3ee7d7b9d35f8a98ed3b340
-
SHA256
373c2274f9add075ba56475a4ac45a313b118fbf88c2025923870c25e794a1a7
-
SHA512
7e3f2551fa8aebb04ad811613b934af4c930e79b1f743d8ddf0bc6cf92c9fb23f6500e38b315fe7bd59bc582de3c759f7016f51d03aa5fc826eba0c515125876
-
SSDEEP
768:fdhO/poiiUcjlJIni2gH9Xqk5nWEZ5SbTDajuI7CPW5G:Vw+jjgniLH9XqcnW85SbTuuIe
Malware Config
Extracted
xenorat
dentiste.ddns.net
Xeno_syteme_update
-
delay
5000
-
install_path
appdata
-
port
7011
-
startup_name
System
Signatures
-
XenorRat
XenorRat is a remote access trojan written in C#.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2eea60f1991928460eca53fb86f127b.exe"C:\Users\Admin\AppData\Local\Temp\a2eea60f1991928460eca53fb86f127b.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XenoManager\a2eea60f1991928460eca53fb86f127b.exe"C:\Users\Admin\AppData\Roaming\XenoManager\a2eea60f1991928460eca53fb86f127b.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "System" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3E12.tmp" /F3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD528342a2224e800046d67455643ad1e2d
SHA1a908b1bcc7c6b6d940aa33fe97f16e034160f19d
SHA2565b3c5f1a318e469b6cb0bd8b14aa9a10e5774340554bd308f9ecc52d0faddd28
SHA512261c4780e687838b99fd646a45e08facb1f40bb760d162fd815cf13b6389daa33d20482ae5c9a7d032aae5db5a369242d20b8e763fb8fe31a580e61d2df0effc
-
Filesize
45KB
MD5a2eea60f1991928460eca53fb86f127b
SHA1b5d31c9b199a9754a3ee7d7b9d35f8a98ed3b340
SHA256373c2274f9add075ba56475a4ac45a313b118fbf88c2025923870c25e794a1a7
SHA5127e3f2551fa8aebb04ad811613b934af4c930e79b1f743d8ddf0bc6cf92c9fb23f6500e38b315fe7bd59bc582de3c759f7016f51d03aa5fc826eba0c515125876
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
48KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
624KB
-
Filesize
1000KB
-
Filesize
1.8MB
-
Filesize
320KB
-
Filesize
472KB
-
Filesize
5.2MB
-
Filesize
120KB
-
Filesize
7.7MB
-
Filesize
72KB
-
Filesize
7.7MB