xenorat | e62a6f77fab09529a64f2e5f356c514217ea88ec2dcacf8ad037ac7fc2fddea5

General

Target

ASDASD.exe
Size

45KB
MD5

748bfff2a909d92412d8400e7a86dbda
SHA1

77bdcf2b5232b3c3eb0b6d2525d6f140cd0a92b1
SHA256

e62a6f77fab09529a64f2e5f356c514217ea88ec2dcacf8ad037ac7fc2fddea5
SHA512

1b19d3e50ce090d7f181d74ccf94b8444f7bee76669dc199389a2a0ec46a9ca09f9884b466cb62d3dc75cdb07d47005ad724005b4f4b2fabd5a8998d543a663d
SSDEEP

768:VdhO/poiiUcjlJInhwH9Xqk5nWEZ5SbTDaDWI7CPW5m:rw+jjgnqH9XqcnW85SbTSWIu

Score

10^/10

xenorat rat spyware stealer trojan

Malware Config

Extracted

Family

xenorat

C2

choice-certainly.gl.at.ply.gg

Mutex

xeno_42344554563443

Attributes

delay
5000
install_path
appdata
port
24253
startup_name
system

Signatures

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

ASDASD.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation ASDASD.exe
Executes dropped EXE 1 IoCs

Processes:

ASDASD.exe

pid process

4180 ASDASD.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

3940 schtasks.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	ASDASD.exe

pid	process
3940	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ASDASD.exe

pid	process
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe
4180	ASDASD.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ASDASD.exe

description pid process

Token: SeDebugPrivilege 4180 ASDASD.exe

description	pid	process
Token: SeDebugPrivilege	4180	ASDASD.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

ASDASD.exeASDASD.exe

description	pid	process	target process
PID 4904 wrote to memory of 4180	4904	ASDASD.exe	ASDASD.exe
PID 4904 wrote to memory of 4180	4904	ASDASD.exe	ASDASD.exe
PID 4904 wrote to memory of 4180	4904	ASDASD.exe	ASDASD.exe
PID 4180 wrote to memory of 3940	4180	ASDASD.exe	schtasks.exe
PID 4180 wrote to memory of 3940	4180	ASDASD.exe	schtasks.exe
PID 4180 wrote to memory of 3940	4180	ASDASD.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\ASDASD.exe
"C:\Users\Admin\AppData\Local\Temp\ASDASD.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4904

C:\Users\Admin\AppData\Roaming\XenoManager\ASDASD.exe
"C:\Users\Admin\AppData\Roaming\XenoManager\ASDASD.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4180

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /Create /TN "system" /XML "C:\Users\Admin\AppData\Local\Temp\tmp48D0.tmp" /F
3⤵
- Creates scheduled task(s)
PID:3940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ASDASD.exe.log
Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp48D0.tmp
Filesize
1KB

MD5
ffe469e0dcbd6034267652c079e9f6e5

SHA1
6d75ff1e2a8c84c5e2dfed54b25ed4b724d527a2

SHA256
497e61ebdb3b43b5b52d005fe3d98dd31860cd9dcfb731608a6eb4c84d1cf8fa

SHA512
e94455c5c5bc869d1e90c5c145bb33f48fdbda9a9448dfc95c719f9fbb60fdd0509fbc3f5ffda3926c9c35145c9f4218a545649e1f4bfcf5829f6a708f4922ba

Download Submit
C:\Users\Admin\AppData\Roaming\XenoManager\ASDASD.exe
Filesize
45KB

MD5
748bfff2a909d92412d8400e7a86dbda

SHA1
77bdcf2b5232b3c3eb0b6d2525d6f140cd0a92b1

SHA256
e62a6f77fab09529a64f2e5f356c514217ea88ec2dcacf8ad037ac7fc2fddea5

SHA512
1b19d3e50ce090d7f181d74ccf94b8444f7bee76669dc199389a2a0ec46a9ca09f9884b466cb62d3dc75cdb07d47005ad724005b4f4b2fabd5a8998d543a663d

Download Submit
memory/4180-24-0x0000000005B10000-0x0000000005B60000-memory.dmp

Filesize
320KB

Download
memory/4180-25-0x0000000005BE0000-0x0000000005C56000-memory.dmp

Filesize
472KB

Download
memory/4180-16-0x0000000074630000-0x0000000074DE0000-memory.dmp

Filesize
7.7MB

Download
memory/4180-17-0x0000000004B60000-0x0000000004B70000-memory.dmp

Filesize
64KB

Download
memory/4180-56-0x0000000004B60000-0x0000000004B70000-memory.dmp

Filesize
64KB

Download
memory/4180-20-0x00000000055D0000-0x0000000005636000-memory.dmp

Filesize
408KB

Download
memory/4180-21-0x00000000059C0000-0x0000000005ABA000-memory.dmp

Filesize
1000KB

Download
memory/4180-22-0x0000000074630000-0x0000000074DE0000-memory.dmp

Filesize
7.7MB

Download
memory/4180-23-0x0000000005C90000-0x0000000005E52000-memory.dmp

Filesize
1.8MB

Download
memory/4180-29-0x0000000006050000-0x00000000060EC000-memory.dmp

Filesize
624KB

Download
memory/4180-27-0x0000000005F90000-0x0000000005FAE000-memory.dmp

Filesize
120KB

Download
memory/4180-26-0x0000000006390000-0x00000000068BC000-memory.dmp

Filesize
5.2MB

Download
memory/4904-15-0x0000000074630000-0x0000000074DE0000-memory.dmp

Filesize
7.7MB

Download
memory/4904-0-0x00000000002F0000-0x0000000000302000-memory.dmp

Filesize
72KB

Download
memory/4904-1-0x0000000074630000-0x0000000074DE0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads