Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-05-2024 02:34

General

  • Target

    9c5864e5d700ac53ebd61bd2494d93f9b43e5f74275a7204ff6d04adabcc397d.exe

  • Size

    242KB

  • MD5

    88569a0094dafd1c5d804534cc6afde4

  • SHA1

    ccf747db107b4e3a6aae1fb202b2aed36eba8bf4

  • SHA256

    9c5864e5d700ac53ebd61bd2494d93f9b43e5f74275a7204ff6d04adabcc397d

  • SHA512

    73901b82c35d86cd547dcd7f378d914dcbdfe67b5d8691527e77dfcf9c42fc0b384e6ec527555a98de7e397904923b95ae0d5a48737f6570e6d77bf82baf4352

  • SSDEEP

    6144:yEbA05j2yCleJJ2qnqnCQlTDSxL1wy1r41XaulCQGZMlIvBIEPYr+A29F4I:yEbA05jKmJ2qwkL1N1CnlnlIvBIEPYrU

Score
10/10

Malware Config

Extracted

Family

xenorat

C2

dns.requimacofradian.site

Mutex

Xeno_rat_nd8818g

Attributes
  • delay

    60000

  • install_path

    appdata

  • port

    1243

  • startup_name

    uic

Signatures

  • XenorRat

    XenorRat is a remote access trojan written in C#.

  • Detects executables packed with ConfuserEx Mod 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9c5864e5d700ac53ebd61bd2494d93f9b43e5f74275a7204ff6d04adabcc397d.exe
    "C:\Users\Admin\AppData\Local\Temp\9c5864e5d700ac53ebd61bd2494d93f9b43e5f74275a7204ff6d04adabcc397d.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3004
    • C:\Users\Admin\AppData\Local\Temp\9c5864e5d700ac53ebd61bd2494d93f9b43e5f74275a7204ff6d04adabcc397d.exe
      C:\Users\Admin\AppData\Local\Temp\9c5864e5d700ac53ebd61bd2494d93f9b43e5f74275a7204ff6d04adabcc397d.exe
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:1172
      • C:\Users\Admin\AppData\Roaming\XenoManager\9c5864e5d700ac53ebd61bd2494d93f9b43e5f74275a7204ff6d04adabcc397d.exe
        "C:\Users\Admin\AppData\Roaming\XenoManager\9c5864e5d700ac53ebd61bd2494d93f9b43e5f74275a7204ff6d04adabcc397d.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1752
        • C:\Users\Admin\AppData\Roaming\XenoManager\9c5864e5d700ac53ebd61bd2494d93f9b43e5f74275a7204ff6d04adabcc397d.exe
          C:\Users\Admin\AppData\Roaming\XenoManager\9c5864e5d700ac53ebd61bd2494d93f9b43e5f74275a7204ff6d04adabcc397d.exe
          4⤵
          • Executes dropped EXE
          PID:1500
        • C:\Users\Admin\AppData\Roaming\XenoManager\9c5864e5d700ac53ebd61bd2494d93f9b43e5f74275a7204ff6d04adabcc397d.exe
          C:\Users\Admin\AppData\Roaming\XenoManager\9c5864e5d700ac53ebd61bd2494d93f9b43e5f74275a7204ff6d04adabcc397d.exe
          4⤵
          • Executes dropped EXE
          PID:4524
        • C:\Users\Admin\AppData\Roaming\XenoManager\9c5864e5d700ac53ebd61bd2494d93f9b43e5f74275a7204ff6d04adabcc397d.exe
          C:\Users\Admin\AppData\Roaming\XenoManager\9c5864e5d700ac53ebd61bd2494d93f9b43e5f74275a7204ff6d04adabcc397d.exe
          4⤵
          • Executes dropped EXE
          PID:4272
    • C:\Users\Admin\AppData\Local\Temp\9c5864e5d700ac53ebd61bd2494d93f9b43e5f74275a7204ff6d04adabcc397d.exe
      C:\Users\Admin\AppData\Local\Temp\9c5864e5d700ac53ebd61bd2494d93f9b43e5f74275a7204ff6d04adabcc397d.exe
      2⤵
        PID:4128
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4128 -s 80
          3⤵
          • Program crash
          PID:3184
      • C:\Users\Admin\AppData\Local\Temp\9c5864e5d700ac53ebd61bd2494d93f9b43e5f74275a7204ff6d04adabcc397d.exe
        C:\Users\Admin\AppData\Local\Temp\9c5864e5d700ac53ebd61bd2494d93f9b43e5f74275a7204ff6d04adabcc397d.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4156
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks.exe" /Create /TN "uic" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1BE0.tmp" /F
          3⤵
          • Creates scheduled task(s)
          PID:2212
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4128 -ip 4128
      1⤵
        PID:384

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\9c5864e5d700ac53ebd61bd2494d93f9b43e5f74275a7204ff6d04adabcc397d.exe.log

        Filesize

        706B

        MD5

        d95c58e609838928f0f49837cab7dfd2

        SHA1

        55e7139a1e3899195b92ed8771d1ca2c7d53c916

        SHA256

        0407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339

        SHA512

        405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d

      • C:\Users\Admin\AppData\Local\Temp\tmp1BE0.tmp

        Filesize

        1KB

        MD5

        720de0477b5db121434eae6e4fd59db9

        SHA1

        1600d9be53aa75e06d161fe3b77fb5ca8d233dc1

        SHA256

        6f8cde970e52cc31789d75112a174b48d5c52fdfebd74cb787efef41550e9017

        SHA512

        38b1f7e363185dc81e5554421f4ac48efef22c57c0701a93f8e0b3b53ef75bb5a0145e30c34f86e8b4a61c14d74b2398f44c97045820bdb5b1c6c514cb0e6432

      • C:\Users\Admin\AppData\Roaming\XenoManager\9c5864e5d700ac53ebd61bd2494d93f9b43e5f74275a7204ff6d04adabcc397d.exe

        Filesize

        242KB

        MD5

        88569a0094dafd1c5d804534cc6afde4

        SHA1

        ccf747db107b4e3a6aae1fb202b2aed36eba8bf4

        SHA256

        9c5864e5d700ac53ebd61bd2494d93f9b43e5f74275a7204ff6d04adabcc397d

        SHA512

        73901b82c35d86cd547dcd7f378d914dcbdfe67b5d8691527e77dfcf9c42fc0b384e6ec527555a98de7e397904923b95ae0d5a48737f6570e6d77bf82baf4352

      • memory/1172-9-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

      • memory/1172-29-0x00000000751B0000-0x0000000075960000-memory.dmp

        Filesize

        7.7MB

      • memory/1172-15-0x00000000751B0000-0x0000000075960000-memory.dmp

        Filesize

        7.7MB

      • memory/1752-37-0x00000000751B0000-0x0000000075960000-memory.dmp

        Filesize

        7.7MB

      • memory/1752-30-0x00000000751B0000-0x0000000075960000-memory.dmp

        Filesize

        7.7MB

      • memory/3004-4-0x00000000751B0000-0x0000000075960000-memory.dmp

        Filesize

        7.7MB

      • memory/3004-8-0x0000000000EA0000-0x0000000000EA6000-memory.dmp

        Filesize

        24KB

      • memory/3004-0-0x00000000751BE000-0x00000000751BF000-memory.dmp

        Filesize

        4KB

      • memory/3004-7-0x000000000DC50000-0x000000000DCE2000-memory.dmp

        Filesize

        584KB

      • memory/3004-6-0x000000000E160000-0x000000000E704000-memory.dmp

        Filesize

        5.6MB

      • memory/3004-5-0x000000000DB10000-0x000000000DBAC000-memory.dmp

        Filesize

        624KB

      • memory/3004-17-0x00000000751B0000-0x0000000075960000-memory.dmp

        Filesize

        7.7MB

      • memory/3004-3-0x000000000DA30000-0x000000000DA70000-memory.dmp

        Filesize

        256KB

      • memory/3004-2-0x0000000002A20000-0x0000000002A26000-memory.dmp

        Filesize

        24KB

      • memory/3004-1-0x0000000000630000-0x0000000000676000-memory.dmp

        Filesize

        280KB

      • memory/4128-10-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

      • memory/4156-18-0x00000000751B0000-0x0000000075960000-memory.dmp

        Filesize

        7.7MB

      • memory/4156-38-0x00000000751B0000-0x0000000075960000-memory.dmp

        Filesize

        7.7MB

      • memory/4156-16-0x00000000751B0000-0x0000000075960000-memory.dmp

        Filesize

        7.7MB