Overview

overview

10

Static

static

3

a340745a55...90.exe

windows7-x64

10

a340745a55...90.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    09-05-2024 10:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a340745a55997188efd34c9d83c186de3b899c3b98d05982f327f142deafe790.exe

  • Size

    180KB

  • MD5

    a5825c821946808fb1f3b22645fbfd9d

  • SHA1

    d0906a55b742bd11e29c2bf6a87dfe3a6dbd547e

  • SHA256

    a340745a55997188efd34c9d83c186de3b899c3b98d05982f327f142deafe790

  • SHA512

    a377a82e2f14909f69958874fd62eec318fd67e266415aa8b6a088c230e7d3fa1833cb8d94dcf660a7c5d6e60817369d10a5694f4577f65b30315a9f91f93043

  • SSDEEP

    3072:+h9LvhVRMQ8at9vMJdr5QckDMV3HycZg8dZuFyjwUZpVTdlRI:tFaj8mMxHy9yQyjwUZpVTdLI

Score
10/10
xenoratrattrojan

Malware Config

Extracted

Family

xenorat

C2

dns.requimacofradian.site

Mutex

Xeno_rat_nd8828g

Attributes
  • delay

    60000

  • install_path

    appdata

  • port

    1253

  • startup_name

    dic

Signatures

  • Detects XenoRAT malware 3 IoCs

    XenoRAT is an open-source remote access tool (RAT) developed in C#.

    rat
  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a340745a55997188efd34c9d83c186de3b899c3b98d05982f327f142deafe790.exe
    "C:\Users\Admin\AppData\Local\Temp\a340745a55997188efd34c9d83c186de3b899c3b98d05982f327f142deafe790.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2220
    • C:\Users\Admin\AppData\Local\Temp\a340745a55997188efd34c9d83c186de3b899c3b98d05982f327f142deafe790.exe
      C:\Users\Admin\AppData\Local\Temp\a340745a55997188efd34c9d83c186de3b899c3b98d05982f327f142deafe790.exe
      2⤵
        PID:2916
      • C:\Users\Admin\AppData\Local\Temp\a340745a55997188efd34c9d83c186de3b899c3b98d05982f327f142deafe790.exe
        C:\Users\Admin\AppData\Local\Temp\a340745a55997188efd34c9d83c186de3b899c3b98d05982f327f142deafe790.exe
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2568
        • C:\Users\Admin\AppData\Roaming\XenoManager\a340745a55997188efd34c9d83c186de3b899c3b98d05982f327f142deafe790.exe
          "C:\Users\Admin\AppData\Roaming\XenoManager\a340745a55997188efd34c9d83c186de3b899c3b98d05982f327f142deafe790.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2544
          • C:\Users\Admin\AppData\Roaming\XenoManager\a340745a55997188efd34c9d83c186de3b899c3b98d05982f327f142deafe790.exe
            C:\Users\Admin\AppData\Roaming\XenoManager\a340745a55997188efd34c9d83c186de3b899c3b98d05982f327f142deafe790.exe
            4⤵
            • Executes dropped EXE
            PID:2396
          • C:\Users\Admin\AppData\Roaming\XenoManager\a340745a55997188efd34c9d83c186de3b899c3b98d05982f327f142deafe790.exe
            C:\Users\Admin\AppData\Roaming\XenoManager\a340745a55997188efd34c9d83c186de3b899c3b98d05982f327f142deafe790.exe
            4⤵
            • Executes dropped EXE
            PID:2820
          • C:\Users\Admin\AppData\Roaming\XenoManager\a340745a55997188efd34c9d83c186de3b899c3b98d05982f327f142deafe790.exe
            C:\Users\Admin\AppData\Roaming\XenoManager\a340745a55997188efd34c9d83c186de3b899c3b98d05982f327f142deafe790.exe
            4⤵
            • Executes dropped EXE
            PID:2428
      • C:\Users\Admin\AppData\Local\Temp\a340745a55997188efd34c9d83c186de3b899c3b98d05982f327f142deafe790.exe
        C:\Users\Admin\AppData\Local\Temp\a340745a55997188efd34c9d83c186de3b899c3b98d05982f327f142deafe790.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2572
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks.exe" /Create /TN "dic" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF75A.tmp" /F
          3⤵
          • Creates scheduled task(s)
          PID:1268

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Scheduled Task/Job

    1
    T1053

    Persistence

    Scheduled Task/Job

    1
    T1053

    Privilege Escalation

    Scheduled Task/Job

    1
    T1053

    Defense Evasion

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpF75A.tmp
      Filesize

      1KB

      MD5

      dbcc5039698bfa08a8a4793f53768400

      SHA1

      6f66282f3022f8c96393f7aaa334fd1ff398302d

      SHA256

      06e2717d069b14083b3bb13a37ff31a1db65898882797ff1f0e2b11b189c150e

      SHA512

      b2f28481c8e6a2f09eb2888f41361d1a49165346e99d3df2f45798f15080a58bbe7b26499c30eae623d8f7e48392cfe35a4ad04bc62d7d4b7fe6ee96f9f3ebff

      Download Submit
    • \Users\Admin\AppData\Roaming\XenoManager\a340745a55997188efd34c9d83c186de3b899c3b98d05982f327f142deafe790.exe
      Filesize

      180KB

      MD5

      a5825c821946808fb1f3b22645fbfd9d

      SHA1

      d0906a55b742bd11e29c2bf6a87dfe3a6dbd547e

      SHA256

      a340745a55997188efd34c9d83c186de3b899c3b98d05982f327f142deafe790

      SHA512

      a377a82e2f14909f69958874fd62eec318fd67e266415aa8b6a088c230e7d3fa1833cb8d94dcf660a7c5d6e60817369d10a5694f4577f65b30315a9f91f93043

      Download Submit
    • memory/2220-1-0x0000000000E00000-0x0000000000E36000-memory.dmp
      Filesize

      216KB

      Download
    • memory/2220-2-0x0000000000210000-0x0000000000234000-memory.dmp
      Filesize

      144KB

      Download
    • memory/2220-3-0x0000000074960000-0x000000007504E000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/2220-0-0x000000007496E000-0x000000007496F000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2220-22-0x0000000074960000-0x000000007504E000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/2544-31-0x0000000000980000-0x00000000009B6000-memory.dmp
      Filesize

      216KB

      Download
    • memory/2568-23-0x0000000074960000-0x000000007504E000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/2568-32-0x0000000074960000-0x000000007504E000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/2916-10-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

      Download
    • memory/2916-24-0x0000000074960000-0x000000007504E000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/2916-21-0x0000000074960000-0x000000007504E000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/2916-6-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

      Download
    • memory/2916-4-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

      Download