xenorat | 12cc22d6b7041f8698d8000327c170aba486bd4aee9ef31f204a379ec7968fa5

Analysis

max time kernel
7s
max time network
8s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LunarRO_EXEC.exe
Size

96KB
MD5

750660c4115082f310530b6edaee6646
SHA1

fcb00e8256e7978e4e4690cd8e44fec66c423f2a
SHA256

12cc22d6b7041f8698d8000327c170aba486bd4aee9ef31f204a379ec7968fa5
SHA512

e5ce9e3b97624474a58cc0f47e414516479f936c45873aadb38bf23a3d0576a2590d9e1b17f248c5423bb661f48b7bb3210f545a982d3fc8575c7001e63c1ddd
SSDEEP

1536:Ww+jjgneye9H9XqcnW85SbTPWI3ehk/oA2MLc4bJnIkX8xOFZU3p2Nn0:Ww+jqeyeF91UbTP8VEc4CksyZU3gNn0

Score

10^/10

xenorat rat trojan

Malware Config

Extracted

Family

xenorat

127.0.0.1

Mutex

LunarRO_EXEC

Attributes

delay
5000
install_path
temp
port
4444
startup_name
Microsoft File Updater

Signatures

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

LunarRO_EXEC.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	LunarRO_EXEC.exe

Executes dropped EXE 1 IoCs

Processes:

LunarRO_EXEC.exe

pid process

1172 LunarRO_EXEC.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4000 schtasks.exe

pid	process
1172	LunarRO_EXEC.exe

pid	process
4000	schtasks.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

LunarRO_EXEC.exeLunarRO_EXEC.exe

description	pid	process	target process
PID 4724 wrote to memory of 1172	4724	LunarRO_EXEC.exe	LunarRO_EXEC.exe
PID 4724 wrote to memory of 1172	4724	LunarRO_EXEC.exe	LunarRO_EXEC.exe
PID 4724 wrote to memory of 1172	4724	LunarRO_EXEC.exe	LunarRO_EXEC.exe
PID 1172 wrote to memory of 4000	1172	LunarRO_EXEC.exe	schtasks.exe
PID 1172 wrote to memory of 4000	1172	LunarRO_EXEC.exe	schtasks.exe
PID 1172 wrote to memory of 4000	1172	LunarRO_EXEC.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\LunarRO_EXEC.exe
"C:\Users\Admin\AppData\Local\Temp\LunarRO_EXEC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4724

C:\Users\Admin\AppData\Local\Temp\XenoManager\LunarRO_EXEC.exe
"C:\Users\Admin\AppData\Local\Temp\XenoManager\LunarRO_EXEC.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /Create /TN "Microsoft File Updater" /XML "C:\Users\Admin\AppData\Local\Temp\tmp496D.tmp" /F
3⤵
- Creates scheduled task(s)
PID:4000

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LunarRO_EXEC.exe.log
Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\XenoManager\LunarRO_EXEC.exe
Filesize
96KB

MD5
750660c4115082f310530b6edaee6646

SHA1
fcb00e8256e7978e4e4690cd8e44fec66c423f2a

SHA256
12cc22d6b7041f8698d8000327c170aba486bd4aee9ef31f204a379ec7968fa5

SHA512
e5ce9e3b97624474a58cc0f47e414516479f936c45873aadb38bf23a3d0576a2590d9e1b17f248c5423bb661f48b7bb3210f545a982d3fc8575c7001e63c1ddd

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp496D.tmp
Filesize
1KB

MD5
5089cf2f2020fd2545bbe7561a871ee1

SHA1
048ccf1a4150c8f4bb95dbcdc9e8347aa6136396

SHA256
cebac238982b612ee1d0c8c3a036e8fff9c4ecf07c71a9f089afca37294d482b

SHA512
661d00349fd5b3116a0ecd2c01fa76236919a55019c7110782c58a1d57f6706974b14b8511a6ace9af24203472e0918a41c6b214abb37ba7e46cfc86d59f2856

Download Submit
memory/1172-15-0x0000000074880000-0x0000000075030000-memory.dmp

Filesize
7.7MB

Download
memory/1172-16-0x0000000074880000-0x0000000075030000-memory.dmp

Filesize
7.7MB

Download
memory/4724-0-0x000000007488E000-0x000000007488F000-memory.dmp

Filesize
4KB

Download
memory/4724-1-0x0000000000520000-0x000000000053E000-memory.dmp

Filesize
120KB

Download