xenorat | 53bb0c771cfaaf16a7409a8b921c9e7e1595d281d94f5e7ad54454b3b5ac1602

Analysis

max time kernel
30s
max time network
11s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 00:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

unlocked-gen.exe
Size

45KB
MD5

d2db2b350e07ac3555b415ad0ef7273e
SHA1

eb95cf23d1cd315d99d64ba61d1cc2f5f7bd76a6
SHA256

53bb0c771cfaaf16a7409a8b921c9e7e1595d281d94f5e7ad54454b3b5ac1602
SHA512

85778d717fc5315d5cd8898836d73fd735d9be2bbb409fa1ae5be3b79097664378779d2a4db3c1895fd2cadf01d3cdbc465e4f8a6186aac969acceeaa591458e
SSDEEP

768:hdhO/poiiUcjlJInXtUH9Xqk5nWEZ5SbTDaQWI7CPW5k:fw+jjgn9UH9XqcnW85SbTxWI8

Score

10^/10

xenorat rat trojan

Malware Config

Extracted

Family

xenorat

127.0.0.1

Mutex

Xeno_rat_nd8912d

Attributes

delay
3000
install_path
temp
port
3389
startup_name
system

Signatures

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

unlocked-gen.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	unlocked-gen.exe

Executes dropped EXE 1 IoCs

Processes:

unlocked-gen.exe

pid process

4588 unlocked-gen.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4680 schtasks.exe

pid	process
4588	unlocked-gen.exe

pid	process
4680	schtasks.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

unlocked-gen.exeunlocked-gen.exe

description	pid	process	target process
PID 4900 wrote to memory of 4588	4900	unlocked-gen.exe	unlocked-gen.exe
PID 4900 wrote to memory of 4588	4900	unlocked-gen.exe	unlocked-gen.exe
PID 4900 wrote to memory of 4588	4900	unlocked-gen.exe	unlocked-gen.exe
PID 4588 wrote to memory of 4680	4588	unlocked-gen.exe	schtasks.exe
PID 4588 wrote to memory of 4680	4588	unlocked-gen.exe	schtasks.exe
PID 4588 wrote to memory of 4680	4588	unlocked-gen.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\unlocked-gen.exe
"C:\Users\Admin\AppData\Local\Temp\unlocked-gen.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4900

C:\Users\Admin\AppData\Local\Temp\XenoManager\unlocked-gen.exe
"C:\Users\Admin\AppData\Local\Temp\XenoManager\unlocked-gen.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /Create /TN "system" /XML "C:\Users\Admin\AppData\Local\Temp\tmp53DD.tmp" /F
3⤵
- Creates scheduled task(s)
PID:4680

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\unlocked-gen.exe.log
Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\XenoManager\unlocked-gen.exe
Filesize
45KB

MD5
d2db2b350e07ac3555b415ad0ef7273e

SHA1
eb95cf23d1cd315d99d64ba61d1cc2f5f7bd76a6

SHA256
53bb0c771cfaaf16a7409a8b921c9e7e1595d281d94f5e7ad54454b3b5ac1602

SHA512
85778d717fc5315d5cd8898836d73fd735d9be2bbb409fa1ae5be3b79097664378779d2a4db3c1895fd2cadf01d3cdbc465e4f8a6186aac969acceeaa591458e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp53DD.tmp
Filesize
1KB

MD5
4a7f735c43ed6520667cbf4ea31bf1e0

SHA1
e1298140c59752771836110a96723504d6f909da

SHA256
461f970c7b7b9bae825eb3841df8f7d4229b307ee6215ae3fe41c96fa42aad4a

SHA512
cdc9566c4beff1e09784a6d46a081598af3f66225966c14d4179d350cbff9f0493e8f40034890aa169ec438a2b6f984877341bc55e819d95c608e1317fd54509

Download Submit
memory/4588-15-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download
memory/4588-18-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download
memory/4588-19-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download
memory/4900-0-0x00000000750EE000-0x00000000750EF000-memory.dmp

Filesize
4KB

Download
memory/4900-1-0x0000000000700000-0x0000000000712000-memory.dmp

Filesize
72KB

Download