Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-05-2024 12:58

General

  • Target

    GT Proxy.exe

  • Size

    310KB

  • MD5

    85cfe597bd2fb4ea20e68f83f47b7df4

  • SHA1

    4ab1dea0fadc87022dab356b02a759f72ec30c2d

  • SHA256

    4735fa85ee766193771be94023eabf93f7763ab742cdd0c0bf5a84e36bcaef3a

  • SHA512

    44087253b541b64a43eb60051420a8f25cfc571eb0e357864cce50a44ab709f7eb27d9054444dacd32645d0b4a7b53f25003b30c9452e079921be154d89a859f

  • SSDEEP

    6144:LWP91UbeeC+5r6PmRIoS5P7xVEDc7SuDSSwb:Lw8CB9V5b

Score
10/10

Malware Config

Extracted

Family

xenorat

C2

149.0.26.4

Mutex

Growtopia_4232

Attributes
  • delay

    5000

  • install_path

    appdata

  • port

    4444

  • startup_name

    nothingset

Signatures

  • XenorRat

    XenorRat is a remote access trojan written in C#.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GT Proxy.exe
    "C:\Users\Admin\AppData\Local\Temp\GT Proxy.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:760
    • C:\Users\Admin\AppData\Roaming\XenoManager\GT Proxy.exe
      "C:\Users\Admin\AppData\Roaming\XenoManager\GT Proxy.exe"
      2⤵
      • Executes dropped EXE
      PID:1656

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\XenoManager\GT Proxy.exe

    Filesize

    310KB

    MD5

    85cfe597bd2fb4ea20e68f83f47b7df4

    SHA1

    4ab1dea0fadc87022dab356b02a759f72ec30c2d

    SHA256

    4735fa85ee766193771be94023eabf93f7763ab742cdd0c0bf5a84e36bcaef3a

    SHA512

    44087253b541b64a43eb60051420a8f25cfc571eb0e357864cce50a44ab709f7eb27d9054444dacd32645d0b4a7b53f25003b30c9452e079921be154d89a859f

  • memory/760-0-0x000000007449E000-0x000000007449F000-memory.dmp

    Filesize

    4KB

  • memory/760-1-0x0000000000CE0000-0x0000000000D34000-memory.dmp

    Filesize

    336KB

  • memory/1656-14-0x0000000074490000-0x0000000074C40000-memory.dmp

    Filesize

    7.7MB

  • memory/1656-15-0x0000000074490000-0x0000000074C40000-memory.dmp

    Filesize

    7.7MB