xenorat | a8b6f84c5a83b221cb27203a565852745db0010e793aedfe2e98db4cd7f10859

Analysis

max time kernel
101s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2024 15:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BE_Forcer.exe
Size

45KB
MD5

888405f1ed21b89ac08343458251bf26
SHA1

4c9b54da2336376441af26ed4bedcd6fda1b316f
SHA256

a8b6f84c5a83b221cb27203a565852745db0010e793aedfe2e98db4cd7f10859
SHA512

4280eddeaba17692a542ab11e1ad92cde5aedd0857990bea01dbd967334801318fd5c31519e58af021ff07c7cf37c2cea6c99502d7f7c1b26852cfb935e3a2a1
SSDEEP

768:1dhO/poiiUcjlJInYqH9Xqk5nWEZ5SbTDa3WI7CPW5R:Lw+jjgnzH9XqcnW85SbTGWI5

Score

10^/10

xenorat rat trojan

Malware Config

Extracted

Family

xenorat

23.243.100.240

Mutex

Xeno_rat_nd8912d

Attributes

delay
5000
install_path
appdata
port
4444
startup_name
Windows Security

Signatures

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

BE_Forcer.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	BE_Forcer.exe

Executes dropped EXE 1 IoCs

Processes:

BE_Forcer.exe

pid process

4156 BE_Forcer.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

3216 schtasks.exe

pid	process
4156	BE_Forcer.exe

pid	process
3216	schtasks.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

BE_Forcer.exeBE_Forcer.exe

description	pid	process	target process
PID 4952 wrote to memory of 4156	4952	BE_Forcer.exe	BE_Forcer.exe
PID 4952 wrote to memory of 4156	4952	BE_Forcer.exe	BE_Forcer.exe
PID 4952 wrote to memory of 4156	4952	BE_Forcer.exe	BE_Forcer.exe
PID 4156 wrote to memory of 3216	4156	BE_Forcer.exe	schtasks.exe
PID 4156 wrote to memory of 3216	4156	BE_Forcer.exe	schtasks.exe
PID 4156 wrote to memory of 3216	4156	BE_Forcer.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\BE_Forcer.exe
"C:\Users\Admin\AppData\Local\Temp\BE_Forcer.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4952

C:\Users\Admin\AppData\Roaming\XenoManager\BE_Forcer.exe
"C:\Users\Admin\AppData\Roaming\XenoManager\BE_Forcer.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /Create /TN "Windows Security" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5A93.tmp" /F
3⤵
- Creates scheduled task(s)
PID:3216

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BE_Forcer.exe.log
Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5A93.tmp
Filesize
1KB

MD5
8941d5c60cb56d632eb823a0394c0851

SHA1
ca1b1d484dc8f932533d5e6b780e0eaab1659353

SHA256
b871a28e8efbe36968894cd4bbd85d4ade83ef6b738181d30f8eabac4598ed82

SHA512
f0651c882f5605054099c3fe26c6c5a9ffeba64aa2844c22297090ace54b7408992088517833e2ff6f4ffa02fc730a13dd6f377e507749f3607a323fdb175a5f

Download Submit
C:\Users\Admin\AppData\Roaming\XenoManager\BE_Forcer.exe
Filesize
45KB

MD5
888405f1ed21b89ac08343458251bf26

SHA1
4c9b54da2336376441af26ed4bedcd6fda1b316f

SHA256
a8b6f84c5a83b221cb27203a565852745db0010e793aedfe2e98db4cd7f10859

SHA512
4280eddeaba17692a542ab11e1ad92cde5aedd0857990bea01dbd967334801318fd5c31519e58af021ff07c7cf37c2cea6c99502d7f7c1b26852cfb935e3a2a1

Download Submit
memory/4156-15-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/4156-18-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/4952-0-0x0000000074B4E000-0x0000000074B4F000-memory.dmp

Filesize
4KB

Download
memory/4952-1-0x0000000000F00000-0x0000000000F12000-memory.dmp

Filesize
72KB

Download