Analysis
-
max time kernel
80s -
max time network
82s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29-05-2024 15:21
Errors
General
-
Target
XenoRat.exe
-
Size
45KB
-
MD5
3afe27a9c4712a61208c88278b611add
-
SHA1
d53eedc05a1bb370f271f32f40abfb12929c4293
-
SHA256
f028a4628d7d5156c4f841ebaf32ac8ee1287c18bb44c3517b402e871faa1eb0
-
SHA512
0d60a1009d31a617b487cdc52503bcb414a1cb8281fb9f17306c0b216d879381557930e05c3fd146568ccfe72dc7ec53870a1c74a4b4563fce0ac47f14750665
-
SSDEEP
768:1dhO/poiiUcjlJInXYH9Xqk5nWEZ5SbTDa+uI7CPW5k:Lw+jjgnIH9XqcnW85SbT7uI8
Malware Config
Extracted
xenorat
taking-headquarters.gl.at.ply.gg
Xeno_rat_nd8912d
-
delay
5000
-
install_path
nothingset
-
port
3069
-
startup_name
nothingset
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
XenoRat.exeXenoRat.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XenoRat.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XenoRat.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 15 IoCs
Processes:
LogonUI.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "233" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe -
Modifies registry class 10 IoCs
Processes:
XenoRat.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\ms-settings\Shell\Open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\XenoRat.exe\"" XenoRat.exe Key deleted \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\ms-settings\Shell XenoRat.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\ms-settings\Shell XenoRat.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\ms-settings\Shell\Open XenoRat.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute XenoRat.exe Key deleted \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\ms-settings\Shell\Open\command XenoRat.exe Key deleted \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\ms-settings\Shell\Open XenoRat.exe Key deleted \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\ms-settings XenoRat.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\ms-settings\Shell\Open\command XenoRat.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\ms-settings XenoRat.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
XenoRat.exeXenoRat.exepid process 2308 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 3912 XenoRat.exe 3912 XenoRat.exe 3912 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 3912 XenoRat.exe 3912 XenoRat.exe 3912 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 3912 XenoRat.exe 3912 XenoRat.exe 3912 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 3912 XenoRat.exe 3912 XenoRat.exe 3912 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 2308 XenoRat.exe 3912 XenoRat.exe 3912 XenoRat.exe 3912 XenoRat.exe 3912 XenoRat.exe 3912 XenoRat.exe 3912 XenoRat.exe 3912 XenoRat.exe 3912 XenoRat.exe 3912 XenoRat.exe 3912 XenoRat.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
XenoRat.exeXenoRat.exeshutdown.exedescription pid process Token: SeDebugPrivilege 2308 XenoRat.exe Token: SeDebugPrivilege 3912 XenoRat.exe Token: SeShutdownPrivilege 2236 shutdown.exe Token: SeRemoteShutdownPrivilege 2236 shutdown.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
LogonUI.exepid process 1976 LogonUI.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
XenoRat.execmd.exefodhelper.execmd.exeXenoRat.exedescription pid process target process PID 2308 wrote to memory of 892 2308 XenoRat.exe cmd.exe PID 2308 wrote to memory of 892 2308 XenoRat.exe cmd.exe PID 892 wrote to memory of 4584 892 cmd.exe fodhelper.exe PID 892 wrote to memory of 4584 892 cmd.exe fodhelper.exe PID 4584 wrote to memory of 3912 4584 fodhelper.exe XenoRat.exe PID 4584 wrote to memory of 3912 4584 fodhelper.exe XenoRat.exe PID 4584 wrote to memory of 3912 4584 fodhelper.exe XenoRat.exe PID 2308 wrote to memory of 4568 2308 XenoRat.exe schtasks.exe PID 2308 wrote to memory of 4568 2308 XenoRat.exe schtasks.exe PID 2308 wrote to memory of 4568 2308 XenoRat.exe schtasks.exe PID 2308 wrote to memory of 3848 2308 XenoRat.exe cmd.exe PID 2308 wrote to memory of 3848 2308 XenoRat.exe cmd.exe PID 2308 wrote to memory of 3848 2308 XenoRat.exe cmd.exe PID 3848 wrote to memory of 836 3848 cmd.exe choice.exe PID 3848 wrote to memory of 836 3848 cmd.exe choice.exe PID 3848 wrote to memory of 836 3848 cmd.exe choice.exe PID 3912 wrote to memory of 1268 3912 XenoRat.exe schtasks.exe PID 3912 wrote to memory of 1268 3912 XenoRat.exe schtasks.exe PID 3912 wrote to memory of 1268 3912 XenoRat.exe schtasks.exe PID 3912 wrote to memory of 2236 3912 XenoRat.exe shutdown.exe PID 3912 wrote to memory of 2236 3912 XenoRat.exe shutdown.exe PID 3912 wrote to memory of 2236 3912 XenoRat.exe shutdown.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XenoRat.exe"C:\Users\Admin\AppData\Local\Temp\XenoRat.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c start "" "%windir%\system32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\fodhelper.exe"C:\Windows\system32\fodhelper.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\XenoRat.exe"C:\Users\Admin\AppData\Local\Temp\XenoRat.exe"4⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "XenoUpdateManager" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4699.tmp" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\shutdown.exe"C:\Windows\System32\shutdown.exe" /r /t 05⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /query /v /fo csv2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\XenoRat.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3978855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4699.tmpFilesize
1KB
MD5fced461c66c41ce1133f7b1f0acc6472
SHA17122010b3214e5688b490856da4f386635893c7d
SHA2565173e9c4402ab0307b0fab6b7945c3f2585ed60653341206f3176f59730492ee
SHA512a0cd6dd3f0131d9945bb9df5fcf378d2bef3b67f82720a3401e62b5b62ff8487f627330f499ea5559a33302d1d57f8a5d177e7a479a169cd2cbd1ad33ac11ba9
-
memory/2308-0-0x000000007484E000-0x000000007484F000-memory.dmpFilesize
4KB
-
memory/2308-1-0x00000000005B0000-0x00000000005C2000-memory.dmpFilesize
72KB
-
memory/2308-2-0x0000000074840000-0x0000000074FF0000-memory.dmpFilesize
7.7MB
-
memory/2308-3-0x0000000005AE0000-0x0000000005B46000-memory.dmpFilesize
408KB
-
memory/2308-4-0x000000007484E000-0x000000007484F000-memory.dmpFilesize
4KB
-
memory/2308-5-0x0000000074840000-0x0000000074FF0000-memory.dmpFilesize
7.7MB
-
memory/2308-6-0x0000000005A70000-0x0000000005A7C000-memory.dmpFilesize
48KB
-
memory/2308-7-0x0000000074840000-0x0000000074FF0000-memory.dmpFilesize
7.7MB
-
memory/3912-8-0x0000000005760000-0x0000000005768000-memory.dmpFilesize
32KB
-
memory/3912-11-0x0000000005B90000-0x0000000005B98000-memory.dmpFilesize
32KB