Analysis
-
max time kernel
100s -
max time network
121s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
30-05-2024 03:12
General
-
Target
WavePreTest.exe
-
Size
250KB
-
MD5
5e5f3675c35d20f0f178656ef3050610
-
SHA1
1c3b806ecf7b9b26dd1c1a1ccead6cab4acb86e5
-
SHA256
f0f5b2b8f43bfec5114b21a4abfeb0f225cb8e5b55ed276b43583caaab7c70e3
-
SHA512
802a3cd68693bbfc86e69f20d734d7ee57188a5649715822da5d463496916b1789aef05315738493efe8160d9c1e8bb9b982f548a13ae841d314e920aac22779
-
SSDEEP
3072:xw+jqc91UbTrp8T8JXuw55R20bXnxNHGLQSYUjkjYiN7q1M3C0x:+W191Ub58T8JXuBWnxN0kjjdC0
Malware Config
Extracted
xenorat
david-login.gl.at.ply.gg
Xeno_rat_nd8912d
-
delay
5000
-
install_path
appdata
-
port
54479
-
startup_name
nothingset
Signatures
-
XenorRat
XenorRat is a remote access trojan written in C#.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\WavePreTest.exe"C:\Users\Admin\AppData\Local\Temp\WavePreTest.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XenoManager\WavePreTest.exe"C:\Users\Admin\AppData\Roaming\XenoManager\WavePreTest.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3d81⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226B
MD5957779c42144282d8cd83192b8fbc7cf
SHA1de83d08d2cca06b9ff3d1ef239d6b60b705d25fe
SHA2560d7ca7ba65e2b465e4878e324ceab8f8981f5ec06dcf5bc32559a4467a9c7d51
SHA512f1549c61b4f2906d13b2aabb74772c2bc826cd42373d7bb6c48cbb125d5aa2ec17617e6b5e67e8aae3bb5790cc831cdba48a45008ed01df4fba8be448cce39fd
-
Filesize
250KB
MD55e5f3675c35d20f0f178656ef3050610
SHA11c3b806ecf7b9b26dd1c1a1ccead6cab4acb86e5
SHA256f0f5b2b8f43bfec5114b21a4abfeb0f225cb8e5b55ed276b43583caaab7c70e3
SHA512802a3cd68693bbfc86e69f20d734d7ee57188a5649715822da5d463496916b1789aef05315738493efe8160d9c1e8bb9b982f548a13ae841d314e920aac22779
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
408KB
-
Filesize
6.9MB
-
Filesize
40KB
-
Filesize
5.0MB
-
Filesize
40KB
-
Filesize
624KB
-
Filesize
6.9MB
-
Filesize
1000KB
-
Filesize
1.8MB
-
Filesize
320KB
-
Filesize
472KB
-
Filesize
5.2MB
-
Filesize
120KB
-
Filesize
272KB
-
Filesize
4KB