Analysis
-
max time kernel
140s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
30-05-2024 11:33
Static task
static1
Behavioral task
behavioral1
Sample
66f635bf805463c4a83b969ac8d4cc563b2feadaea0460dc22c5f53be72a9223.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
66f635bf805463c4a83b969ac8d4cc563b2feadaea0460dc22c5f53be72a9223.exe
Resource
win10v2004-20240508-en
General
-
Target
66f635bf805463c4a83b969ac8d4cc563b2feadaea0460dc22c5f53be72a9223.exe
-
Size
955KB
-
MD5
94f798a6cc5738e8924c9c0b3d2abb1e
-
SHA1
5714cb7b382dab9977c99c94294561bc42d3166e
-
SHA256
66f635bf805463c4a83b969ac8d4cc563b2feadaea0460dc22c5f53be72a9223
-
SHA512
7b301bddf5d8a3602805754dc995bb4ee88c957b1029e3a17a0ed10d85cc60b1c603a8953a521cae283c39e2ecf69e1253db92cc89dacd46a45d2c72837ce0e4
-
SSDEEP
24576:duDXTIGaPhEYzUzA0qxUAUBqG8DCRG7F9V5:ADjlabwz9M7WRG59V5
Malware Config
Extracted
xenorat
23.243.100.240
Xeno_rat_nd8912d
-
delay
5000
-
install_path
appdata
-
port
4444
-
startup_name
Windows Security
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
InternalLoader2.exeRuntime Broker.exeRuntime Broker.exepid process 2396 InternalLoader2.exe 2940 Runtime Broker.exe 2592 Runtime Broker.exe -
Loads dropped DLL 3 IoCs
Processes:
66f635bf805463c4a83b969ac8d4cc563b2feadaea0460dc22c5f53be72a9223.exeRuntime Broker.exepid process 2104 66f635bf805463c4a83b969ac8d4cc563b2feadaea0460dc22c5f53be72a9223.exe 2628 2940 Runtime Broker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2776 timeout.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
66f635bf805463c4a83b969ac8d4cc563b2feadaea0460dc22c5f53be72a9223.exeInternalLoader2.execmd.execmd.execmd.exeRuntime Broker.exeRuntime Broker.exedescription pid process target process PID 2104 wrote to memory of 2396 2104 66f635bf805463c4a83b969ac8d4cc563b2feadaea0460dc22c5f53be72a9223.exe InternalLoader2.exe PID 2104 wrote to memory of 2396 2104 66f635bf805463c4a83b969ac8d4cc563b2feadaea0460dc22c5f53be72a9223.exe InternalLoader2.exe PID 2104 wrote to memory of 2396 2104 66f635bf805463c4a83b969ac8d4cc563b2feadaea0460dc22c5f53be72a9223.exe InternalLoader2.exe PID 2396 wrote to memory of 2732 2396 InternalLoader2.exe cmd.exe PID 2396 wrote to memory of 2732 2396 InternalLoader2.exe cmd.exe PID 2396 wrote to memory of 2732 2396 InternalLoader2.exe cmd.exe PID 2732 wrote to memory of 2736 2732 cmd.exe certutil.exe PID 2732 wrote to memory of 2736 2732 cmd.exe certutil.exe PID 2732 wrote to memory of 2736 2732 cmd.exe certutil.exe PID 2732 wrote to memory of 2764 2732 cmd.exe find.exe PID 2732 wrote to memory of 2764 2732 cmd.exe find.exe PID 2732 wrote to memory of 2764 2732 cmd.exe find.exe PID 2732 wrote to memory of 2760 2732 cmd.exe find.exe PID 2732 wrote to memory of 2760 2732 cmd.exe find.exe PID 2732 wrote to memory of 2760 2732 cmd.exe find.exe PID 2396 wrote to memory of 2644 2396 InternalLoader2.exe cmd.exe PID 2396 wrote to memory of 2644 2396 InternalLoader2.exe cmd.exe PID 2396 wrote to memory of 2644 2396 InternalLoader2.exe cmd.exe PID 2644 wrote to memory of 2404 2644 cmd.exe cmd.exe PID 2644 wrote to memory of 2404 2644 cmd.exe cmd.exe PID 2644 wrote to memory of 2404 2644 cmd.exe cmd.exe PID 2396 wrote to memory of 2524 2396 InternalLoader2.exe WerFault.exe PID 2396 wrote to memory of 2524 2396 InternalLoader2.exe WerFault.exe PID 2396 wrote to memory of 2524 2396 InternalLoader2.exe WerFault.exe PID 2404 wrote to memory of 2776 2404 cmd.exe timeout.exe PID 2404 wrote to memory of 2776 2404 cmd.exe timeout.exe PID 2404 wrote to memory of 2776 2404 cmd.exe timeout.exe PID 2104 wrote to memory of 2940 2104 66f635bf805463c4a83b969ac8d4cc563b2feadaea0460dc22c5f53be72a9223.exe Runtime Broker.exe PID 2104 wrote to memory of 2940 2104 66f635bf805463c4a83b969ac8d4cc563b2feadaea0460dc22c5f53be72a9223.exe Runtime Broker.exe PID 2104 wrote to memory of 2940 2104 66f635bf805463c4a83b969ac8d4cc563b2feadaea0460dc22c5f53be72a9223.exe Runtime Broker.exe PID 2104 wrote to memory of 2940 2104 66f635bf805463c4a83b969ac8d4cc563b2feadaea0460dc22c5f53be72a9223.exe Runtime Broker.exe PID 2940 wrote to memory of 2592 2940 Runtime Broker.exe Runtime Broker.exe PID 2940 wrote to memory of 2592 2940 Runtime Broker.exe Runtime Broker.exe PID 2940 wrote to memory of 2592 2940 Runtime Broker.exe Runtime Broker.exe PID 2940 wrote to memory of 2592 2940 Runtime Broker.exe Runtime Broker.exe PID 2592 wrote to memory of 1836 2592 Runtime Broker.exe schtasks.exe PID 2592 wrote to memory of 1836 2592 Runtime Broker.exe schtasks.exe PID 2592 wrote to memory of 1836 2592 Runtime Broker.exe schtasks.exe PID 2592 wrote to memory of 1836 2592 Runtime Broker.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\66f635bf805463c4a83b969ac8d4cc563b2feadaea0460dc22c5f53be72a9223.exe"C:\Users\Admin\AppData\Local\Temp\66f635bf805463c4a83b969ac8d4cc563b2feadaea0460dc22c5f53be72a9223.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\InternalLoader2.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\InternalLoader2.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\RarSFX0\InternalLoader2.exe" MD5 | find /i /v "md5" | find /i /v "certutil"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\RarSFX0\InternalLoader2.exe" MD54⤵
-
C:\Windows\system32\find.exefind /i /v "md5"4⤵
-
C:\Windows\system32\find.exefind /i /v "certutil"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /C "color b && title Error && echo SSL connect error && timeout /t 5"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /t 55⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2396 -s 2963⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Runtime Broker.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XenoManager\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\XenoManager\Runtime Broker.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "Windows Security" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5C91.tmp" /F4⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Runtime Broker.exeFilesize
45KB
MD5888405f1ed21b89ac08343458251bf26
SHA14c9b54da2336376441af26ed4bedcd6fda1b316f
SHA256a8b6f84c5a83b221cb27203a565852745db0010e793aedfe2e98db4cd7f10859
SHA5124280eddeaba17692a542ab11e1ad92cde5aedd0857990bea01dbd967334801318fd5c31519e58af021ff07c7cf37c2cea6c99502d7f7c1b26852cfb935e3a2a1
-
C:\Users\Admin\AppData\Local\Temp\tmp5C91.tmpFilesize
1KB
MD55b219b4101d84f08808354aca4b544bc
SHA1f067faceacdefb5d1062fac1400c288aca4b36d7
SHA2567072f7d22c1809a4f13ab22b1b2eacebf3f7333f668810e4bad2e3c22d2b9836
SHA51267be44450193b5a10529b668e5dc3a35647bf85bb6cadbb2e9a45271d808f24ef0e8dc55103a50b1a82edc71f3c3371de50ac81220366a8188cca21a6587c8cd
-
\Users\Admin\AppData\Local\Temp\RarSFX0\InternalLoader2.exeFilesize
588KB
MD52582a8dfdf77e54747a2e84a27377131
SHA187a91b5cd34f2ed215a0092997ce2989a333b920
SHA25638ea6534608e1496b285dadaa545a968c2b128111fc3841ba84f162f1a3f8e20
SHA512f6193e490b95ef0ac3e2c66c2e83d8f582d4d86c4360b117a7ed11079a612ef62c2408968b96d3a55453cc0ac01b48773377ca090855650c368210235883ba3c
-
memory/2592-29-0x0000000000DC0000-0x0000000000DD2000-memory.dmpFilesize
72KB
-
memory/2940-21-0x0000000000030000-0x0000000000042000-memory.dmpFilesize
72KB