Analysis

  • max time kernel
    94s
  • max time network
    21s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    30-05-2024 18:41

General

  • Target

    incognito-beta.exe

  • Size

    45KB

  • MD5

    3110b35fe4c0b011bda32853cf6ea8e5

  • SHA1

    99e01bbec76e7b17fce3a9992bf59453aa5f1344

  • SHA256

    a99db0013ba923fc71f497d838ecc385d19aad27a51a079895d879f59b22a4ad

  • SHA512

    1b804db6a4c0ef1a5726fb05767f62bbe19dcb06c9072e024a457e2aa2cb080cbd815e4018878bd402e2a190d3f567946cdf35b5eede1af431fb11d7dc2e46f4

  • SSDEEP

    768:SdhO/poiiUcjlJInrlH9Xqk5nWEZ5SbTDaBWI7CPW5h:0w+jjgnJH9XqcnW85SbTgWI5

Score
10/10

Malware Config

Extracted

Family

xenorat

C2

127.0.0.1

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    5000

  • install_path

    appdata

  • port

    3243

  • startup_name

    nothingset

Signatures

  • XenorRat

    XenorRat is a remote access trojan written in C#.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\incognito-beta.exe
    "C:\Users\Admin\AppData\Local\Temp\incognito-beta.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1936
    • C:\Users\Admin\AppData\Roaming\XenoManager\incognito-beta.exe
      "C:\Users\Admin\AppData\Roaming\XenoManager\incognito-beta.exe"
      2⤵
      • Executes dropped EXE
      PID:1296
  • C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe"
    1⤵
      PID:2820

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Roaming\XenoManager\incognito-beta.exe

      Filesize

      45KB

      MD5

      3110b35fe4c0b011bda32853cf6ea8e5

      SHA1

      99e01bbec76e7b17fce3a9992bf59453aa5f1344

      SHA256

      a99db0013ba923fc71f497d838ecc385d19aad27a51a079895d879f59b22a4ad

      SHA512

      1b804db6a4c0ef1a5726fb05767f62bbe19dcb06c9072e024a457e2aa2cb080cbd815e4018878bd402e2a190d3f567946cdf35b5eede1af431fb11d7dc2e46f4

    • memory/1296-9-0x000000007425E000-0x000000007425F000-memory.dmp

      Filesize

      4KB

    • memory/1296-10-0x0000000000970000-0x0000000000982000-memory.dmp

      Filesize

      72KB

    • memory/1296-11-0x0000000074250000-0x000000007493E000-memory.dmp

      Filesize

      6.9MB

    • memory/1296-12-0x0000000074250000-0x000000007493E000-memory.dmp

      Filesize

      6.9MB

    • memory/1936-0-0x000000007494E000-0x000000007494F000-memory.dmp

      Filesize

      4KB

    • memory/1936-1-0x00000000010A0000-0x00000000010B2000-memory.dmp

      Filesize

      72KB