Analysis

  • max time kernel
    104s
  • max time network
    110s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-05-2024 18:41

General

  • Target

    incognito-beta.exe

  • Size

    45KB

  • MD5

    3110b35fe4c0b011bda32853cf6ea8e5

  • SHA1

    99e01bbec76e7b17fce3a9992bf59453aa5f1344

  • SHA256

    a99db0013ba923fc71f497d838ecc385d19aad27a51a079895d879f59b22a4ad

  • SHA512

    1b804db6a4c0ef1a5726fb05767f62bbe19dcb06c9072e024a457e2aa2cb080cbd815e4018878bd402e2a190d3f567946cdf35b5eede1af431fb11d7dc2e46f4

  • SSDEEP

    768:SdhO/poiiUcjlJInrlH9Xqk5nWEZ5SbTDaBWI7CPW5h:0w+jjgnJH9XqcnW85SbTgWI5

Score
10/10

Malware Config

Extracted

Family

xenorat

C2

127.0.0.1

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    5000

  • install_path

    appdata

  • port

    3243

  • startup_name

    nothingset

Signatures

  • XenorRat

    XenorRat is a remote access trojan written in C#.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\incognito-beta.exe
    "C:\Users\Admin\AppData\Local\Temp\incognito-beta.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4956
    • C:\Users\Admin\AppData\Roaming\XenoManager\incognito-beta.exe
      "C:\Users\Admin\AppData\Roaming\XenoManager\incognito-beta.exe"
      2⤵
      • Executes dropped EXE
      PID:2276
  • C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe"
    1⤵
      PID:1496

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\incognito-beta.exe.log

      Filesize

      226B

      MD5

      916851e072fbabc4796d8916c5131092

      SHA1

      d48a602229a690c512d5fdaf4c8d77547a88e7a2

      SHA256

      7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

      SHA512

      07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

    • C:\Users\Admin\AppData\Roaming\XenoManager\incognito-beta.exe

      Filesize

      45KB

      MD5

      3110b35fe4c0b011bda32853cf6ea8e5

      SHA1

      99e01bbec76e7b17fce3a9992bf59453aa5f1344

      SHA256

      a99db0013ba923fc71f497d838ecc385d19aad27a51a079895d879f59b22a4ad

      SHA512

      1b804db6a4c0ef1a5726fb05767f62bbe19dcb06c9072e024a457e2aa2cb080cbd815e4018878bd402e2a190d3f567946cdf35b5eede1af431fb11d7dc2e46f4

    • memory/2276-15-0x0000000074670000-0x0000000074E20000-memory.dmp

      Filesize

      7.7MB

    • memory/2276-16-0x0000000074670000-0x0000000074E20000-memory.dmp

      Filesize

      7.7MB

    • memory/2276-17-0x0000000074670000-0x0000000074E20000-memory.dmp

      Filesize

      7.7MB

    • memory/4956-0-0x000000007467E000-0x000000007467F000-memory.dmp

      Filesize

      4KB

    • memory/4956-1-0x00000000006C0000-0x00000000006D2000-memory.dmp

      Filesize

      72KB