xenorat | c671f88c82c2d0f234e637f4a76f34bb1f9ec381a05419bda0ded20d2659fee4

Analysis

max time kernel
138s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07-06-2024 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

puttson.exe
Size

45KB
MD5

245b17283d08c683a8a3438b139fddd5
SHA1

5954e69b83c1fd5074d79dfe2fb1c2d492d7ef12
SHA256

c671f88c82c2d0f234e637f4a76f34bb1f9ec381a05419bda0ded20d2659fee4
SHA512

a9a728f220f01db52335dd0c87a3aa6354e29d434af1a9b5417a98ce3be95eecf2379d458bc73b2d903c578ec21423f7d29d1fecfdd44bc9548ae680b2f1439c
SSDEEP

768:AdhO/poiiUcjlJIn0bqmH9Xqk5nWEZ5SbTDalWI7CPW5a:yw+jjgn2H9XqcnW85SbTkWIS

Score

10^/10

xenorat rat trojan

Malware Config

Extracted

Family

xenorat

192.168.100.78

Mutex

Putty1

Attributes

delay
5000
install_path
temp
port
4782
startup_name
Windows Updater

Signatures

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

puttson.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation puttson.exe
Executes dropped EXE 1 IoCs

Processes:

puttson.exe

pid process

2552 puttson.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4168 schtasks.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	puttson.exe

pid	process
2552	puttson.exe

pid	process
4168	schtasks.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

puttson.exeputtson.exe

description	pid	process	target process
PID 1180 wrote to memory of 2552	1180	puttson.exe	puttson.exe
PID 1180 wrote to memory of 2552	1180	puttson.exe	puttson.exe
PID 1180 wrote to memory of 2552	1180	puttson.exe	puttson.exe
PID 2552 wrote to memory of 4168	2552	puttson.exe	schtasks.exe
PID 2552 wrote to memory of 4168	2552	puttson.exe	schtasks.exe
PID 2552 wrote to memory of 4168	2552	puttson.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\puttson.exe
"C:\Users\Admin\AppData\Local\Temp\puttson.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1180

C:\Users\Admin\AppData\Local\Temp\XenoManager\puttson.exe
"C:\Users\Admin\AppData\Local\Temp\XenoManager\puttson.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /Create /TN "Windows Updater" /XML "C:\Users\Admin\AppData\Local\Temp\tmp540B.tmp" /F
3⤵
- Creates scheduled task(s)
PID:4168

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\puttson.exe.log
Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\XenoManager\puttson.exe
Filesize
45KB

MD5
245b17283d08c683a8a3438b139fddd5

SHA1
5954e69b83c1fd5074d79dfe2fb1c2d492d7ef12

SHA256
c671f88c82c2d0f234e637f4a76f34bb1f9ec381a05419bda0ded20d2659fee4

SHA512
a9a728f220f01db52335dd0c87a3aa6354e29d434af1a9b5417a98ce3be95eecf2379d458bc73b2d903c578ec21423f7d29d1fecfdd44bc9548ae680b2f1439c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp540B.tmp
Filesize
1KB

MD5
54be6b219f0330dd369badc1263b7bf9

SHA1
c797b4f76424618e91128cc2a74c3acfca2a041e

SHA256
28dc780dbfaefdd6ab4fbef2e8535e44eaa0b80a21b35e03d8208f0a8095ba7e

SHA512
a2d593f78be5148fa54e0c21dc5a5dbb6936e7c95ac860fee80ee3f42369b07df9d46c457bd4c665ba7f8c4db90e5a5bdf9a473e46c6d23938e32cc39b0b7039

Download Submit
memory/1180-0-0x0000000074D8E000-0x0000000074D8F000-memory.dmp

Filesize
4KB

Download
memory/1180-1-0x0000000000680000-0x0000000000692000-memory.dmp

Filesize
72KB

Download
memory/2552-15-0x0000000074D80000-0x0000000075530000-memory.dmp

Filesize
7.7MB

Download
memory/2552-18-0x0000000074D80000-0x0000000075530000-memory.dmp

Filesize
7.7MB

Download