Analysis

  • max time kernel
    148s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-06-2024 07:54

General

  • Target

    79b315305079f3cdf15ff04463ade270a4056b90d8b95937f19455f47603b1ed.exe

  • Size

    46KB

  • MD5

    2e6acdcea8f62c62efccd790b8cce3f7

  • SHA1

    44fa27c411545d32955ad7e342ff0462ad49a776

  • SHA256

    79b315305079f3cdf15ff04463ade270a4056b90d8b95937f19455f47603b1ed

  • SHA512

    639b5d5b587090e494f71f05671b20883a3456029ae15ff463ba46855691f070ada664cde95905047d1491aa04432c28b721839da2534d48003f06045725b78e

  • SSDEEP

    768:+SisJmceOoRDlY8spLfFpyT7QHbtm+mEyqnN+8N9:YsJmfO2De7prj4QHbtiEH4U9

Score
10/10

Malware Config

Extracted

Family

xenorat

C2

dns.dobiamfollollc.online

Mutex

Solid_rat_nd8889g

Attributes
  • delay

    61000

  • install_path

    appdata

  • port

    1283

  • startup_name

    bns

Signatures

  • XenorRat

    XenorRat is a remote access trojan written in C#.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\79b315305079f3cdf15ff04463ade270a4056b90d8b95937f19455f47603b1ed.exe
    "C:\Users\Admin\AppData\Local\Temp\79b315305079f3cdf15ff04463ade270a4056b90d8b95937f19455f47603b1ed.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:412
    • C:\Users\Admin\AppData\Roaming\XenoManager\79b315305079f3cdf15ff04463ade270a4056b90d8b95937f19455f47603b1ed.exe
      "C:\Users\Admin\AppData\Roaming\XenoManager\79b315305079f3cdf15ff04463ade270a4056b90d8b95937f19455f47603b1ed.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3768
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks.exe" /Create /TN "bns" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEBF1.tmp" /F
        3⤵
        • Creates scheduled task(s)
        PID:4592
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3716 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:372

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpEBF1.tmp

      Filesize

      1KB

      MD5

      bca2d33c6b21a2b417d64c3c873d9fa0

      SHA1

      da1b559bb2041513db7347c33a5a5118e6283efb

      SHA256

      7440d7437729daf295d4a5bef882050e7894c39894c91a7db2d932f8590fad96

      SHA512

      a168bde21317f53b60e72119054070d2e4cdea4582061f46eb261fc5dbf57c1533a6e723ed3a41bddd0b3cdca94a7edb91fb7888f8f294f353e5195d6673f0c3

    • C:\Users\Admin\AppData\Roaming\XenoManager\79b315305079f3cdf15ff04463ade270a4056b90d8b95937f19455f47603b1ed.exe

      Filesize

      46KB

      MD5

      2e6acdcea8f62c62efccd790b8cce3f7

      SHA1

      44fa27c411545d32955ad7e342ff0462ad49a776

      SHA256

      79b315305079f3cdf15ff04463ade270a4056b90d8b95937f19455f47603b1ed

      SHA512

      639b5d5b587090e494f71f05671b20883a3456029ae15ff463ba46855691f070ada664cde95905047d1491aa04432c28b721839da2534d48003f06045725b78e

    • memory/412-0-0x0000000074B8E000-0x0000000074B8F000-memory.dmp

      Filesize

      4KB

    • memory/412-1-0x00000000001F0000-0x0000000000202000-memory.dmp

      Filesize

      72KB

    • memory/3768-14-0x0000000074B80000-0x0000000075330000-memory.dmp

      Filesize

      7.7MB

    • memory/3768-15-0x0000000074B80000-0x0000000075330000-memory.dmp

      Filesize

      7.7MB

    • memory/3768-16-0x0000000074B80000-0x0000000075330000-memory.dmp

      Filesize

      7.7MB