Malware Analysis Report

2024-08-06 18:05

Sample ID 240614-qcm7xswakl
Target Odeme_Takvimi_Ocak-2024.xll
SHA256 639ef6c263e48a4e6d3c2ffe628c85351d51df4a58955d0fdf64a8764812cca0
Tags
xenorat rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

639ef6c263e48a4e6d3c2ffe628c85351d51df4a58955d0fdf64a8764812cca0

Threat Level: Known bad

The file Odeme_Takvimi_Ocak-2024.xll was found to be: Known bad.

Malicious Activity Summary

xenorat rat trojan

XenorRat

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Suspicious use of SetThreadContext

Enumerates physical storage devices

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Creates scheduled task(s)

Modifies Internet Explorer settings

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Persistence
TA0003
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-14 13:07

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 13:07

Reported

2024-06-14 13:09

Platform

win7-20240611-en

Max time kernel

118s

Max time network

118s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Odeme_Takvimi_Ocak-2024.xll

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Processes

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Odeme_Takvimi_Ocak-2024.xll

Network

N/A

Files

memory/236-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/236-1-0x00000000725AD000-0x00000000725B8000-memory.dmp

\Users\Admin\AppData\Local\Temp\Odeme_Takvimi_Ocak-2024.xll

MD5 4c07ccb169a4cbaabec7eb3470428a53
SHA1 a5f8fea414a2be0cb4a8dd277fae03c8921823ec
SHA256 2acf28597bc3cfef2f1d83f504d7d8be3a5aedc113794ab71009dd479cf7aee0
SHA512 875289b443a059de29ff33022849f2e859943bb83444d1cc8948fefa56186481a564618e54b4d20c05afa4d00511a7667676cd64150bdb42d4a5acc3613cb60f

memory/236-3-0x00000000725AD000-0x00000000725B8000-memory.dmp

memory/236-4-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/236-5-0x00000000725AD000-0x00000000725B8000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 13:07

Reported

2024-06-14 13:09

Platform

win10v2004-20240611-en

Max time kernel

147s

Max time network

151s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Odeme_Takvimi_Ocak-2024.xll"

Signatures

XenorRat

trojan rat xenorat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3068 set thread context of 1148 N/A C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 3068 set thread context of 4264 N/A C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 4688 set thread context of 4348 N/A C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 4688 set thread context of 3508 N/A C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2560 wrote to memory of 3068 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 2560 wrote to memory of 3068 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 2560 wrote to memory of 3068 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 3068 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 3068 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 3068 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 3068 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 3068 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 3068 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 3068 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 3068 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 3068 wrote to memory of 4264 N/A C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 3068 wrote to memory of 4264 N/A C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 3068 wrote to memory of 4264 N/A C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 3068 wrote to memory of 4264 N/A C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 3068 wrote to memory of 4264 N/A C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 3068 wrote to memory of 4264 N/A C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 3068 wrote to memory of 4264 N/A C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 3068 wrote to memory of 4264 N/A C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 1148 wrote to memory of 4688 N/A C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 1148 wrote to memory of 4688 N/A C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 1148 wrote to memory of 4688 N/A C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 4688 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 4688 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 4688 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 4688 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 4688 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 4688 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 4688 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 4688 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 4688 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 4688 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 4688 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 4688 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 4688 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 4688 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 4688 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 4688 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe
PID 4348 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Windows\SysWOW64\schtasks.exe
PID 4348 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Windows\SysWOW64\schtasks.exe
PID 4348 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Odeme_Takvimi_Ocak-2024.xll"

C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe

"C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe"

C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe

C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe

C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe

C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4264 -ip 4264

C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe

"C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 80

C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe

C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe

C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe

C:\Users\Admin\AppData\Roaming\XenoManager\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "setting" /XML "C:\Users\Admin\AppData\Local\Temp\tmp789B.tmp" /F

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.32.109.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
NL 23.62.61.147:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 147.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 17.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 salutoepiesircam.sytes.net udp
US 8.8.8.8:53 salutoepiesircam.sytes.net udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 salutoepiesircam.sytes.net udp
US 8.8.8.8:53 65.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 salutoepiesircam.sytes.net udp
US 8.8.8.8:53 salutoepiesircam.sytes.net udp
US 8.8.8.8:53 salutoepiesircam.sytes.net udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 salutoepiesircam.sytes.net udp
US 8.8.8.8:53 salutoepiesircam.sytes.net udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 salutoepiesircam.sytes.net udp
US 8.8.8.8:53 salutoepiesircam.sytes.net udp
US 8.8.8.8:53 salutoepiesircam.sytes.net udp
US 8.8.8.8:53 salutoepiesircam.sytes.net udp
US 8.8.8.8:53 salutoepiesircam.sytes.net udp
US 8.8.8.8:53 salutoepiesircam.sytes.net udp
US 8.8.8.8:53 88.16.208.104.in-addr.arpa udp

Files

memory/2560-0-0x00007FF9D5B50000-0x00007FF9D5B60000-memory.dmp

memory/2560-2-0x00007FF9D5B50000-0x00007FF9D5B60000-memory.dmp

memory/2560-1-0x00007FF9D5B50000-0x00007FF9D5B60000-memory.dmp

memory/2560-4-0x00007FF9D5B50000-0x00007FF9D5B60000-memory.dmp

memory/2560-3-0x00007FF9D5B50000-0x00007FF9D5B60000-memory.dmp

memory/2560-5-0x00007FFA15B6D000-0x00007FFA15B6E000-memory.dmp

memory/2560-6-0x00007FFA15AD0000-0x00007FFA15CC5000-memory.dmp

memory/2560-8-0x00007FFA15AD0000-0x00007FFA15CC5000-memory.dmp

memory/2560-9-0x00007FF9D3810000-0x00007FF9D3820000-memory.dmp

memory/2560-7-0x00007FFA15AD0000-0x00007FFA15CC5000-memory.dmp

memory/2560-10-0x00007FFA15AD0000-0x00007FFA15CC5000-memory.dmp

memory/2560-12-0x00007FFA15AD0000-0x00007FFA15CC5000-memory.dmp

memory/2560-11-0x00007FF9D3810000-0x00007FF9D3820000-memory.dmp

memory/2560-16-0x00007FFA15AD0000-0x00007FFA15CC5000-memory.dmp

memory/2560-17-0x00007FFA15AD0000-0x00007FFA15CC5000-memory.dmp

memory/2560-15-0x00007FFA15AD0000-0x00007FFA15CC5000-memory.dmp

memory/2560-21-0x00007FFA15AD0000-0x00007FFA15CC5000-memory.dmp

memory/2560-20-0x00007FFA15AD0000-0x00007FFA15CC5000-memory.dmp

memory/2560-19-0x00007FFA15AD0000-0x00007FFA15CC5000-memory.dmp

memory/2560-18-0x00007FFA15AD0000-0x00007FFA15CC5000-memory.dmp

memory/2560-14-0x00007FFA15AD0000-0x00007FFA15CC5000-memory.dmp

memory/2560-13-0x00007FFA15AD0000-0x00007FFA15CC5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Odeme_Takvimi_Ocak-2024.xll

MD5 a18a3a3e81558c30701a5d28fbea50db
SHA1 044a8edc053be2fa5dff2565b4f08906c51f5a91
SHA256 639ef6c263e48a4e6d3c2ffe628c85351d51df4a58955d0fdf64a8764812cca0
SHA512 d6758fefe0955c5be4fa9dada657e61db294b6039d4be1781cc474ba001bbcd131c49102e26fa2f699c77084548c60b29c9dc15a8ab42cef10f779b243600db6

memory/2560-24-0x00000221B8DA0000-0x00000221B8E89000-memory.dmp

memory/2560-26-0x00007FFA15AD0000-0x00007FFA15CC5000-memory.dmp

memory/2560-28-0x00007FFA15AD0000-0x00007FFA15CC5000-memory.dmp

memory/2560-30-0x00007FFA15AD0000-0x00007FFA15CC5000-memory.dmp

memory/2560-31-0x00000221D5430000-0x00000221D55B4000-memory.dmp

memory/2560-29-0x00007FFA15AD0000-0x00007FFA15CC5000-memory.dmp

memory/2560-27-0x00000221BCF40000-0x00000221BCF54000-memory.dmp

memory/2560-32-0x00000221D5220000-0x00000221D525C000-memory.dmp

memory/2560-33-0x00007FFA15AD0000-0x00007FFA15CC5000-memory.dmp

memory/2560-34-0x00000221D52A0000-0x00000221D52E6000-memory.dmp

memory/2560-35-0x00007FFA15AD0000-0x00007FFA15CC5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe

MD5 63832573fe21731013ba3c4b419682f7
SHA1 9ebb4b8afb218d83661ccfc9ffc1a3e7e4dad0b9
SHA256 2fc5d95990c8cc587e5788c21c20dede449f4992c80a5009553f39fdf29c91bb
SHA512 50e5429ff0f5005a825584bd50c2ff09a06a87e621ff552ffdea284d3d6493f29f85ae3c401f958f6a45389e7a7180e7f7ec6f37b8e4ded578f75d4988dbc2c2

memory/3068-51-0x00007FFA15AD0000-0x00007FFA15CC5000-memory.dmp

memory/3068-52-0x0000000000B40000-0x0000000000B84000-memory.dmp

memory/3068-53-0x0000000005340000-0x0000000005346000-memory.dmp

memory/3068-57-0x00000000055B0000-0x00000000055EE000-memory.dmp

memory/3068-58-0x0000000005690000-0x000000000572C000-memory.dmp

memory/3068-59-0x0000000005CE0000-0x0000000006284000-memory.dmp

memory/3068-60-0x00000000057D0000-0x0000000005862000-memory.dmp

memory/3068-61-0x0000000005660000-0x0000000005666000-memory.dmp

memory/1148-62-0x0000000000400000-0x0000000000412000-memory.dmp

memory/3068-68-0x00007FFA15AD0000-0x00007FFA15CC5000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ebfba3a0-bde6-41e2-8a88-83f66a4e141b.exe.log

MD5 d95c58e609838928f0f49837cab7dfd2
SHA1 55e7139a1e3899195b92ed8771d1ca2c7d53c916
SHA256 0407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339
SHA512 405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d

C:\Users\Admin\AppData\Local\Temp\tmp789B.tmp

MD5 a59f7f2f3945ff192c56f948457a8746
SHA1 72658189330a7b67065a5d807b13bec418b3f459
SHA256 3422055d35049518d8c4b015eb93655c182429de18c73aa65671eada33a98365
SHA512 fae3d066aca64e2ae444dfa4e0260b3c578305416d18a59624724276ec0adcde32ada8ffb5f98a6d8cef945f84fbc63170c1fbc0e9c11212ff1c573a08304a7b

memory/2560-86-0x00007FFA15AD0000-0x00007FFA15CC5000-memory.dmp

memory/2560-87-0x00007FFA15AD0000-0x00007FFA15CC5000-memory.dmp

memory/2560-90-0x00007FFA15AD0000-0x00007FFA15CC5000-memory.dmp

memory/2560-91-0x00007FFA15AD0000-0x00007FFA15CC5000-memory.dmp

memory/2560-92-0x00007FFA15AD0000-0x00007FFA15CC5000-memory.dmp

memory/2560-93-0x00007FFA15AD0000-0x00007FFA15CC5000-memory.dmp

memory/2560-106-0x00007FF9D5B50000-0x00007FF9D5B60000-memory.dmp

memory/2560-107-0x00007FF9D5B50000-0x00007FF9D5B60000-memory.dmp

memory/2560-109-0x00007FF9D5B50000-0x00007FF9D5B60000-memory.dmp

memory/2560-108-0x00007FF9D5B50000-0x00007FF9D5B60000-memory.dmp

memory/2560-110-0x00007FFA15AD0000-0x00007FFA15CC5000-memory.dmp