Analysis
-
max time kernel
129s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15-06-2024 10:01
Static task
static1
Behavioral task
behavioral1
Sample
ESTADODECUENTA.xll
Resource
win7-20240611-en
General
-
Target
ESTADODECUENTA.xll
-
Size
820KB
-
MD5
a619cded29da7704aed4a84f24da47b9
-
SHA1
16bee7cb5587cd14a5937f9f7bc32e6e065ee2fe
-
SHA256
7b38251641313fb55b8fb461accb8af284d8c2ec11c5da53b306a0e7b3271cdd
-
SHA512
148b07b8f1b0668e71ab46f15fe7ee41b69c88bb86543f2def6f7ffa3614d7d61268d5450c0cfe7535f8900d86074143ad6cecb5b98b6c7d9bbd64c8bc6656c0
-
SSDEEP
12288:1G1N4HkcgMsiOd58bzbBSre6Q0uqZzD1reWabd/dbNZEEx/DLn0vkYHipwyA:1oOOMX1K+QHT+d9NZdxYHip
Malware Config
Extracted
Extracted
xenorat
91.92.248.167
Wolid_rat_nd8889g
-
delay
60000
-
install_path
appdata
-
port
1279
-
startup_name
qns
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe -
Executes dropped EXE 8 IoCs
pid Process 4312 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 1932 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 3688 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 3464 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 208 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 4168 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 816 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 552 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe -
Loads dropped DLL 2 IoCs
pid Process 4944 EXCEL.EXE 4944 EXCEL.EXE -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 4312 set thread context of 1932 4312 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 87 PID 4312 set thread context of 3464 4312 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 88 PID 4312 set thread context of 3688 4312 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 89 PID 208 set thread context of 4168 208 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 91 PID 208 set thread context of 816 208 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 92 PID 208 set thread context of 552 208 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 93 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3880 schtasks.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4944 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4944 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4944 EXCEL.EXE Token: SeDebugPrivilege 4312 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe Token: SeDebugPrivilege 208 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4944 EXCEL.EXE 4944 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4944 EXCEL.EXE 4944 EXCEL.EXE 4944 EXCEL.EXE 4944 EXCEL.EXE 4944 EXCEL.EXE 4944 EXCEL.EXE 4944 EXCEL.EXE 4944 EXCEL.EXE 4944 EXCEL.EXE 4944 EXCEL.EXE -
Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 4944 wrote to memory of 4312 4944 EXCEL.EXE 86 PID 4944 wrote to memory of 4312 4944 EXCEL.EXE 86 PID 4944 wrote to memory of 4312 4944 EXCEL.EXE 86 PID 4312 wrote to memory of 1932 4312 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 87 PID 4312 wrote to memory of 1932 4312 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 87 PID 4312 wrote to memory of 1932 4312 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 87 PID 4312 wrote to memory of 1932 4312 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 87 PID 4312 wrote to memory of 1932 4312 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 87 PID 4312 wrote to memory of 1932 4312 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 87 PID 4312 wrote to memory of 1932 4312 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 87 PID 4312 wrote to memory of 1932 4312 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 87 PID 4312 wrote to memory of 3464 4312 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 88 PID 4312 wrote to memory of 3464 4312 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 88 PID 4312 wrote to memory of 3464 4312 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 88 PID 4312 wrote to memory of 3464 4312 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 88 PID 4312 wrote to memory of 3464 4312 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 88 PID 4312 wrote to memory of 3464 4312 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 88 PID 4312 wrote to memory of 3464 4312 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 88 PID 4312 wrote to memory of 3464 4312 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 88 PID 4312 wrote to memory of 3688 4312 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 89 PID 4312 wrote to memory of 3688 4312 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 89 PID 4312 wrote to memory of 3688 4312 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 89 PID 4312 wrote to memory of 3688 4312 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 89 PID 4312 wrote to memory of 3688 4312 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 89 PID 4312 wrote to memory of 3688 4312 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 89 PID 4312 wrote to memory of 3688 4312 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 89 PID 4312 wrote to memory of 3688 4312 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 89 PID 1932 wrote to memory of 208 1932 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 90 PID 1932 wrote to memory of 208 1932 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 90 PID 1932 wrote to memory of 208 1932 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 90 PID 208 wrote to memory of 4168 208 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 91 PID 208 wrote to memory of 4168 208 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 91 PID 208 wrote to memory of 4168 208 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 91 PID 208 wrote to memory of 4168 208 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 91 PID 208 wrote to memory of 4168 208 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 91 PID 208 wrote to memory of 4168 208 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 91 PID 208 wrote to memory of 4168 208 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 91 PID 208 wrote to memory of 4168 208 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 91 PID 208 wrote to memory of 816 208 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 92 PID 208 wrote to memory of 816 208 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 92 PID 208 wrote to memory of 816 208 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 92 PID 208 wrote to memory of 816 208 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 92 PID 208 wrote to memory of 816 208 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 92 PID 208 wrote to memory of 816 208 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 92 PID 208 wrote to memory of 816 208 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 92 PID 208 wrote to memory of 816 208 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 92 PID 208 wrote to memory of 552 208 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 93 PID 208 wrote to memory of 552 208 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 93 PID 208 wrote to memory of 552 208 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 93 PID 208 wrote to memory of 552 208 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 93 PID 208 wrote to memory of 552 208 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 93 PID 208 wrote to memory of 552 208 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 93 PID 208 wrote to memory of 552 208 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 93 PID 208 wrote to memory of 552 208 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 93 PID 3464 wrote to memory of 3880 3464 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 102 PID 3464 wrote to memory of 3880 3464 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 102 PID 3464 wrote to memory of 3880 3464 9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe 102
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ESTADODECUENTA.xll"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe"C:\Users\Admin\AppData\Local\Temp\9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\9a19be6c-2ec8-4d65-919a-69e8d2416acb.exeC:\Users\Admin\AppData\Local\Temp\9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Roaming\XenoManager\9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe"C:\Users\Admin\AppData\Roaming\XenoManager\9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Roaming\XenoManager\9a19be6c-2ec8-4d65-919a-69e8d2416acb.exeC:\Users\Admin\AppData\Roaming\XenoManager\9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe5⤵
- Executes dropped EXE
PID:4168
-
-
C:\Users\Admin\AppData\Roaming\XenoManager\9a19be6c-2ec8-4d65-919a-69e8d2416acb.exeC:\Users\Admin\AppData\Roaming\XenoManager\9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe5⤵
- Executes dropped EXE
PID:816
-
-
C:\Users\Admin\AppData\Roaming\XenoManager\9a19be6c-2ec8-4d65-919a-69e8d2416acb.exeC:\Users\Admin\AppData\Roaming\XenoManager\9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe5⤵
- Executes dropped EXE
PID:552
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\9a19be6c-2ec8-4d65-919a-69e8d2416acb.exeC:\Users\Admin\AppData\Local\Temp\9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "qns" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5A9E.tmp" /F4⤵
- Creates scheduled task(s)
PID:3880
-
-
-
C:\Users\Admin\AppData\Local\Temp\9a19be6c-2ec8-4d65-919a-69e8d2416acb.exeC:\Users\Admin\AppData\Local\Temp\9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe3⤵
- Executes dropped EXE
PID:3688
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\9a19be6c-2ec8-4d65-919a-69e8d2416acb.exe.log
Filesize522B
MD58334a471a4b492ece225b471b8ad2fc8
SHA11cb24640f32d23e8f7800bd0511b7b9c3011d992
SHA2565612afe347d8549cc95a0c710602bcc7d7b224361b613c0a6ba362092300c169
SHA51256ae2e83355c331b00d782797f5664c2f373eac240e811aab978732503ae05eb20b08730d2427ed90efa5a706d71b42b57153596a45a6b5592e3dd9128b81c36
-
Filesize
233KB
MD5025593cacb392aadf7266febcb9f700a
SHA1602a4fcbbdaf682dc6311dc72468a00eb148ca86
SHA2566b09a61d15fd9835db561b9f7571c714333a071cce0facd8ac3dc39289ef8998
SHA5128e5c571c4905b418446cea26d8ef978706d1deb209227c602b8dbc5e9b9d23379bf42169887ee81dd287b9c07e43df733ffa7a72e4e279f9dfcec490710ed947
-
Filesize
820KB
MD5a619cded29da7704aed4a84f24da47b9
SHA116bee7cb5587cd14a5937f9f7bc32e6e065ee2fe
SHA2567b38251641313fb55b8fb461accb8af284d8c2ec11c5da53b306a0e7b3271cdd
SHA512148b07b8f1b0668e71ab46f15fe7ee41b69c88bb86543f2def6f7ffa3614d7d61268d5450c0cfe7535f8900d86074143ad6cecb5b98b6c7d9bbd64c8bc6656c0
-
Filesize
1KB
MD5e5dff63a5c1102a0b1c91318fca7f1ac
SHA148ab5d52e42b663625a31d3a7705976b085ea4d4
SHA256ae8c378e12b05106cc7a6b022aa7f72aea70011315518df01eb5aa00db0e5fb4
SHA51274784096e74e2e3e07fd7995a13633761509310dfc50ab5877a9d773db8a44231a2152f99f2376a8ab4071640b8197607d6484361c6cecea54049fbb9aaea210