Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
15-06-2024 12:58
Static task
static1
Behavioral task
behavioral1
Sample
2c6977ae3de5f4439b178da21bd279e3181dfc394eaad65ed1b006dfb3b25d5b.xll
Resource
win7-20240611-en
General
-
Target
2c6977ae3de5f4439b178da21bd279e3181dfc394eaad65ed1b006dfb3b25d5b.xll
-
Size
832KB
-
MD5
8d31657e3cc733753f129c0a8ab9dd35
-
SHA1
c5d9d5ddba7c1d9ee76c6ee21a5f6dcad1dbe82e
-
SHA256
2c6977ae3de5f4439b178da21bd279e3181dfc394eaad65ed1b006dfb3b25d5b
-
SHA512
381adba099f21f6b0ffa1ca70709ea5d3c3d4e7f87dc205b14e947c0c2353988d20c9fcf7732ac46a4e06fe4cfd6aa975c08e8357e2454ef2863fdac63015e34
-
SSDEEP
12288:jG1N4HkcgMsiOd58bzbBSreWQ0uqZzD1reWabd/aEce45oJNb1qX90YdquL:joOOMX1m+QHT+dCEcelJJ1qtHPL
Malware Config
Extracted
Extracted
xenorat
salutoepiesircam.sytes.net
Xeno_rat_nd8911d
-
delay
5000
-
install_path
appdata
-
port
4450
-
startup_name
setting
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation 15f51430-94b3-4965-82a8-659f8b27d2e0.exe -
Executes dropped EXE 6 IoCs
pid Process 1768 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 4248 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 548 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 2504 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 2324 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 3656 15f51430-94b3-4965-82a8-659f8b27d2e0.exe -
Loads dropped DLL 2 IoCs
pid Process 4160 EXCEL.EXE 4160 EXCEL.EXE -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1768 set thread context of 4248 1768 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 95 PID 1768 set thread context of 548 1768 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 96 PID 2504 set thread context of 2324 2504 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 98 PID 2504 set thread context of 3656 2504 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 99 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3680 schtasks.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4160 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4160 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4160 EXCEL.EXE Token: SeDebugPrivilege 1768 15f51430-94b3-4965-82a8-659f8b27d2e0.exe Token: SeDebugPrivilege 2504 15f51430-94b3-4965-82a8-659f8b27d2e0.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4160 EXCEL.EXE 4160 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4160 EXCEL.EXE 4160 EXCEL.EXE 4160 EXCEL.EXE 4160 EXCEL.EXE 4160 EXCEL.EXE 4160 EXCEL.EXE 4160 EXCEL.EXE 4160 EXCEL.EXE 4160 EXCEL.EXE 4160 EXCEL.EXE -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 4160 wrote to memory of 1768 4160 EXCEL.EXE 94 PID 4160 wrote to memory of 1768 4160 EXCEL.EXE 94 PID 4160 wrote to memory of 1768 4160 EXCEL.EXE 94 PID 1768 wrote to memory of 4248 1768 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 95 PID 1768 wrote to memory of 4248 1768 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 95 PID 1768 wrote to memory of 4248 1768 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 95 PID 1768 wrote to memory of 4248 1768 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 95 PID 1768 wrote to memory of 4248 1768 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 95 PID 1768 wrote to memory of 4248 1768 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 95 PID 1768 wrote to memory of 4248 1768 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 95 PID 1768 wrote to memory of 4248 1768 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 95 PID 1768 wrote to memory of 548 1768 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 96 PID 1768 wrote to memory of 548 1768 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 96 PID 1768 wrote to memory of 548 1768 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 96 PID 1768 wrote to memory of 548 1768 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 96 PID 1768 wrote to memory of 548 1768 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 96 PID 1768 wrote to memory of 548 1768 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 96 PID 1768 wrote to memory of 548 1768 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 96 PID 1768 wrote to memory of 548 1768 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 96 PID 4248 wrote to memory of 2504 4248 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 97 PID 4248 wrote to memory of 2504 4248 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 97 PID 4248 wrote to memory of 2504 4248 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 97 PID 2504 wrote to memory of 2324 2504 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 98 PID 2504 wrote to memory of 2324 2504 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 98 PID 2504 wrote to memory of 2324 2504 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 98 PID 2504 wrote to memory of 2324 2504 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 98 PID 2504 wrote to memory of 2324 2504 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 98 PID 2504 wrote to memory of 2324 2504 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 98 PID 2504 wrote to memory of 2324 2504 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 98 PID 2504 wrote to memory of 2324 2504 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 98 PID 2504 wrote to memory of 3656 2504 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 99 PID 2504 wrote to memory of 3656 2504 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 99 PID 2504 wrote to memory of 3656 2504 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 99 PID 2504 wrote to memory of 3656 2504 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 99 PID 2504 wrote to memory of 3656 2504 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 99 PID 2504 wrote to memory of 3656 2504 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 99 PID 2504 wrote to memory of 3656 2504 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 99 PID 2504 wrote to memory of 3656 2504 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 99 PID 548 wrote to memory of 3680 548 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 101 PID 548 wrote to memory of 3680 548 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 101 PID 548 wrote to memory of 3680 548 15f51430-94b3-4965-82a8-659f8b27d2e0.exe 101
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\2c6977ae3de5f4439b178da21bd279e3181dfc394eaad65ed1b006dfb3b25d5b.xll"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\15f51430-94b3-4965-82a8-659f8b27d2e0.exe"C:\Users\Admin\AppData\Local\Temp\15f51430-94b3-4965-82a8-659f8b27d2e0.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\15f51430-94b3-4965-82a8-659f8b27d2e0.exeC:\Users\Admin\AppData\Local\Temp\15f51430-94b3-4965-82a8-659f8b27d2e0.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Roaming\XenoManager\15f51430-94b3-4965-82a8-659f8b27d2e0.exe"C:\Users\Admin\AppData\Roaming\XenoManager\15f51430-94b3-4965-82a8-659f8b27d2e0.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Roaming\XenoManager\15f51430-94b3-4965-82a8-659f8b27d2e0.exeC:\Users\Admin\AppData\Roaming\XenoManager\15f51430-94b3-4965-82a8-659f8b27d2e0.exe5⤵
- Executes dropped EXE
PID:2324
-
-
C:\Users\Admin\AppData\Roaming\XenoManager\15f51430-94b3-4965-82a8-659f8b27d2e0.exeC:\Users\Admin\AppData\Roaming\XenoManager\15f51430-94b3-4965-82a8-659f8b27d2e0.exe5⤵
- Executes dropped EXE
PID:3656
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\15f51430-94b3-4965-82a8-659f8b27d2e0.exeC:\Users\Admin\AppData\Local\Temp\15f51430-94b3-4965-82a8-659f8b27d2e0.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "setting" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEE29.tmp" /F4⤵
- Creates scheduled task(s)
PID:3680
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1028,i,4778049104057176787,6631751660692402210,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:81⤵PID:5040
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\15f51430-94b3-4965-82a8-659f8b27d2e0.exe.log
Filesize706B
MD5d95c58e609838928f0f49837cab7dfd2
SHA155e7139a1e3899195b92ed8771d1ca2c7d53c916
SHA2560407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339
SHA512405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d
-
Filesize
237KB
MD575d3859dfcf940cc1da679fc66e9b7e1
SHA1343e5170eadfc2a3706bab50b422fa4d8103286f
SHA256d5c9c960a1bc89923c8ec30aebd6fb9389e1cc8937540c2284d5344a967465f6
SHA5121f825f829f055bf2f63243353a83834e0109b7f696a067ca9530bcf83db4697ecc6e353c4602a371a0bc7a514e42bd3720c128ac797444bf1eac6d859c842d49
-
C:\Users\Admin\AppData\Local\Temp\2c6977ae3de5f4439b178da21bd279e3181dfc394eaad65ed1b006dfb3b25d5b.xll
Filesize832KB
MD58d31657e3cc733753f129c0a8ab9dd35
SHA1c5d9d5ddba7c1d9ee76c6ee21a5f6dcad1dbe82e
SHA2562c6977ae3de5f4439b178da21bd279e3181dfc394eaad65ed1b006dfb3b25d5b
SHA512381adba099f21f6b0ffa1ca70709ea5d3c3d4e7f87dc205b14e947c0c2353988d20c9fcf7732ac46a4e06fe4cfd6aa975c08e8357e2454ef2863fdac63015e34
-
Filesize
1KB
MD5c5424e8baaec31074c4e7782238d9955
SHA19919d6a4629deeacb6a010e99b8a41a0af1d3886
SHA25608f25d1774658cdff43bbc49fe33f00197ff385a8318e209465d1c7a33125746
SHA512c73f208b99417ce48e7fea7b7ace7c5a515f0a61dac5cded3bbb2cb30fd46588e74371c55a02f05436962209f2f41823b8b9be5c88c85f44d9cf0abcd0907c86