Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
16-06-2024 01:14
Static task
static1
Behavioral task
behavioral1
Sample
7c43077f843fcf5ad00e36587087929c73702171bfb36e4c5007ea54df09e37f.xll
Resource
win7-20240220-en
General
-
Target
7c43077f843fcf5ad00e36587087929c73702171bfb36e4c5007ea54df09e37f.xll
-
Size
820KB
-
MD5
0645646e6a417573d0047b6084e4632a
-
SHA1
d43adf73470cb151a61482d2e5d87f3fa1420717
-
SHA256
7c43077f843fcf5ad00e36587087929c73702171bfb36e4c5007ea54df09e37f
-
SHA512
36daebde0a113fae75301f4b3bc09860b6c17788e3f132cd25cf66b1d6b726bf6df4ba80add24009bc1d5fb566359d3e4be6d54456fbbe733059e106f5878f87
-
SSDEEP
12288:BG1N4HkcgMsiOd58bzbBSrePQ0uqZzD1reWabd/T7ppePgEKB9S4566Gwa:BoOOMX1/+QHT+d77ppqWB9S4Q6y
Malware Config
Extracted
Extracted
xenorat
91.92.248.167
Wolid_rat_nd8889g
-
delay
60000
-
install_path
appdata
-
port
1279
-
startup_name
qns
Signatures
-
Detects executables packed with ConfuserEx Mod 4 IoCs
resource yara_rule behavioral2/memory/4252-35-0x000001231D0C0000-0x000001231D104000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x00020000000229b6-43.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/3684-53-0x0000000000E50000-0x0000000000E90000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/3684-56-0x00000000056A0000-0x00000000056DE000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe -
Executes dropped EXE 8 IoCs
pid Process 3684 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 1144 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 3092 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 3432 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 1320 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 3592 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 2472 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 4860 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe -
Loads dropped DLL 2 IoCs
pid Process 4252 EXCEL.EXE 4252 EXCEL.EXE -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 3684 set thread context of 1144 3684 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 88 PID 3684 set thread context of 3092 3684 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 89 PID 3684 set thread context of 3432 3684 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 90 PID 1320 set thread context of 3592 1320 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 95 PID 1320 set thread context of 2472 1320 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 96 PID 1320 set thread context of 4860 1320 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 97 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 2976 3432 WerFault.exe 90 4716 2472 WerFault.exe 96 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2896 schtasks.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4252 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4252 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4252 EXCEL.EXE Token: SeDebugPrivilege 3684 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe Token: SeDebugPrivilege 1320 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4252 EXCEL.EXE 4252 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4252 EXCEL.EXE 4252 EXCEL.EXE 4252 EXCEL.EXE 4252 EXCEL.EXE 4252 EXCEL.EXE 4252 EXCEL.EXE 4252 EXCEL.EXE 4252 EXCEL.EXE 4252 EXCEL.EXE 4252 EXCEL.EXE -
Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 4252 wrote to memory of 3684 4252 EXCEL.EXE 85 PID 4252 wrote to memory of 3684 4252 EXCEL.EXE 85 PID 4252 wrote to memory of 3684 4252 EXCEL.EXE 85 PID 3684 wrote to memory of 1144 3684 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 88 PID 3684 wrote to memory of 1144 3684 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 88 PID 3684 wrote to memory of 1144 3684 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 88 PID 3684 wrote to memory of 1144 3684 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 88 PID 3684 wrote to memory of 1144 3684 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 88 PID 3684 wrote to memory of 1144 3684 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 88 PID 3684 wrote to memory of 1144 3684 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 88 PID 3684 wrote to memory of 1144 3684 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 88 PID 3684 wrote to memory of 3092 3684 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 89 PID 3684 wrote to memory of 3092 3684 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 89 PID 3684 wrote to memory of 3092 3684 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 89 PID 3684 wrote to memory of 3092 3684 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 89 PID 3684 wrote to memory of 3092 3684 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 89 PID 3684 wrote to memory of 3092 3684 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 89 PID 3684 wrote to memory of 3092 3684 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 89 PID 3684 wrote to memory of 3092 3684 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 89 PID 3684 wrote to memory of 3432 3684 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 90 PID 3684 wrote to memory of 3432 3684 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 90 PID 3684 wrote to memory of 3432 3684 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 90 PID 3684 wrote to memory of 3432 3684 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 90 PID 3684 wrote to memory of 3432 3684 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 90 PID 3684 wrote to memory of 3432 3684 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 90 PID 3684 wrote to memory of 3432 3684 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 90 PID 3684 wrote to memory of 3432 3684 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 90 PID 1144 wrote to memory of 1320 1144 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 93 PID 1144 wrote to memory of 1320 1144 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 93 PID 1144 wrote to memory of 1320 1144 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 93 PID 1320 wrote to memory of 3592 1320 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 95 PID 1320 wrote to memory of 3592 1320 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 95 PID 1320 wrote to memory of 3592 1320 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 95 PID 1320 wrote to memory of 3592 1320 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 95 PID 1320 wrote to memory of 3592 1320 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 95 PID 1320 wrote to memory of 3592 1320 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 95 PID 1320 wrote to memory of 3592 1320 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 95 PID 1320 wrote to memory of 3592 1320 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 95 PID 1320 wrote to memory of 2472 1320 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 96 PID 1320 wrote to memory of 2472 1320 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 96 PID 1320 wrote to memory of 2472 1320 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 96 PID 1320 wrote to memory of 2472 1320 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 96 PID 1320 wrote to memory of 2472 1320 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 96 PID 1320 wrote to memory of 2472 1320 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 96 PID 1320 wrote to memory of 2472 1320 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 96 PID 1320 wrote to memory of 2472 1320 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 96 PID 1320 wrote to memory of 4860 1320 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 97 PID 1320 wrote to memory of 4860 1320 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 97 PID 1320 wrote to memory of 4860 1320 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 97 PID 1320 wrote to memory of 4860 1320 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 97 PID 1320 wrote to memory of 4860 1320 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 97 PID 1320 wrote to memory of 4860 1320 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 97 PID 1320 wrote to memory of 4860 1320 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 97 PID 1320 wrote to memory of 4860 1320 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 97 PID 3092 wrote to memory of 2896 3092 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 102 PID 3092 wrote to memory of 2896 3092 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 102 PID 3092 wrote to memory of 2896 3092 30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe 102
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\7c43077f843fcf5ad00e36587087929c73702171bfb36e4c5007ea54df09e37f.xll"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe"C:\Users\Admin\AppData\Local\Temp\30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\30f11a26-c0c4-4d05-b91c-0fadb1df4023.exeC:\Users\Admin\AppData\Local\Temp\30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Roaming\XenoManager\30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe"C:\Users\Admin\AppData\Roaming\XenoManager\30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Roaming\XenoManager\30f11a26-c0c4-4d05-b91c-0fadb1df4023.exeC:\Users\Admin\AppData\Roaming\XenoManager\30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe5⤵
- Executes dropped EXE
PID:3592
-
-
C:\Users\Admin\AppData\Roaming\XenoManager\30f11a26-c0c4-4d05-b91c-0fadb1df4023.exeC:\Users\Admin\AppData\Roaming\XenoManager\30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe5⤵
- Executes dropped EXE
PID:2472 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 806⤵
- Program crash
PID:4716
-
-
-
C:\Users\Admin\AppData\Roaming\XenoManager\30f11a26-c0c4-4d05-b91c-0fadb1df4023.exeC:\Users\Admin\AppData\Roaming\XenoManager\30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe5⤵
- Executes dropped EXE
PID:4860
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\30f11a26-c0c4-4d05-b91c-0fadb1df4023.exeC:\Users\Admin\AppData\Local\Temp\30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "qns" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5CE0.tmp" /F4⤵
- Creates scheduled task(s)
PID:2896
-
-
-
C:\Users\Admin\AppData\Local\Temp\30f11a26-c0c4-4d05-b91c-0fadb1df4023.exeC:\Users\Admin\AppData\Local\Temp\30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe3⤵
- Executes dropped EXE
PID:3432 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 804⤵
- Program crash
PID:2976
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3432 -ip 34321⤵PID:892
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2472 -ip 24721⤵PID:4552
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\30f11a26-c0c4-4d05-b91c-0fadb1df4023.exe.log
Filesize522B
MD58334a471a4b492ece225b471b8ad2fc8
SHA11cb24640f32d23e8f7800bd0511b7b9c3011d992
SHA2565612afe347d8549cc95a0c710602bcc7d7b224361b613c0a6ba362092300c169
SHA51256ae2e83355c331b00d782797f5664c2f373eac240e811aab978732503ae05eb20b08730d2427ed90efa5a706d71b42b57153596a45a6b5592e3dd9128b81c36
-
Filesize
234KB
MD5a19378142ff17ef4a4cef4add24b10aa
SHA16231b66cdbea1a29043dfee2bfc4772b241bae98
SHA256789cec98f94a74b862783c6f3a41794f375b775b81f291798fde8b3653e96bb9
SHA5120eefc81ff23ac4e02d85fce6c0d10d819f6856d6ac19b0df28e786242f6cc158bbee057fc2097e5b44caafd58d6e7b8ccd4063f40fedd8eb5e4be3d3d16de1c1
-
C:\Users\Admin\AppData\Local\Temp\7c43077f843fcf5ad00e36587087929c73702171bfb36e4c5007ea54df09e37f.xll
Filesize820KB
MD50645646e6a417573d0047b6084e4632a
SHA1d43adf73470cb151a61482d2e5d87f3fa1420717
SHA2567c43077f843fcf5ad00e36587087929c73702171bfb36e4c5007ea54df09e37f
SHA51236daebde0a113fae75301f4b3bc09860b6c17788e3f132cd25cf66b1d6b726bf6df4ba80add24009bc1d5fb566359d3e4be6d54456fbbe733059e106f5878f87
-
Filesize
1KB
MD5eceebd691cc742f1a92b9e9aaa31a231
SHA14e75433fe80f6aa6a8f38e259ed8fa120cd345af
SHA256a2e634a5f4572e206595469046f2801c3b9095feb42313aba110161ed47efa69
SHA5120be47d178d7486d884d40e8602201e6ce8580ac345f932f5e70a8c378874d1f44afb8837310a152e5e6efd31dd0ea7fb2a300fb877acc817345a748205faee76