Overview

overview

10

Static

static

3

c99818a50f...c5.xll

windows7-x64

7

c99818a50f...c5.xll

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-06-2024 01:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c99818a50f8c02af5204158301bf8552993c03ade20f2016b5997d440d2297c5.xll

  • Size

    819KB

  • MD5

    568383287c850ef98c2fde1c642870f2

  • SHA1

    f8487d82118c0439545fddde534bdde0250885ee

  • SHA256

    c99818a50f8c02af5204158301bf8552993c03ade20f2016b5997d440d2297c5

  • SHA512

    11e5d1b7eb2113a5d283e01ea715479f84fb401a2f0940639368cf4453f0a478c8af905aae8fdb3b05c9a090f4838cbfb9b5f0ec509d533b8ffc36ad858df3a0

  • SSDEEP

    12288:1G1N4HkcgMsiOd58bzbBSreqQ0uqZzD1reWabd/84QKycycwU636x2Cd5J:1oOOMX16+QHT+dbQKZBxP5

Score
10/10
xenoratrattrojan

Malware Config

Extracted

Language
xlm4.0
Source

Extracted

Family

xenorat

C2

91.92.248.167

Mutex

Wolid_rat_nd8889g

Attributes
  • delay

    60000

  • install_path

    appdata

  • port

    1279

  • startup_name

    qns

Signatures

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat
  • Detects executables packed with ConfuserEx Mod 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\c99818a50f8c02af5204158301bf8552993c03ade20f2016b5997d440d2297c5.xll"
    1⤵
    • Loads dropped DLL
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3532
    • C:\Users\Admin\AppData\Local\Temp\10dbf269-35b4-49a7-a632-aeb77aeb1c28.exe
      "C:\Users\Admin\AppData\Local\Temp\10dbf269-35b4-49a7-a632-aeb77aeb1c28.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:900
      • C:\Users\Admin\AppData\Local\Temp\10dbf269-35b4-49a7-a632-aeb77aeb1c28.exe
        C:\Users\Admin\AppData\Local\Temp\10dbf269-35b4-49a7-a632-aeb77aeb1c28.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1728
        • C:\Users\Admin\AppData\Roaming\XenoManager\10dbf269-35b4-49a7-a632-aeb77aeb1c28.exe
          "C:\Users\Admin\AppData\Roaming\XenoManager\10dbf269-35b4-49a7-a632-aeb77aeb1c28.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4676
          • C:\Users\Admin\AppData\Roaming\XenoManager\10dbf269-35b4-49a7-a632-aeb77aeb1c28.exe
            C:\Users\Admin\AppData\Roaming\XenoManager\10dbf269-35b4-49a7-a632-aeb77aeb1c28.exe
            5⤵
            • Executes dropped EXE
            PID:4192
          • C:\Users\Admin\AppData\Roaming\XenoManager\10dbf269-35b4-49a7-a632-aeb77aeb1c28.exe
            C:\Users\Admin\AppData\Roaming\XenoManager\10dbf269-35b4-49a7-a632-aeb77aeb1c28.exe
            5⤵
            • Executes dropped EXE
            PID:1244
          • C:\Users\Admin\AppData\Roaming\XenoManager\10dbf269-35b4-49a7-a632-aeb77aeb1c28.exe
            C:\Users\Admin\AppData\Roaming\XenoManager\10dbf269-35b4-49a7-a632-aeb77aeb1c28.exe
            5⤵
            • Executes dropped EXE
            PID:1212
      • C:\Users\Admin\AppData\Local\Temp\10dbf269-35b4-49a7-a632-aeb77aeb1c28.exe
        C:\Users\Admin\AppData\Local\Temp\10dbf269-35b4-49a7-a632-aeb77aeb1c28.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2476
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks.exe" /Create /TN "qns" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE23D.tmp" /F
          4⤵
          • Creates scheduled task(s)
          PID:3492
      • C:\Users\Admin\AppData\Local\Temp\10dbf269-35b4-49a7-a632-aeb77aeb1c28.exe
        C:\Users\Admin\AppData\Local\Temp\10dbf269-35b4-49a7-a632-aeb77aeb1c28.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of UnmapMainImage
        PID:1284
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1284 -s 12
          4⤵
          • Program crash
          PID:1616
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1284 -ip 1284
    1⤵
      PID:3416
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4088,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:8
      1⤵
        PID:1380

      Network

      MITRE ATT&CK Matrix ATT&CK v13

      Initial Access

      Execution

      Scheduled Task/Job

      1
      T1053

      Persistence

      Scheduled Task/Job

      1
      T1053

      Privilege Escalation

      Scheduled Task/Job

      1
      T1053

      Defense Evasion

      Credential Access

      Discovery

      Query Registry

      3
      T1012

      System Information Discovery

      4
      T1082

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Resource Development

      Reconnaissance

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\10dbf269-35b4-49a7-a632-aeb77aeb1c28.exe.log
        Filesize

        522B

        MD5

        8334a471a4b492ece225b471b8ad2fc8

        SHA1

        1cb24640f32d23e8f7800bd0511b7b9c3011d992

        SHA256

        5612afe347d8549cc95a0c710602bcc7d7b224361b613c0a6ba362092300c169

        SHA512

        56ae2e83355c331b00d782797f5664c2f373eac240e811aab978732503ae05eb20b08730d2427ed90efa5a706d71b42b57153596a45a6b5592e3dd9128b81c36

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\10dbf269-35b4-49a7-a632-aeb77aeb1c28.exe
        Filesize

        234KB

        MD5

        f8a5baf3665522e063b7c2a32f6e09d9

        SHA1

        fbc67542afdc39e3da28eda62c77a5fe9cdcb28e

        SHA256

        b7ec8f3a40f0f598986870753221b468160d4485825fe5056ad618300b3a9c0b

        SHA512

        6345049ce349dd282269f8afa99ff8e1fe2441f1527b0a1c90ab8e80a7fe6def964827306dd84efdeee623dc830d2dfc9001aa0f14e12e9034a9764e4870e535

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\c99818a50f8c02af5204158301bf8552993c03ade20f2016b5997d440d2297c5.xll
        Filesize

        819KB

        MD5

        568383287c850ef98c2fde1c642870f2

        SHA1

        f8487d82118c0439545fddde534bdde0250885ee

        SHA256

        c99818a50f8c02af5204158301bf8552993c03ade20f2016b5997d440d2297c5

        SHA512

        11e5d1b7eb2113a5d283e01ea715479f84fb401a2f0940639368cf4453f0a478c8af905aae8fdb3b05c9a090f4838cbfb9b5f0ec509d533b8ffc36ad858df3a0

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\tmpE23D.tmp
        Filesize

        1KB

        MD5

        b41e0edee782019d5e9769a9769af213

        SHA1

        2a2fdb433648c7cef7a3856423e02bdbf6af337b

        SHA256

        5d421c9e1bd241b5a23fe8b54b723909f8955138e425ab44f38242cbf2948632

        SHA512

        7c3aee1362f3b88c3c51a4833f596bcc7c5f342d40e8d7f5075cbd1025f5c4d0e7c61f2fab8b7f2226b4573879c6247341dfd5d050d15e6b8c7c4681d0032381

        Download Submit
      • memory/900-61-0x0000000002830000-0x0000000002836000-memory.dmp
        Filesize

        24KB

        Download
      • memory/900-60-0x0000000005100000-0x000000000519C000-memory.dmp
        Filesize

        624KB

        Download
      • memory/900-59-0x0000000004D30000-0x0000000004D6E000-memory.dmp
        Filesize

        248KB

        Download
      • memory/900-58-0x00007FF801F30000-0x00007FF802125000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/900-57-0x00000000026B0000-0x00000000026B6000-memory.dmp
        Filesize

        24KB

        Download
      • memory/900-56-0x0000000000390000-0x00000000003D0000-memory.dmp
        Filesize

        256KB

        Download
      • memory/900-55-0x00007FF801F30000-0x00007FF802125000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/1728-62-0x0000000000400000-0x0000000000412000-memory.dmp
        Filesize

        72KB

        Download
      • memory/3532-17-0x00007FF801F30000-0x00007FF802125000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/3532-37-0x00007FF801F30000-0x00007FF802125000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/3532-0-0x00007FF7C1FB0000-0x00007FF7C1FC0000-memory.dmp
        Filesize

        64KB

        Download
      • memory/3532-16-0x00007FF801F30000-0x00007FF802125000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/3532-15-0x00007FFFBF650000-0x00007FFFBF660000-memory.dmp
        Filesize

        64KB

        Download
      • memory/3532-14-0x00007FF7C0060000-0x00007FF7C0070000-memory.dmp
        Filesize

        64KB

        Download
      • memory/3532-10-0x00007FF801F30000-0x00007FF802125000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/3532-20-0x00007FF801F30000-0x00007FF802125000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/3532-19-0x00007FF801F30000-0x00007FF802125000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/3532-12-0x00007FF801F30000-0x00007FF802125000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/3532-24-0x0000019A210D0000-0x0000019A211B6000-memory.dmp
        Filesize

        920KB

        Download
      • memory/3532-25-0x00007FF801F30000-0x00007FF802125000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/3532-28-0x00007FF801F30000-0x00007FF802125000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/3532-30-0x00007FF801F30000-0x00007FF802125000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/3532-29-0x0000019A212E0000-0x0000019A212F4000-memory.dmp
        Filesize

        80KB

        Download
      • memory/3532-27-0x0000019A24660000-0x0000019A24674000-memory.dmp
        Filesize

        80KB

        Download
      • memory/3532-26-0x00007FF801F30000-0x00007FF802125000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/3532-31-0x00007FF801F30000-0x00007FF802125000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/3532-34-0x0000019A3C830000-0x0000019A3C9B4000-memory.dmp
        Filesize

        1.5MB

        Download
      • memory/3532-35-0x0000019A212F0000-0x0000019A2132C000-memory.dmp
        Filesize

        240KB

        Download
      • memory/3532-36-0x00007FF801F30000-0x00007FF802125000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/3532-18-0x00007FF801F30000-0x00007FF802125000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/3532-38-0x0000019A24710000-0x0000019A24754000-memory.dmp
        Filesize

        272KB

        Download
      • memory/3532-13-0x00007FF801F30000-0x00007FF802125000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/3532-11-0x00007FF801F30000-0x00007FF802125000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/3532-8-0x00007FFFBF650000-0x00007FFFBF660000-memory.dmp
        Filesize

        64KB

        Download
      • memory/3532-9-0x00007FF801F30000-0x00007FF802125000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/3532-7-0x00007FF801F30000-0x00007FF802125000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/3532-6-0x00007FF801F30000-0x00007FF802125000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/3532-5-0x00007FF801FCD000-0x00007FF801FCE000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3532-3-0x00007FF7C1FB0000-0x00007FF7C1FC0000-memory.dmp
        Filesize

        64KB

        Download
      • memory/3532-4-0x00007FF7C1FB0000-0x00007FF7C1FC0000-memory.dmp
        Filesize

        64KB

        Download
      • memory/3532-2-0x00007FF7C1FB0000-0x00007FF7C1FC0000-memory.dmp
        Filesize

        64KB

        Download
      • memory/3532-86-0x00007FF801F30000-0x00007FF802125000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/3532-87-0x00007FF801F30000-0x00007FF802125000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/3532-90-0x00007FF801F30000-0x00007FF802125000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/3532-91-0x00007FF801F30000-0x00007FF802125000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/3532-92-0x00007FF801F30000-0x00007FF802125000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/3532-1-0x00007FF7C1FB0000-0x00007FF7C1FC0000-memory.dmp
        Filesize

        64KB

        Download
      • memory/3532-109-0x00007FF7C1FB0000-0x00007FF7C1FC0000-memory.dmp
        Filesize

        64KB

        Download
      • memory/3532-110-0x00007FF7C1FB0000-0x00007FF7C1FC0000-memory.dmp
        Filesize

        64KB

        Download
      • memory/3532-108-0x00007FF7C1FB0000-0x00007FF7C1FC0000-memory.dmp
        Filesize

        64KB

        Download
      • memory/3532-107-0x00007FF7C1FB0000-0x00007FF7C1FC0000-memory.dmp
        Filesize

        64KB

        Download
      • memory/3532-111-0x00007FF801F30000-0x00007FF802125000-memory.dmp
        Filesize

        2.0MB

        Download