Analysis
-
max time kernel
129s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-06-2024 12:21
Static task
static1
Behavioral task
behavioral1
Sample
7c43077f843fcf5ad00e36587087929c73702171bfb36e4c5007ea54df09e37f.xll
Resource
win7-20240611-en
General
-
Target
7c43077f843fcf5ad00e36587087929c73702171bfb36e4c5007ea54df09e37f.xll
-
Size
820KB
-
MD5
0645646e6a417573d0047b6084e4632a
-
SHA1
d43adf73470cb151a61482d2e5d87f3fa1420717
-
SHA256
7c43077f843fcf5ad00e36587087929c73702171bfb36e4c5007ea54df09e37f
-
SHA512
36daebde0a113fae75301f4b3bc09860b6c17788e3f132cd25cf66b1d6b726bf6df4ba80add24009bc1d5fb566359d3e4be6d54456fbbe733059e106f5878f87
-
SSDEEP
12288:BG1N4HkcgMsiOd58bzbBSrePQ0uqZzD1reWabd/T7ppePgEKB9S4566Gwa:BoOOMX1/+QHT+d77ppqWB9S4Q6y
Malware Config
Extracted
Extracted
xenorat
91.92.248.167
Wolid_rat_nd8889g
-
delay
60000
-
install_path
appdata
-
port
1279
-
startup_name
qns
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe -
Executes dropped EXE 8 IoCs
pid Process 1440 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 3456 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 1932 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 4812 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 4936 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 4400 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 4956 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 4184 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe -
Loads dropped DLL 2 IoCs
pid Process 4084 EXCEL.EXE 4084 EXCEL.EXE -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 1440 set thread context of 3456 1440 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 82 PID 1440 set thread context of 1932 1440 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 83 PID 1440 set thread context of 4812 1440 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 84 PID 4936 set thread context of 4400 4936 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 86 PID 4936 set thread context of 4956 4936 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 87 PID 4936 set thread context of 4184 4936 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 88 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2560 schtasks.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4084 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4084 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4084 EXCEL.EXE Token: SeDebugPrivilege 1440 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe Token: SeDebugPrivilege 4936 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4084 EXCEL.EXE 4084 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4084 EXCEL.EXE 4084 EXCEL.EXE 4084 EXCEL.EXE 4084 EXCEL.EXE 4084 EXCEL.EXE 4084 EXCEL.EXE 4084 EXCEL.EXE 4084 EXCEL.EXE 4084 EXCEL.EXE 4084 EXCEL.EXE -
Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 4084 wrote to memory of 1440 4084 EXCEL.EXE 81 PID 4084 wrote to memory of 1440 4084 EXCEL.EXE 81 PID 4084 wrote to memory of 1440 4084 EXCEL.EXE 81 PID 1440 wrote to memory of 3456 1440 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 82 PID 1440 wrote to memory of 3456 1440 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 82 PID 1440 wrote to memory of 3456 1440 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 82 PID 1440 wrote to memory of 3456 1440 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 82 PID 1440 wrote to memory of 3456 1440 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 82 PID 1440 wrote to memory of 3456 1440 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 82 PID 1440 wrote to memory of 3456 1440 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 82 PID 1440 wrote to memory of 3456 1440 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 82 PID 1440 wrote to memory of 1932 1440 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 83 PID 1440 wrote to memory of 1932 1440 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 83 PID 1440 wrote to memory of 1932 1440 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 83 PID 1440 wrote to memory of 1932 1440 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 83 PID 1440 wrote to memory of 1932 1440 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 83 PID 1440 wrote to memory of 1932 1440 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 83 PID 1440 wrote to memory of 1932 1440 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 83 PID 1440 wrote to memory of 1932 1440 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 83 PID 1440 wrote to memory of 4812 1440 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 84 PID 1440 wrote to memory of 4812 1440 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 84 PID 1440 wrote to memory of 4812 1440 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 84 PID 1440 wrote to memory of 4812 1440 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 84 PID 1440 wrote to memory of 4812 1440 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 84 PID 1440 wrote to memory of 4812 1440 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 84 PID 1440 wrote to memory of 4812 1440 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 84 PID 1440 wrote to memory of 4812 1440 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 84 PID 3456 wrote to memory of 4936 3456 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 85 PID 3456 wrote to memory of 4936 3456 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 85 PID 3456 wrote to memory of 4936 3456 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 85 PID 4936 wrote to memory of 4400 4936 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 86 PID 4936 wrote to memory of 4400 4936 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 86 PID 4936 wrote to memory of 4400 4936 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 86 PID 4936 wrote to memory of 4400 4936 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 86 PID 4936 wrote to memory of 4400 4936 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 86 PID 4936 wrote to memory of 4400 4936 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 86 PID 4936 wrote to memory of 4400 4936 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 86 PID 4936 wrote to memory of 4400 4936 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 86 PID 4936 wrote to memory of 4956 4936 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 87 PID 4936 wrote to memory of 4956 4936 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 87 PID 4936 wrote to memory of 4956 4936 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 87 PID 4936 wrote to memory of 4956 4936 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 87 PID 4936 wrote to memory of 4956 4936 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 87 PID 4936 wrote to memory of 4956 4936 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 87 PID 4936 wrote to memory of 4956 4936 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 87 PID 4936 wrote to memory of 4956 4936 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 87 PID 4936 wrote to memory of 4184 4936 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 88 PID 4936 wrote to memory of 4184 4936 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 88 PID 4936 wrote to memory of 4184 4936 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 88 PID 4936 wrote to memory of 4184 4936 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 88 PID 4936 wrote to memory of 4184 4936 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 88 PID 4936 wrote to memory of 4184 4936 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 88 PID 4936 wrote to memory of 4184 4936 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 88 PID 4936 wrote to memory of 4184 4936 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 88 PID 1932 wrote to memory of 2560 1932 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 99 PID 1932 wrote to memory of 2560 1932 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 99 PID 1932 wrote to memory of 2560 1932 f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe 99
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\7c43077f843fcf5ad00e36587087929c73702171bfb36e4c5007ea54df09e37f.xll"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe"C:\Users\Admin\AppData\Local\Temp\f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exeC:\Users\Admin\AppData\Local\Temp\f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Roaming\XenoManager\f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe"C:\Users\Admin\AppData\Roaming\XenoManager\f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Roaming\XenoManager\f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exeC:\Users\Admin\AppData\Roaming\XenoManager\f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe5⤵
- Executes dropped EXE
PID:4400
-
-
C:\Users\Admin\AppData\Roaming\XenoManager\f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exeC:\Users\Admin\AppData\Roaming\XenoManager\f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe5⤵
- Executes dropped EXE
PID:4956
-
-
C:\Users\Admin\AppData\Roaming\XenoManager\f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exeC:\Users\Admin\AppData\Roaming\XenoManager\f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe5⤵
- Executes dropped EXE
PID:4184
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exeC:\Users\Admin\AppData\Local\Temp\f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "qns" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3294.tmp" /F4⤵
- Creates scheduled task(s)
PID:2560
-
-
-
C:\Users\Admin\AppData\Local\Temp\f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exeC:\Users\Admin\AppData\Local\Temp\f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe3⤵
- Executes dropped EXE
PID:4812
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\f9fc7247-a9d6-41d5-af7c-0e75e35c7528.exe.log
Filesize522B
MD58334a471a4b492ece225b471b8ad2fc8
SHA11cb24640f32d23e8f7800bd0511b7b9c3011d992
SHA2565612afe347d8549cc95a0c710602bcc7d7b224361b613c0a6ba362092300c169
SHA51256ae2e83355c331b00d782797f5664c2f373eac240e811aab978732503ae05eb20b08730d2427ed90efa5a706d71b42b57153596a45a6b5592e3dd9128b81c36
-
C:\Users\Admin\AppData\Local\Temp\7c43077f843fcf5ad00e36587087929c73702171bfb36e4c5007ea54df09e37f.xll
Filesize820KB
MD50645646e6a417573d0047b6084e4632a
SHA1d43adf73470cb151a61482d2e5d87f3fa1420717
SHA2567c43077f843fcf5ad00e36587087929c73702171bfb36e4c5007ea54df09e37f
SHA51236daebde0a113fae75301f4b3bc09860b6c17788e3f132cd25cf66b1d6b726bf6df4ba80add24009bc1d5fb566359d3e4be6d54456fbbe733059e106f5878f87
-
Filesize
234KB
MD5a19378142ff17ef4a4cef4add24b10aa
SHA16231b66cdbea1a29043dfee2bfc4772b241bae98
SHA256789cec98f94a74b862783c6f3a41794f375b775b81f291798fde8b3653e96bb9
SHA5120eefc81ff23ac4e02d85fce6c0d10d819f6856d6ac19b0df28e786242f6cc158bbee057fc2097e5b44caafd58d6e7b8ccd4063f40fedd8eb5e4be3d3d16de1c1
-
Filesize
1KB
MD5373efc08517bfd0a0121ebdec9257867
SHA18352c967be3800c9ebd516f4bb7afe939c19fcfe
SHA25667c5537f0f61a3abf2e8aefbda03d24274ca96ac8e1ae75907bfbbe59b6f0f96
SHA51251f469f3e6b5fc37e9f7258e4bbc5ed373bd98bc2e62886e8e7713c69ebb6517d17135f872343080308e0a3ac2c75979425beb7343af208c680ef0f37edb9710