Overview

overview

10

Static

static

3

c99818a50f...c5.xll

windows7-x64

7

c99818a50f...c5.xll

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-06-2024 13:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c99818a50f8c02af5204158301bf8552993c03ade20f2016b5997d440d2297c5.xll

  • Size

    819KB

  • MD5

    568383287c850ef98c2fde1c642870f2

  • SHA1

    f8487d82118c0439545fddde534bdde0250885ee

  • SHA256

    c99818a50f8c02af5204158301bf8552993c03ade20f2016b5997d440d2297c5

  • SHA512

    11e5d1b7eb2113a5d283e01ea715479f84fb401a2f0940639368cf4453f0a478c8af905aae8fdb3b05c9a090f4838cbfb9b5f0ec509d533b8ffc36ad858df3a0

  • SSDEEP

    12288:1G1N4HkcgMsiOd58bzbBSreqQ0uqZzD1reWabd/84QKycycwU636x2Cd5J:1oOOMX16+QHT+dbQKZBxP5

Score
10/10
xenoratrattrojan

Malware Config

Extracted

Language
xlm4.0
Source

Extracted

Family

xenorat

C2

91.92.248.167

Mutex

Wolid_rat_nd8889g

Attributes
  • delay

    60000

  • install_path

    appdata

  • port

    1279

  • startup_name

    qns

Signatures

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\c99818a50f8c02af5204158301bf8552993c03ade20f2016b5997d440d2297c5.xll"
    1⤵
    • Loads dropped DLL
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3080
    • C:\Users\Admin\AppData\Local\Temp\0e303da4-0d46-4073-aae6-0f3811b914ce.exe
      "C:\Users\Admin\AppData\Local\Temp\0e303da4-0d46-4073-aae6-0f3811b914ce.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1148
      • C:\Users\Admin\AppData\Local\Temp\0e303da4-0d46-4073-aae6-0f3811b914ce.exe
        C:\Users\Admin\AppData\Local\Temp\0e303da4-0d46-4073-aae6-0f3811b914ce.exe
        3⤵
        • Executes dropped EXE
        PID:4996
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 80
          4⤵
          • Program crash
          PID:740
      • C:\Users\Admin\AppData\Local\Temp\0e303da4-0d46-4073-aae6-0f3811b914ce.exe
        C:\Users\Admin\AppData\Local\Temp\0e303da4-0d46-4073-aae6-0f3811b914ce.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3676
        • C:\Users\Admin\AppData\Roaming\XenoManager\0e303da4-0d46-4073-aae6-0f3811b914ce.exe
          "C:\Users\Admin\AppData\Roaming\XenoManager\0e303da4-0d46-4073-aae6-0f3811b914ce.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2696
          • C:\Users\Admin\AppData\Roaming\XenoManager\0e303da4-0d46-4073-aae6-0f3811b914ce.exe
            C:\Users\Admin\AppData\Roaming\XenoManager\0e303da4-0d46-4073-aae6-0f3811b914ce.exe
            5⤵
            • Executes dropped EXE
            PID:2208
          • C:\Users\Admin\AppData\Roaming\XenoManager\0e303da4-0d46-4073-aae6-0f3811b914ce.exe
            C:\Users\Admin\AppData\Roaming\XenoManager\0e303da4-0d46-4073-aae6-0f3811b914ce.exe
            5⤵
            • Executes dropped EXE
            PID:2448
          • C:\Users\Admin\AppData\Roaming\XenoManager\0e303da4-0d46-4073-aae6-0f3811b914ce.exe
            C:\Users\Admin\AppData\Roaming\XenoManager\0e303da4-0d46-4073-aae6-0f3811b914ce.exe
            5⤵
            • Executes dropped EXE
            PID:4244
      • C:\Users\Admin\AppData\Local\Temp\0e303da4-0d46-4073-aae6-0f3811b914ce.exe
        C:\Users\Admin\AppData\Local\Temp\0e303da4-0d46-4073-aae6-0f3811b914ce.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3408
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks.exe" /Create /TN "qns" /XML "C:\Users\Admin\AppData\Local\Temp\tmp409E.tmp" /F
          4⤵
          • Creates scheduled task(s)
          PID:3872
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4996 -ip 4996
    1⤵
      PID:5100

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Scheduled Task/Job

    1
    T1053

    Persistence

    Scheduled Task/Job

    1
    T1053

    Privilege Escalation

    Scheduled Task/Job

    1
    T1053

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    3
    T1012

    System Information Discovery

    4
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\0e303da4-0d46-4073-aae6-0f3811b914ce.exe.log
      Filesize

      522B

      MD5

      8334a471a4b492ece225b471b8ad2fc8

      SHA1

      1cb24640f32d23e8f7800bd0511b7b9c3011d992

      SHA256

      5612afe347d8549cc95a0c710602bcc7d7b224361b613c0a6ba362092300c169

      SHA512

      56ae2e83355c331b00d782797f5664c2f373eac240e811aab978732503ae05eb20b08730d2427ed90efa5a706d71b42b57153596a45a6b5592e3dd9128b81c36

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\0e303da4-0d46-4073-aae6-0f3811b914ce.exe
      Filesize

      234KB

      MD5

      f8a5baf3665522e063b7c2a32f6e09d9

      SHA1

      fbc67542afdc39e3da28eda62c77a5fe9cdcb28e

      SHA256

      b7ec8f3a40f0f598986870753221b468160d4485825fe5056ad618300b3a9c0b

      SHA512

      6345049ce349dd282269f8afa99ff8e1fe2441f1527b0a1c90ab8e80a7fe6def964827306dd84efdeee623dc830d2dfc9001aa0f14e12e9034a9764e4870e535

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\c99818a50f8c02af5204158301bf8552993c03ade20f2016b5997d440d2297c5.xll
      Filesize

      819KB

      MD5

      568383287c850ef98c2fde1c642870f2

      SHA1

      f8487d82118c0439545fddde534bdde0250885ee

      SHA256

      c99818a50f8c02af5204158301bf8552993c03ade20f2016b5997d440d2297c5

      SHA512

      11e5d1b7eb2113a5d283e01ea715479f84fb401a2f0940639368cf4453f0a478c8af905aae8fdb3b05c9a090f4838cbfb9b5f0ec509d533b8ffc36ad858df3a0

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\tmp409E.tmp
      Filesize

      1KB

      MD5

      e06bb569120b4f8a56aa82a4f69deb53

      SHA1

      d0b6a030224aa09bd7aa8f9e3a255c6d0a092520

      SHA256

      e13e064e380ddf6a23de0cd3a8e5b423779905cbe26d98eb552a6a665212aa18

      SHA512

      d775b9bfc76b354c5a61160c7c224cd5d19181dc8e1b428300f8514fc5f5f6154412439513abc639c197da54f6219db0b9f4f31257cfabc579cfe236daac86b7

      Download Submit
    • memory/1148-71-0x00007FF852AD0000-0x00007FF852CC5000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/1148-61-0x0000000002530000-0x0000000002536000-memory.dmp
      Filesize

      24KB

      Download
    • memory/1148-57-0x0000000004DB0000-0x0000000004E4C000-memory.dmp
      Filesize

      624KB

      Download
    • memory/1148-56-0x0000000004CD0000-0x0000000004D0E000-memory.dmp
      Filesize

      248KB

      Download
    • memory/1148-55-0x0000000000B50000-0x0000000000B56000-memory.dmp
      Filesize

      24KB

      Download
    • memory/1148-52-0x0000000000250000-0x0000000000290000-memory.dmp
      Filesize

      256KB

      Download
    • memory/1148-51-0x00007FF852AD0000-0x00007FF852CC5000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/3080-16-0x00007FF8101F0000-0x00007FF810200000-memory.dmp
      Filesize

      64KB

      Download
    • memory/3080-29-0x00007FF852AD0000-0x00007FF852CC5000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/3080-0-0x00007FF812B50000-0x00007FF812B60000-memory.dmp
      Filesize

      64KB

      Download
    • memory/3080-19-0x00007FF852AD0000-0x00007FF852CC5000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/3080-20-0x00007FF852AD0000-0x00007FF852CC5000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/3080-21-0x00007FF852AD0000-0x00007FF852CC5000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/3080-18-0x00007FF852AD0000-0x00007FF852CC5000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/3080-17-0x00007FF852AD0000-0x00007FF852CC5000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/3080-15-0x00007FF852AD0000-0x00007FF852CC5000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/3080-14-0x00007FF852AD0000-0x00007FF852CC5000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/3080-13-0x00007FF852AD0000-0x00007FF852CC5000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/3080-11-0x00007FF852AD0000-0x00007FF852CC5000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/3080-23-0x000001F5B3B20000-0x000001F5B3C06000-memory.dmp
      Filesize

      920KB

      Download
    • memory/3080-26-0x000001F5B3CA0000-0x000001F5B3CB4000-memory.dmp
      Filesize

      80KB

      Download
    • memory/3080-28-0x00007FF852AD0000-0x00007FF852CC5000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/3080-32-0x000001F5B5210000-0x000001F5B524C000-memory.dmp
      Filesize

      240KB

      Download
    • memory/3080-33-0x00007FF852AD0000-0x00007FF852CC5000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/3080-31-0x000001F5CD690000-0x000001F5CD814000-memory.dmp
      Filesize

      1.5MB

      Download
    • memory/3080-34-0x00007FF852AD0000-0x00007FF852CC5000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/3080-30-0x00007FF852AD0000-0x00007FF852CC5000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/3080-35-0x000001F5B53D0000-0x000001F5B5414000-memory.dmp
      Filesize

      272KB

      Download
    • memory/3080-12-0x00007FF852AD0000-0x00007FF852CC5000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/3080-36-0x00007FF852AD0000-0x00007FF852CC5000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/3080-38-0x00007FF852AD0000-0x00007FF852CC5000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/3080-10-0x00007FF852AD0000-0x00007FF852CC5000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/3080-3-0x00007FF812B50000-0x00007FF812B60000-memory.dmp
      Filesize

      64KB

      Download
    • memory/3080-8-0x00007FF852AD0000-0x00007FF852CC5000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/3080-9-0x00007FF8101F0000-0x00007FF810200000-memory.dmp
      Filesize

      64KB

      Download
    • memory/3080-6-0x00007FF852AD0000-0x00007FF852CC5000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/3080-7-0x00007FF852AD0000-0x00007FF852CC5000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/3080-5-0x00007FF852B6D000-0x00007FF852B6E000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3080-112-0x00007FF852AD0000-0x00007FF852CC5000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/3080-4-0x00007FF812B50000-0x00007FF812B60000-memory.dmp
      Filesize

      64KB

      Download
    • memory/3080-1-0x00007FF812B50000-0x00007FF812B60000-memory.dmp
      Filesize

      64KB

      Download
    • memory/3080-90-0x00007FF852AD0000-0x00007FF852CC5000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/3080-91-0x00007FF852AD0000-0x00007FF852CC5000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/3080-92-0x00007FF852AD0000-0x00007FF852CC5000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/3080-93-0x00007FF852AD0000-0x00007FF852CC5000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/3080-2-0x00007FF812B50000-0x00007FF812B60000-memory.dmp
      Filesize

      64KB

      Download
    • memory/3080-108-0x00007FF812B50000-0x00007FF812B60000-memory.dmp
      Filesize

      64KB

      Download
    • memory/3080-109-0x00007FF812B50000-0x00007FF812B60000-memory.dmp
      Filesize

      64KB

      Download
    • memory/3080-111-0x00007FF812B50000-0x00007FF812B60000-memory.dmp
      Filesize

      64KB

      Download
    • memory/3080-110-0x00007FF812B50000-0x00007FF812B60000-memory.dmp
      Filesize

      64KB

      Download
    • memory/3676-64-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

      Download