xenorat | 40ec6278632cd557b1b4a71756f605cd1579e1c54f1534c74f15751199fd521c

System Information Discovery

Processes:

MJSQCNZV.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	MJSQCNZV.exe

Executes dropped EXE 8 IoCs

Processes:

MJSQCNZV.exeMJSQCNZV.exeMJSQCNZV.exeMJSQCNZV.exeMJSQCNZV.exeMJSQCNZV.exeMJSQCNZV.exeMJSQCNZV.exe

pid process

5104 MJSQCNZV.exe
3636 MJSQCNZV.exe
3600 MJSQCNZV.exe
2272 MJSQCNZV.exe
184 MJSQCNZV.exe
2544 MJSQCNZV.exe
4500 MJSQCNZV.exe
2152 MJSQCNZV.exe

pid	process
5104	MJSQCNZV.exe
3636	MJSQCNZV.exe
3600	MJSQCNZV.exe
2272	MJSQCNZV.exe
184	MJSQCNZV.exe
2544	MJSQCNZV.exe
4500	MJSQCNZV.exe
2152	MJSQCNZV.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

MJSQCNZV.exeMJSQCNZV.exe

description	pid	process	target process
PID 5104 set thread context of 3636	5104	MJSQCNZV.exe	MJSQCNZV.exe
PID 5104 set thread context of 3600	5104	MJSQCNZV.exe	MJSQCNZV.exe
PID 5104 set thread context of 2272	5104	MJSQCNZV.exe	MJSQCNZV.exe
PID 184 set thread context of 2544	184	MJSQCNZV.exe	MJSQCNZV.exe
PID 184 set thread context of 4500	184	MJSQCNZV.exe	MJSQCNZV.exe
PID 184 set thread context of 2152	184	MJSQCNZV.exe	MJSQCNZV.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

4520 2272 WerFault.exe MJSQCNZV.exe
4128 3600 WerFault.exe
2412 2152 WerFault.exe

pid	pid_target	process	target process
4520	2272	WerFault.exe	MJSQCNZV.exe
4128	3600	WerFault.exe
2412	2152	WerFault.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

5104 schtasks.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

4932 EXCEL.EXE
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

MJSQCNZV.exeMJSQCNZV.exe

description pid process

Token: SeDebugPrivilege 5104 MJSQCNZV.exe
Token: SeDebugPrivilege 184 MJSQCNZV.exe

pid	process
5104	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	5104	MJSQCNZV.exe
Token: SeDebugPrivilege	184	MJSQCNZV.exe

Suspicious use of SetWindowsHookEx 18 IoCs

Processes:

EXCEL.EXE

pid	process
4932	EXCEL.EXE
4932	EXCEL.EXE
4932	EXCEL.EXE
4932	EXCEL.EXE
4932	EXCEL.EXE
4932	EXCEL.EXE
4932	EXCEL.EXE
4932	EXCEL.EXE
4932	EXCEL.EXE
4932	EXCEL.EXE
4932	EXCEL.EXE
4932	EXCEL.EXE
4932	EXCEL.EXE
4932	EXCEL.EXE
4932	EXCEL.EXE
4932	EXCEL.EXE
4932	EXCEL.EXE
4932	EXCEL.EXE

Suspicious use of WriteProcessMemory 57 IoCs

Processes:

EXCEL.EXEMJSQCNZV.exeMJSQCNZV.exeMJSQCNZV.exeMJSQCNZV.exe

description	pid	process	target process
PID 4932 wrote to memory of 5104	4932	EXCEL.EXE	MJSQCNZV.exe
PID 4932 wrote to memory of 5104	4932	EXCEL.EXE	MJSQCNZV.exe
PID 4932 wrote to memory of 5104	4932	EXCEL.EXE	MJSQCNZV.exe
PID 5104 wrote to memory of 3636	5104	MJSQCNZV.exe	MJSQCNZV.exe
PID 5104 wrote to memory of 3636	5104	MJSQCNZV.exe	MJSQCNZV.exe
PID 5104 wrote to memory of 3636	5104	MJSQCNZV.exe	MJSQCNZV.exe
PID 5104 wrote to memory of 3636	5104	MJSQCNZV.exe	MJSQCNZV.exe
PID 5104 wrote to memory of 3636	5104	MJSQCNZV.exe	MJSQCNZV.exe
PID 5104 wrote to memory of 3636	5104	MJSQCNZV.exe	MJSQCNZV.exe
PID 5104 wrote to memory of 3636	5104	MJSQCNZV.exe	MJSQCNZV.exe
PID 5104 wrote to memory of 3636	5104	MJSQCNZV.exe	MJSQCNZV.exe
PID 5104 wrote to memory of 3600	5104	MJSQCNZV.exe	MJSQCNZV.exe
PID 5104 wrote to memory of 3600	5104	MJSQCNZV.exe	MJSQCNZV.exe
PID 5104 wrote to memory of 3600	5104	MJSQCNZV.exe	MJSQCNZV.exe
PID 5104 wrote to memory of 3600	5104	MJSQCNZV.exe	MJSQCNZV.exe
PID 5104 wrote to memory of 3600	5104	MJSQCNZV.exe	MJSQCNZV.exe
PID 5104 wrote to memory of 3600	5104	MJSQCNZV.exe	MJSQCNZV.exe
PID 5104 wrote to memory of 3600	5104	MJSQCNZV.exe	MJSQCNZV.exe
PID 5104 wrote to memory of 3600	5104	MJSQCNZV.exe	MJSQCNZV.exe
PID 5104 wrote to memory of 2272	5104	MJSQCNZV.exe	MJSQCNZV.exe
PID 5104 wrote to memory of 2272	5104	MJSQCNZV.exe	MJSQCNZV.exe
PID 5104 wrote to memory of 2272	5104	MJSQCNZV.exe	MJSQCNZV.exe
PID 5104 wrote to memory of 2272	5104	MJSQCNZV.exe	MJSQCNZV.exe
PID 5104 wrote to memory of 2272	5104	MJSQCNZV.exe	MJSQCNZV.exe
PID 5104 wrote to memory of 2272	5104	MJSQCNZV.exe	MJSQCNZV.exe
PID 5104 wrote to memory of 2272	5104	MJSQCNZV.exe	MJSQCNZV.exe
PID 5104 wrote to memory of 2272	5104	MJSQCNZV.exe	MJSQCNZV.exe
PID 3636 wrote to memory of 184	3636	MJSQCNZV.exe	MJSQCNZV.exe
PID 3636 wrote to memory of 184	3636	MJSQCNZV.exe	MJSQCNZV.exe
PID 3636 wrote to memory of 184	3636	MJSQCNZV.exe	MJSQCNZV.exe
PID 184 wrote to memory of 2544	184	MJSQCNZV.exe	MJSQCNZV.exe
PID 184 wrote to memory of 2544	184	MJSQCNZV.exe	MJSQCNZV.exe
PID 184 wrote to memory of 2544	184	MJSQCNZV.exe	MJSQCNZV.exe
PID 184 wrote to memory of 2544	184	MJSQCNZV.exe	MJSQCNZV.exe
PID 184 wrote to memory of 2544	184	MJSQCNZV.exe	MJSQCNZV.exe
PID 184 wrote to memory of 2544	184	MJSQCNZV.exe	MJSQCNZV.exe
PID 184 wrote to memory of 2544	184	MJSQCNZV.exe	MJSQCNZV.exe
PID 184 wrote to memory of 2544	184	MJSQCNZV.exe	MJSQCNZV.exe
PID 184 wrote to memory of 4500	184	MJSQCNZV.exe	MJSQCNZV.exe
PID 184 wrote to memory of 4500	184	MJSQCNZV.exe	MJSQCNZV.exe
PID 184 wrote to memory of 4500	184	MJSQCNZV.exe	MJSQCNZV.exe
PID 184 wrote to memory of 4500	184	MJSQCNZV.exe	MJSQCNZV.exe
PID 184 wrote to memory of 4500	184	MJSQCNZV.exe	MJSQCNZV.exe
PID 184 wrote to memory of 4500	184	MJSQCNZV.exe	MJSQCNZV.exe
PID 184 wrote to memory of 4500	184	MJSQCNZV.exe	MJSQCNZV.exe
PID 184 wrote to memory of 4500	184	MJSQCNZV.exe	MJSQCNZV.exe
PID 184 wrote to memory of 2152	184	MJSQCNZV.exe	MJSQCNZV.exe
PID 184 wrote to memory of 2152	184	MJSQCNZV.exe	MJSQCNZV.exe
PID 184 wrote to memory of 2152	184	MJSQCNZV.exe	MJSQCNZV.exe
PID 184 wrote to memory of 2152	184	MJSQCNZV.exe	MJSQCNZV.exe
PID 184 wrote to memory of 2152	184	MJSQCNZV.exe	MJSQCNZV.exe
PID 184 wrote to memory of 2152	184	MJSQCNZV.exe	MJSQCNZV.exe
PID 184 wrote to memory of 2152	184	MJSQCNZV.exe	MJSQCNZV.exe
PID 184 wrote to memory of 2152	184	MJSQCNZV.exe	MJSQCNZV.exe
PID 2544 wrote to memory of 5104	2544	MJSQCNZV.exe	schtasks.exe
PID 2544 wrote to memory of 5104	2544	MJSQCNZV.exe	schtasks.exe
PID 2544 wrote to memory of 5104	2544	MJSQCNZV.exe	schtasks.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Transaccion_Recibos.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\MJSQCNZV.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\MJSQCNZV.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5104

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\MJSQCNZV.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\MJSQCNZV.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636

C:\Users\Admin\AppData\Roaming\XenoManager\MJSQCNZV.exe
"C:\Users\Admin\AppData\Roaming\XenoManager\MJSQCNZV.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:184

C:\Users\Admin\AppData\Roaming\XenoManager\MJSQCNZV.exe
C:\Users\Admin\AppData\Roaming\XenoManager\MJSQCNZV.exe
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /Create /TN "cms" /XML "C:\Users\Admin\AppData\Local\Temp\tmp41C7.tmp" /F
6⤵
- Scheduled Task/Job: Scheduled Task
PID:5104

C:\Users\Admin\AppData\Roaming\XenoManager\MJSQCNZV.exe
C:\Users\Admin\AppData\Roaming\XenoManager\MJSQCNZV.exe
5⤵
- Executes dropped EXE
PID:4500

C:\Users\Admin\AppData\Roaming\XenoManager\MJSQCNZV.exe
C:\Users\Admin\AppData\Roaming\XenoManager\MJSQCNZV.exe
5⤵
- Executes dropped EXE
PID:2152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 152
6⤵
- Program crash
PID:2412

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\MJSQCNZV.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\MJSQCNZV.exe
3⤵
- Executes dropped EXE
PID:3600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 80
4⤵
- Program crash
PID:4128

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\MJSQCNZV.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\MJSQCNZV.exe
3⤵
- Executes dropped EXE
PID:2272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 80
4⤵
- Program crash
PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2272 -ip 2272
1⤵
PID:1540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3600 -ip 3600
1⤵
PID:3292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2152 -ip 2152
1⤵
PID:764

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

3

System Information Discovery

4