Overview

overview

10

Static

static

3

dc787902ff...5a.exe

windows7-x64

10

dc787902ff...5a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    22-06-2024 01:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe

  • Size

    221KB

  • MD5

    792c34fea9fdbebd00ccb3e2c82bd3a5

  • SHA1

    d50a4769a2fca48504e9535a598f1e812d003c2f

  • SHA256

    dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a

  • SHA512

    f68beb38b7c68432211531d7a6f95626f388089098c878aee956def1e6de96744fa6459064ebd04df01316092cc018ad8321691cdc57265da889f030bf77e606

  • SSDEEP

    3072:chp584YL4TWFxVvaZAUOQDMwutBq17PTPlw92Vr5/6PSr2k5fsPI:chMmSFxhaZQsmBq1bTPlwq/Vr2k5fAI

Score
10/10
xenoratrattrojan

Malware Config

Extracted

Family

xenorat

C2

91.92.248.167

Mutex

Wolid_rat_nd8859g

Attributes
  • delay

    60000

  • install_path

    appdata

  • port

    1280

  • startup_name

    cms

Signatures

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat
  • Detects executables packed with ConfuserEx Mod 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe
    "C:\Users\Admin\AppData\Local\Temp\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2416
    • C:\Users\Admin\AppData\Local\Temp\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe
      C:\Users\Admin\AppData\Local\Temp\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe
      2⤵
        PID:2756
      • C:\Users\Admin\AppData\Local\Temp\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe
        C:\Users\Admin\AppData\Local\Temp\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2564
        • C:\Users\Admin\AppData\Roaming\XenoManager\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe
          "C:\Users\Admin\AppData\Roaming\XenoManager\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2836
          • C:\Users\Admin\AppData\Roaming\XenoManager\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe
            C:\Users\Admin\AppData\Roaming\XenoManager\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe
            4⤵
            • Executes dropped EXE
            PID:2464
          • C:\Users\Admin\AppData\Roaming\XenoManager\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe
            C:\Users\Admin\AppData\Roaming\XenoManager\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe
            4⤵
            • Executes dropped EXE
            PID:2488
          • C:\Users\Admin\AppData\Roaming\XenoManager\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe
            C:\Users\Admin\AppData\Roaming\XenoManager\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe
            4⤵
            • Executes dropped EXE
            PID:2536
      • C:\Users\Admin\AppData\Local\Temp\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe
        C:\Users\Admin\AppData\Local\Temp\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2712
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks.exe" /Create /TN "cms" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3F51.tmp" /F
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1092

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Persistence

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Privilege Escalation

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Defense Evasion

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp3F51.tmp
      Filesize

      1KB

      MD5

      f8dc44da42b7efb85bc15ab7f6fa7bd2

      SHA1

      f81f26de6ba0432771aeffa2bcf169012d4f835f

      SHA256

      7cd99bf8e6e3763d8614843118ea96c6b23a8bd4740f050238702a81cfb2f292

      SHA512

      6973a187fb215b6c1f027fe88b15a0ec989dd75ddf73cbb2de60f0d7820bed36e18f0bdfe5c13a13d8aab765802fdeb35998c608523dfbbdd7814d5b5e82f32b

      Download Submit
    • C:\Users\Admin\AppData\Roaming\XenoManager\dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a.exe
      Filesize

      221KB

      MD5

      792c34fea9fdbebd00ccb3e2c82bd3a5

      SHA1

      d50a4769a2fca48504e9535a598f1e812d003c2f

      SHA256

      dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a

      SHA512

      f68beb38b7c68432211531d7a6f95626f388089098c878aee956def1e6de96744fa6459064ebd04df01316092cc018ad8321691cdc57265da889f030bf77e606

      Download Submit
    • memory/2416-4-0x0000000000550000-0x000000000058A000-memory.dmp
      Filesize

      232KB

      Download
    • memory/2416-0-0x0000000074ACE000-0x0000000074ACF000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2416-5-0x0000000000330000-0x0000000000336000-memory.dmp
      Filesize

      24KB

      Download
    • memory/2416-3-0x0000000074AC0000-0x00000000751AE000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/2416-1-0x0000000000F70000-0x0000000000FAC000-memory.dmp
      Filesize

      240KB

      Download
    • memory/2416-2-0x00000000002F0000-0x00000000002F6000-memory.dmp
      Filesize

      24KB

      Download
    • memory/2416-24-0x0000000074AC0000-0x00000000751AE000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/2564-25-0x0000000074AC0000-0x00000000751AE000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/2564-31-0x0000000074AC0000-0x00000000751AE000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/2756-6-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

      Download
    • memory/2756-23-0x0000000074AC0000-0x00000000751AE000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/2756-16-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

      Download
    • memory/2756-46-0x0000000074AC0000-0x00000000751AE000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/2756-8-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

      Download
    • memory/2836-33-0x0000000000900000-0x000000000093C000-memory.dmp
      Filesize

      240KB

      Download