Malware Analysis Report

2024-08-06 18:11

Sample ID 240628-y3fjrs1cje
Target 34845dadebb0249756855a3255e6cebebae8f614c45022455d83848c2657c554
SHA256 34845dadebb0249756855a3255e6cebebae8f614c45022455d83848c2657c554
Tags
xenorat rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

34845dadebb0249756855a3255e6cebebae8f614c45022455d83848c2657c554

Threat Level: Known bad

The file 34845dadebb0249756855a3255e6cebebae8f614c45022455d83848c2657c554 was found to be: Known bad.

Malicious Activity Summary

xenorat rat trojan

Xenorat family

XenorRat

Unsigned PE

Scheduled Task/Job: Scheduled Task

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Persistence
TA0003
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-28 20:18

Signatures

Xenorat family

xenorat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-28 20:18

Reported

2024-06-28 20:20

Platform

win7-20240508-en

Max time kernel

132s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\34845dadebb0249756855a3255e6cebebae8f614c45022455d83848c2657c554.exe"

Signatures

XenorRat

trojan rat xenorat

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2400 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\34845dadebb0249756855a3255e6cebebae8f614c45022455d83848c2657c554.exe C:\Windows\SysWOW64\schtasks.exe
PID 2400 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\34845dadebb0249756855a3255e6cebebae8f614c45022455d83848c2657c554.exe C:\Windows\SysWOW64\schtasks.exe
PID 2400 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\34845dadebb0249756855a3255e6cebebae8f614c45022455d83848c2657c554.exe C:\Windows\SysWOW64\schtasks.exe
PID 2400 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\34845dadebb0249756855a3255e6cebebae8f614c45022455d83848c2657c554.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\34845dadebb0249756855a3255e6cebebae8f614c45022455d83848c2657c554.exe

"C:\Users\Admin\AppData\Local\Temp\34845dadebb0249756855a3255e6cebebae8f614c45022455d83848c2657c554.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "Windows" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3ABF.tmp" /F

Network

Country Destination Domain Proto
N/A 192.168.254.187:22 tcp
N/A 192.168.254.187:22 tcp
N/A 192.168.254.187:22 tcp
N/A 192.168.254.187:22 tcp
N/A 192.168.254.187:22 tcp

Files

memory/2400-0-0x0000000074C6E000-0x0000000074C6F000-memory.dmp

memory/2400-1-0x0000000000BB0000-0x0000000000BC2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp3ABF.tmp

MD5 ede64eaa3c93844334f72ba570de9472
SHA1 bdba8745384617651564d2b37c0b739885318944
SHA256 615b3f9732208a105e98a076d374ac87a501b53bc862cc19185936fd1366fb68
SHA512 056dfd298ec1dc695116d40e191e8980bc1afc52bd7ff42a584c583dc6a94ad1ad07c5a13a9bd58c3a831b420b3d721c41e15ef225b12f7f3225f608e47f3a3d

memory/2400-4-0x0000000074C60000-0x000000007534E000-memory.dmp

memory/2400-5-0x0000000074C6E000-0x0000000074C6F000-memory.dmp

memory/2400-6-0x0000000074C60000-0x000000007534E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-28 20:18

Reported

2024-06-28 20:20

Platform

win10v2004-20240508-en

Max time kernel

133s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\34845dadebb0249756855a3255e6cebebae8f614c45022455d83848c2657c554.exe"

Signatures

XenorRat

trojan rat xenorat

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3828 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\34845dadebb0249756855a3255e6cebebae8f614c45022455d83848c2657c554.exe C:\Windows\SysWOW64\schtasks.exe
PID 3828 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\34845dadebb0249756855a3255e6cebebae8f614c45022455d83848c2657c554.exe C:\Windows\SysWOW64\schtasks.exe
PID 3828 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\34845dadebb0249756855a3255e6cebebae8f614c45022455d83848c2657c554.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\34845dadebb0249756855a3255e6cebebae8f614c45022455d83848c2657c554.exe

"C:\Users\Admin\AppData\Local\Temp\34845dadebb0249756855a3255e6cebebae8f614c45022455d83848c2657c554.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "Windows" /XML "C:\Users\Admin\AppData\Local\Temp\tmp596A.tmp" /F

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 217.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
N/A 192.168.254.187:22 tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
N/A 192.168.254.187:22 tcp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
N/A 192.168.254.187:22 tcp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
N/A 192.168.254.187:22 tcp
N/A 192.168.254.187:22 tcp

Files

memory/3828-0-0x0000000074F2E000-0x0000000074F2F000-memory.dmp

memory/3828-1-0x0000000000A90000-0x0000000000AA2000-memory.dmp

memory/3828-2-0x0000000074F20000-0x00000000756D0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp596A.tmp

MD5 ede64eaa3c93844334f72ba570de9472
SHA1 bdba8745384617651564d2b37c0b739885318944
SHA256 615b3f9732208a105e98a076d374ac87a501b53bc862cc19185936fd1366fb68
SHA512 056dfd298ec1dc695116d40e191e8980bc1afc52bd7ff42a584c583dc6a94ad1ad07c5a13a9bd58c3a831b420b3d721c41e15ef225b12f7f3225f608e47f3a3d

memory/3828-5-0x0000000074F2E000-0x0000000074F2F000-memory.dmp

memory/3828-6-0x0000000074F20000-0x00000000756D0000-memory.dmp