Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-07-2024 14:30

General

  • Target

    1cc823962da2fa7a4d6fee8335ce8d92c6b44be627803cba85a1bdb8184da1d9.exe

  • Size

    235KB

  • MD5

    0551dcf55adc23a07d56580729730d50

  • SHA1

    5d09095bde071815b26624712352a9b0cc579d16

  • SHA256

    1cc823962da2fa7a4d6fee8335ce8d92c6b44be627803cba85a1bdb8184da1d9

  • SHA512

    6368b2ffceffc2415c1d21f5cc2107c1374b0a045ebd7181c7e1557904d44cc33b0f55380f83cf9d1693ef5d24bd1d292aa7348a72a8cefe7df7d72b0dc27b81

  • SSDEEP

    6144:v5N2IzPXRuvbd0hT0rh+PGdhhG1soMRxPqs9sm6I:72IzPXYZ0+l+OPcVixPqs9smP

Score
10/10

Malware Config

Extracted

Family

xenorat

C2

91.92.248.167

Mutex

Wolid_rat_nd8859g

Attributes
  • delay

    60000

  • install_path

    appdata

  • port

    1280

  • startup_name

    cms

Signatures

  • XenorRat

    XenorRat is a remote access trojan written in C#.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1cc823962da2fa7a4d6fee8335ce8d92c6b44be627803cba85a1bdb8184da1d9.exe
    "C:\Users\Admin\AppData\Local\Temp\1cc823962da2fa7a4d6fee8335ce8d92c6b44be627803cba85a1bdb8184da1d9.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2128
    • C:\Users\Admin\AppData\Local\Temp\1cc823962da2fa7a4d6fee8335ce8d92c6b44be627803cba85a1bdb8184da1d9.exe
      C:\Users\Admin\AppData\Local\Temp\1cc823962da2fa7a4d6fee8335ce8d92c6b44be627803cba85a1bdb8184da1d9.exe
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:2620
      • C:\Users\Admin\AppData\Roaming\XenoManager\1cc823962da2fa7a4d6fee8335ce8d92c6b44be627803cba85a1bdb8184da1d9.exe
        "C:\Users\Admin\AppData\Roaming\XenoManager\1cc823962da2fa7a4d6fee8335ce8d92c6b44be627803cba85a1bdb8184da1d9.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4172
        • C:\Users\Admin\AppData\Roaming\XenoManager\1cc823962da2fa7a4d6fee8335ce8d92c6b44be627803cba85a1bdb8184da1d9.exe
          C:\Users\Admin\AppData\Roaming\XenoManager\1cc823962da2fa7a4d6fee8335ce8d92c6b44be627803cba85a1bdb8184da1d9.exe
          4⤵
          • Executes dropped EXE
          PID:4260
        • C:\Users\Admin\AppData\Roaming\XenoManager\1cc823962da2fa7a4d6fee8335ce8d92c6b44be627803cba85a1bdb8184da1d9.exe
          C:\Users\Admin\AppData\Roaming\XenoManager\1cc823962da2fa7a4d6fee8335ce8d92c6b44be627803cba85a1bdb8184da1d9.exe
          4⤵
          • Executes dropped EXE
          PID:4120
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 80
            5⤵
            • Program crash
            PID:3680
        • C:\Users\Admin\AppData\Roaming\XenoManager\1cc823962da2fa7a4d6fee8335ce8d92c6b44be627803cba85a1bdb8184da1d9.exe
          C:\Users\Admin\AppData\Roaming\XenoManager\1cc823962da2fa7a4d6fee8335ce8d92c6b44be627803cba85a1bdb8184da1d9.exe
          4⤵
          • Executes dropped EXE
          PID:3088
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 80
            5⤵
            • Program crash
            PID:2256
    • C:\Users\Admin\AppData\Local\Temp\1cc823962da2fa7a4d6fee8335ce8d92c6b44be627803cba85a1bdb8184da1d9.exe
      C:\Users\Admin\AppData\Local\Temp\1cc823962da2fa7a4d6fee8335ce8d92c6b44be627803cba85a1bdb8184da1d9.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4852
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks.exe" /Create /TN "cms" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2B22.tmp" /F
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3700
    • C:\Users\Admin\AppData\Local\Temp\1cc823962da2fa7a4d6fee8335ce8d92c6b44be627803cba85a1bdb8184da1d9.exe
      C:\Users\Admin\AppData\Local\Temp\1cc823962da2fa7a4d6fee8335ce8d92c6b44be627803cba85a1bdb8184da1d9.exe
      2⤵
        PID:2840
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3088 -ip 3088
      1⤵
        PID:4716
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4120 -ip 4120
        1⤵
          PID:1448

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1cc823962da2fa7a4d6fee8335ce8d92c6b44be627803cba85a1bdb8184da1d9.exe.log

          Filesize

          522B

          MD5

          8334a471a4b492ece225b471b8ad2fc8

          SHA1

          1cb24640f32d23e8f7800bd0511b7b9c3011d992

          SHA256

          5612afe347d8549cc95a0c710602bcc7d7b224361b613c0a6ba362092300c169

          SHA512

          56ae2e83355c331b00d782797f5664c2f373eac240e811aab978732503ae05eb20b08730d2427ed90efa5a706d71b42b57153596a45a6b5592e3dd9128b81c36

        • C:\Users\Admin\AppData\Local\Temp\tmp2B22.tmp

          Filesize

          1KB

          MD5

          364eece25949d0382cb2359417990db6

          SHA1

          7dfe4b87a282ea9d03195cf34d6f3ed73462904e

          SHA256

          97226722a9361b515cbb623c3c7cc2468a8bb79dc471376407b8f9768d0c79c4

          SHA512

          b6d5ed28aa504b9e0577b8acc06d25509a5c45a8e0c2794bbd1f24617c48ae9b02ce8747efa26cb222d7314113389ee5c283392a9da325203cdb337039daa971

        • C:\Users\Admin\AppData\Roaming\XenoManager\1cc823962da2fa7a4d6fee8335ce8d92c6b44be627803cba85a1bdb8184da1d9.exe

          Filesize

          235KB

          MD5

          0551dcf55adc23a07d56580729730d50

          SHA1

          5d09095bde071815b26624712352a9b0cc579d16

          SHA256

          1cc823962da2fa7a4d6fee8335ce8d92c6b44be627803cba85a1bdb8184da1d9

          SHA512

          6368b2ffceffc2415c1d21f5cc2107c1374b0a045ebd7181c7e1557904d44cc33b0f55380f83cf9d1693ef5d24bd1d292aa7348a72a8cefe7df7d72b0dc27b81

        • memory/2128-4-0x000000000D7F0000-0x000000000D82E000-memory.dmp

          Filesize

          248KB

        • memory/2128-16-0x0000000074D00000-0x00000000754B0000-memory.dmp

          Filesize

          7.7MB

        • memory/2128-5-0x000000000D8D0000-0x000000000D96C000-memory.dmp

          Filesize

          624KB

        • memory/2128-6-0x0000000000940000-0x0000000000946000-memory.dmp

          Filesize

          24KB

        • memory/2128-0-0x0000000074D0E000-0x0000000074D0F000-memory.dmp

          Filesize

          4KB

        • memory/2128-3-0x0000000074D00000-0x00000000754B0000-memory.dmp

          Filesize

          7.7MB

        • memory/2128-1-0x0000000000240000-0x0000000000280000-memory.dmp

          Filesize

          256KB

        • memory/2128-2-0x0000000000900000-0x0000000000906000-memory.dmp

          Filesize

          24KB

        • memory/2620-7-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/2620-27-0x0000000074D00000-0x00000000754B0000-memory.dmp

          Filesize

          7.7MB

        • memory/2620-12-0x0000000074D00000-0x00000000754B0000-memory.dmp

          Filesize

          7.7MB

        • memory/2840-14-0x0000000074D00000-0x00000000754B0000-memory.dmp

          Filesize

          7.7MB

        • memory/2840-34-0x0000000074D00000-0x00000000754B0000-memory.dmp

          Filesize

          7.7MB

        • memory/4852-15-0x0000000074D00000-0x00000000754B0000-memory.dmp

          Filesize

          7.7MB

        • memory/4852-35-0x0000000074D00000-0x00000000754B0000-memory.dmp

          Filesize

          7.7MB