Overview

overview

10

Static

static

3

697098bd0a...ab.exe

windows7-x64

10

697098bd0a...ab.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    02-07-2024 01:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

  • Size

    236KB

  • MD5

    5f86d94893b47e542cf857749dfcd185

  • SHA1

    7816d9af40a9e9265708df00af8137db67d8c7aa

  • SHA256

    697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab

  • SHA512

    8cf9bb6ba985843d57f2a013e40d3243b89e5aa0af07d504e9bcc7a2b577028a9cf24258bab14e256b7cb11f75a9a5993eff920879ab11f24c926bce85fb4c7d

  • SSDEEP

    6144:wA0gX+3bpKthw8rZg+mr08M0O5wkoYfMJRNeUqNI:wA0gXgpKNknMX57ocMJRNeUq2

Score
10/10
xenoratratspywarestealertrojan

Malware Config

Extracted

Family

xenorat

C2

91.92.248.167

Mutex

Wolid_rat_nd8859g

Attributes
  • delay

    60000

  • install_path

    appdata

  • port

    1280

  • startup_name

    cms

Signatures

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
    "C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2368
    • C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
      C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
      2⤵
        PID:2524
      • C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
        C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2992
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks.exe" /Create /TN "cms" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF99B.tmp" /F
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:2104
      • C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
        C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:3044
        • C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
          "C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2300
          • C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
            C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
            4⤵
            • Executes dropped EXE
            PID:2480
          • C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
            C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
            4⤵
            • Executes dropped EXE
            PID:1560
          • C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
            C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
            4⤵
            • Executes dropped EXE
            PID:2428

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Persistence

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Privilege Escalation

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Defense Evasion

    Credential Access

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpF99B.tmp
      Filesize

      1KB

      MD5

      3d5fb318f0c4c844c417b4dd9ec02498

      SHA1

      b83b629d7a8f7a016e30cb3a9eb1b76de34bc78b

      SHA256

      981169aaa6f00dccdf0822989180d3bb96c6b45fa9b6a819935da76c24dd795e

      SHA512

      6c141efe1857b1d2ba74ea10fd766166161815d869b5217f79799c650ec2b87f44f36f278b9d1a3f4a754243c5ac4a3abe1aabd74fd3c61903db20403e915806

      Download Submit
    • \Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
      Filesize

      236KB

      MD5

      5f86d94893b47e542cf857749dfcd185

      SHA1

      7816d9af40a9e9265708df00af8137db67d8c7aa

      SHA256

      697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab

      SHA512

      8cf9bb6ba985843d57f2a013e40d3243b89e5aa0af07d504e9bcc7a2b577028a9cf24258bab14e256b7cb11f75a9a5993eff920879ab11f24c926bce85fb4c7d

      Download Submit
    • memory/2300-28-0x00000000003E0000-0x0000000000420000-memory.dmp
      Filesize

      256KB

      Download
    • memory/2368-1-0x0000000000990000-0x00000000009D0000-memory.dmp
      Filesize

      256KB

      Download
    • memory/2368-2-0x00000000004A0000-0x00000000004A6000-memory.dmp
      Filesize

      24KB

      Download
    • memory/2368-3-0x0000000000920000-0x000000000095E000-memory.dmp
      Filesize

      248KB

      Download
    • memory/2368-4-0x00000000741D0000-0x00000000748BE000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/2368-5-0x00000000003F0000-0x00000000003F6000-memory.dmp
      Filesize

      24KB

      Download
    • memory/2368-0-0x00000000741DE000-0x00000000741DF000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2368-18-0x00000000741D0000-0x00000000748BE000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/2992-35-0x00000000741D0000-0x00000000748BE000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/2992-19-0x00000000741D0000-0x00000000748BE000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/2992-9-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

      Download
    • memory/2992-11-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

      Download
    • memory/2992-7-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

      Download
    • memory/2992-38-0x00000000741D0000-0x00000000748BE000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/2992-39-0x00000000060C0000-0x00000000061BA000-memory.dmp
      Filesize

      1000KB

      Download
    • memory/2992-45-0x00000000063E0000-0x0000000006660000-memory.dmp
      Filesize

      2.5MB

      Download
    • memory/2992-56-0x00000000741D0000-0x00000000748BE000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/3044-20-0x00000000741D0000-0x00000000748BE000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/3044-27-0x00000000741D0000-0x00000000748BE000-memory.dmp
      Filesize

      6.9MB

      Download