Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    03-07-2024 13:39

General

  • Target

    d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe

  • Size

    235KB

  • MD5

    0dba4bed5bf4e4c327b712f723e714c5

  • SHA1

    b8609db0404983d9a7f2bc4639d93a539bb883a6

  • SHA256

    d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267

  • SHA512

    3e2d21c7f0f4a97cc491d70bef203e75c91d716706256938d6cb0171cbd8499e902b9d51be4a0afc47c602d5aebf5db22802c38aae29d0ebcd9fb29611824653

  • SSDEEP

    6144:BhTnFgUgcego6uIXCHq2MYOITuVYmE9oO8N21Tx6I:/byUTelnK2fZSVYmE9oO8N21TxP

Score
10/10

Malware Config

Extracted

Family

xenorat

C2

91.92.248.167

Mutex

Wolid_rat_nd8859g

Attributes
  • delay

    60000

  • install_path

    appdata

  • port

    1280

  • startup_name

    cms

Signatures

  • XenorRat

    XenorRat is a remote access trojan written in C#.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe
    "C:\Users\Admin\AppData\Local\Temp\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2084
    • C:\Users\Admin\AppData\Local\Temp\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe
      C:\Users\Admin\AppData\Local\Temp\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2108
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks.exe" /Create /TN "cms" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFFF1.tmp" /F
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2748
    • C:\Users\Admin\AppData\Local\Temp\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe
      C:\Users\Admin\AppData\Local\Temp\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe
      2⤵
        PID:2536
      • C:\Users\Admin\AppData\Local\Temp\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe
        C:\Users\Admin\AppData\Local\Temp\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2612
        • C:\Users\Admin\AppData\Roaming\XenoManager\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe
          "C:\Users\Admin\AppData\Roaming\XenoManager\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2192
          • C:\Users\Admin\AppData\Roaming\XenoManager\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe
            C:\Users\Admin\AppData\Roaming\XenoManager\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe
            4⤵
            • Executes dropped EXE
            PID:2460
          • C:\Users\Admin\AppData\Roaming\XenoManager\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe
            C:\Users\Admin\AppData\Roaming\XenoManager\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe
            4⤵
            • Executes dropped EXE
            PID:2400
          • C:\Users\Admin\AppData\Roaming\XenoManager\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe
            C:\Users\Admin\AppData\Roaming\XenoManager\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe
            4⤵
            • Executes dropped EXE
            PID:2480

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpFFF1.tmp

      Filesize

      1KB

      MD5

      afef954e03bba0a4799c2eb89877df4c

      SHA1

      829fecc6e072769ae3d720580456eb6153a4e2a2

      SHA256

      07501340bd4fc395d08b29637a74fb2aeec1f4c3e6082488e6582f6dd3526a99

      SHA512

      96ea517ac387f3b5f1a898436e197adf736a9078aedcb9b6bbe8e94ba862bfbf2085dd9df856ffd3d20ccf1a87810565d379e9f872bbff9415807426675268d0

    • \Users\Admin\AppData\Roaming\XenoManager\d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe

      Filesize

      235KB

      MD5

      0dba4bed5bf4e4c327b712f723e714c5

      SHA1

      b8609db0404983d9a7f2bc4639d93a539bb883a6

      SHA256

      d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267

      SHA512

      3e2d21c7f0f4a97cc491d70bef203e75c91d716706256938d6cb0171cbd8499e902b9d51be4a0afc47c602d5aebf5db22802c38aae29d0ebcd9fb29611824653

    • memory/2084-19-0x0000000074BF0000-0x00000000752DE000-memory.dmp

      Filesize

      6.9MB

    • memory/2084-1-0x00000000000A0000-0x00000000000E0000-memory.dmp

      Filesize

      256KB

    • memory/2084-2-0x0000000000380000-0x0000000000386000-memory.dmp

      Filesize

      24KB

    • memory/2084-3-0x0000000074BF0000-0x00000000752DE000-memory.dmp

      Filesize

      6.9MB

    • memory/2084-4-0x0000000000390000-0x00000000003CE000-memory.dmp

      Filesize

      248KB

    • memory/2084-5-0x0000000000410000-0x0000000000416000-memory.dmp

      Filesize

      24KB

    • memory/2084-0-0x0000000074BFE000-0x0000000074BFF000-memory.dmp

      Filesize

      4KB

    • memory/2108-8-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/2108-18-0x0000000074BF0000-0x00000000752DE000-memory.dmp

      Filesize

      6.9MB

    • memory/2108-10-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/2108-42-0x0000000074BF0000-0x00000000752DE000-memory.dmp

      Filesize

      6.9MB

    • memory/2108-6-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/2108-45-0x0000000074BF0000-0x00000000752DE000-memory.dmp

      Filesize

      6.9MB

    • memory/2108-46-0x0000000074BF0000-0x00000000752DE000-memory.dmp

      Filesize

      6.9MB

    • memory/2192-28-0x0000000000D00000-0x0000000000D40000-memory.dmp

      Filesize

      256KB

    • memory/2612-25-0x0000000074BF0000-0x00000000752DE000-memory.dmp

      Filesize

      6.9MB

    • memory/2612-27-0x0000000074BF0000-0x00000000752DE000-memory.dmp

      Filesize

      6.9MB