Analysis

  • max time kernel
    147s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-07-2024 14:23

General

  • Target

    4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe

  • Size

    235KB

  • MD5

    edc793f85ad6e90c754a9f0799cc08e3

  • SHA1

    c0a2e36283f9e20219b25dd4e15ec7dc73e7aa71

  • SHA256

    4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb

  • SHA512

    653ffa9b5f36afc61804354d74faf0d15e0ff3db4209a4d688de9c49917966a095b56108da1948e5011b262abd910259977f428d80e407d48a6af07579a6058a

  • SSDEEP

    6144:OGKCONo00JeBH3onZ2q5YUUexxgKR63u9i24NnPdI:OBCy0J+XQZ1xgKR63u9i24NnPG

Score
10/10

Malware Config

Extracted

Family

xenorat

C2

91.92.248.167

Mutex

Wolid_rat_nd8859g

Attributes
  • delay

    60000

  • install_path

    appdata

  • port

    1280

  • startup_name

    cms

Signatures

  • XenorRat

    XenorRat is a remote access trojan written in C#.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe
    "C:\Users\Admin\AppData\Local\Temp\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2364
    • C:\Users\Admin\AppData\Local\Temp\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe
      C:\Users\Admin\AppData\Local\Temp\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:32
      • C:\Users\Admin\AppData\Roaming\XenoManager\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe
        "C:\Users\Admin\AppData\Roaming\XenoManager\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1000
        • C:\Users\Admin\AppData\Roaming\XenoManager\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe
          C:\Users\Admin\AppData\Roaming\XenoManager\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe
          4⤵
          • Executes dropped EXE
          PID:4612
        • C:\Users\Admin\AppData\Roaming\XenoManager\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe
          C:\Users\Admin\AppData\Roaming\XenoManager\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe
          4⤵
          • Executes dropped EXE
          PID:4244
        • C:\Users\Admin\AppData\Roaming\XenoManager\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe
          C:\Users\Admin\AppData\Roaming\XenoManager\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe
          4⤵
          • Executes dropped EXE
          PID:3656
    • C:\Users\Admin\AppData\Local\Temp\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe
      C:\Users\Admin\AppData\Local\Temp\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4812
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks.exe" /Create /TN "cms" /XML "C:\Users\Admin\AppData\Local\Temp\tmp39A9.tmp" /F
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3012
    • C:\Users\Admin\AppData\Local\Temp\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe
      C:\Users\Admin\AppData\Local\Temp\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe
      2⤵
        PID:3092

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe.log

      Filesize

      522B

      MD5

      8334a471a4b492ece225b471b8ad2fc8

      SHA1

      1cb24640f32d23e8f7800bd0511b7b9c3011d992

      SHA256

      5612afe347d8549cc95a0c710602bcc7d7b224361b613c0a6ba362092300c169

      SHA512

      56ae2e83355c331b00d782797f5664c2f373eac240e811aab978732503ae05eb20b08730d2427ed90efa5a706d71b42b57153596a45a6b5592e3dd9128b81c36

    • C:\Users\Admin\AppData\Local\Temp\tmp39A9.tmp

      Filesize

      1KB

      MD5

      cdbd829e6cd46e8a747214e62d6b9ba6

      SHA1

      2cc952d146a50e6e37de320d56aee66f6e328f5a

      SHA256

      15dc6821efb09ad1b196f9c36322e252c5ddc10e80ee0f3ee0134d74bfea9b8d

      SHA512

      59c9d58b86c2584ec5341b50344c5ab9e5a8ddd4e71e6d96b56e8d3033e262666393d9c821de73197d5388bd2e8818cc798ff083b6e99959777fcdf73be794d2

    • C:\Users\Admin\AppData\Roaming\XenoManager\4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb.exe

      Filesize

      235KB

      MD5

      edc793f85ad6e90c754a9f0799cc08e3

      SHA1

      c0a2e36283f9e20219b25dd4e15ec7dc73e7aa71

      SHA256

      4d70544594fdd2d04f114222dac0f9a5a21a05a2a3ffd68688cdab8ed93588eb

      SHA512

      653ffa9b5f36afc61804354d74faf0d15e0ff3db4209a4d688de9c49917966a095b56108da1948e5011b262abd910259977f428d80e407d48a6af07579a6058a

    • memory/32-7-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/32-28-0x00000000751F0000-0x00000000759A0000-memory.dmp

      Filesize

      7.7MB

    • memory/32-13-0x00000000751F0000-0x00000000759A0000-memory.dmp

      Filesize

      7.7MB

    • memory/2364-4-0x00000000051E0000-0x000000000521E000-memory.dmp

      Filesize

      248KB

    • memory/2364-6-0x0000000005220000-0x0000000005226000-memory.dmp

      Filesize

      24KB

    • memory/2364-5-0x0000000005580000-0x000000000561C000-memory.dmp

      Filesize

      624KB

    • memory/2364-0-0x00000000751FE000-0x00000000751FF000-memory.dmp

      Filesize

      4KB

    • memory/2364-15-0x00000000751F0000-0x00000000759A0000-memory.dmp

      Filesize

      7.7MB

    • memory/2364-3-0x00000000751F0000-0x00000000759A0000-memory.dmp

      Filesize

      7.7MB

    • memory/2364-2-0x0000000002D80000-0x0000000002D86000-memory.dmp

      Filesize

      24KB

    • memory/2364-1-0x0000000000870000-0x00000000008B0000-memory.dmp

      Filesize

      256KB

    • memory/3092-14-0x00000000751F0000-0x00000000759A0000-memory.dmp

      Filesize

      7.7MB

    • memory/4812-16-0x00000000751F0000-0x00000000759A0000-memory.dmp

      Filesize

      7.7MB

    • memory/4812-17-0x00000000751F0000-0x00000000759A0000-memory.dmp

      Filesize

      7.7MB

    • memory/4812-35-0x00000000751F0000-0x00000000759A0000-memory.dmp

      Filesize

      7.7MB