Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    04-07-2024 11:40

General

  • Target

    477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe

  • Size

    240KB

  • MD5

    b41d067615ca60ffe4253297866d79be

  • SHA1

    1aab2b69eb9f918d1e0a23a82a98411709ee2fdb

  • SHA256

    477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c

  • SHA512

    7c5b98c2e3fbdafc0949ca9d32b9c41be044f3b99052e1119472d1999442114ed60d5949929e7b14aa028c77c7adc638ee0507362ab848af7cb4612c9313e29e

  • SSDEEP

    6144:oGB7vPW1gnEHLltCX754KLHrdoBiEd0nJ1iaJC4E2Hjyq3RVlA44I:oOOCnEHXY7ZzreHin7iaJC4E2Hjyq3Rj

Malware Config

Extracted

Family

xenorat

C2

91.92.248.167

Mutex

Dolid_rat_nd8859g

Attributes
  • delay

    60000

  • install_path

    appdata

  • port

    1280

  • startup_name

    dms

Signatures

  • XenorRat

    XenorRat is a remote access trojan written in C#.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe
    "C:\Users\Admin\AppData\Local\Temp\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3020
    • C:\Users\Admin\AppData\Local\Temp\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe
      C:\Users\Admin\AppData\Local\Temp\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3056
      • C:\Users\Admin\AppData\Roaming\XenoManager\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe
        "C:\Users\Admin\AppData\Roaming\XenoManager\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2716
        • C:\Users\Admin\AppData\Roaming\XenoManager\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe
          C:\Users\Admin\AppData\Roaming\XenoManager\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe
          4⤵
          • Executes dropped EXE
          PID:2456
        • C:\Users\Admin\AppData\Roaming\XenoManager\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe
          C:\Users\Admin\AppData\Roaming\XenoManager\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe
          4⤵
          • Executes dropped EXE
          PID:2488
        • C:\Users\Admin\AppData\Roaming\XenoManager\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe
          C:\Users\Admin\AppData\Roaming\XenoManager\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe
          4⤵
          • Executes dropped EXE
          PID:1656
    • C:\Users\Admin\AppData\Local\Temp\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe
      C:\Users\Admin\AppData\Local\Temp\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3004
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks.exe" /Create /TN "dms" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD78.tmp" /F
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1840
    • C:\Users\Admin\AppData\Local\Temp\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe
      C:\Users\Admin\AppData\Local\Temp\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe
      2⤵
        PID:1984

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpD78.tmp

      Filesize

      1KB

      MD5

      37d8f916f69666f7b5814df290e50c2f

      SHA1

      d4acff3a48bb79e17a6174a012f5ab8c84c7cec2

      SHA256

      90dc3324a60e56d6db1f21a9a04887365a999232b2a4a7c994f8e1c3ecf9603a

      SHA512

      2050d02a75e01c132074014bb718392e7022d7a4d73442127cc61273a9d8e3324f0025d535b0a2c249d7f377a299e77b61ea2f821f3e4571ae4ad252071e0b10

    • \Users\Admin\AppData\Roaming\XenoManager\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe

      Filesize

      240KB

      MD5

      b41d067615ca60ffe4253297866d79be

      SHA1

      1aab2b69eb9f918d1e0a23a82a98411709ee2fdb

      SHA256

      477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c

      SHA512

      7c5b98c2e3fbdafc0949ca9d32b9c41be044f3b99052e1119472d1999442114ed60d5949929e7b14aa028c77c7adc638ee0507362ab848af7cb4612c9313e29e

    • memory/2716-33-0x0000000000EE0000-0x0000000000F20000-memory.dmp

      Filesize

      256KB

    • memory/3004-24-0x0000000074290000-0x000000007497E000-memory.dmp

      Filesize

      6.9MB

    • memory/3004-66-0x0000000074290000-0x000000007497E000-memory.dmp

      Filesize

      6.9MB

    • memory/3004-50-0x00000000060D0000-0x00000000061CA000-memory.dmp

      Filesize

      1000KB

    • memory/3004-49-0x0000000074290000-0x000000007497E000-memory.dmp

      Filesize

      6.9MB

    • memory/3004-46-0x0000000074290000-0x000000007497E000-memory.dmp

      Filesize

      6.9MB

    • memory/3020-5-0x0000000000270000-0x0000000000276000-memory.dmp

      Filesize

      24KB

    • memory/3020-32-0x0000000074290000-0x000000007497E000-memory.dmp

      Filesize

      6.9MB

    • memory/3020-0-0x000000007429E000-0x000000007429F000-memory.dmp

      Filesize

      4KB

    • memory/3020-3-0x0000000000220000-0x000000000025E000-memory.dmp

      Filesize

      248KB

    • memory/3020-4-0x0000000074290000-0x000000007497E000-memory.dmp

      Filesize

      6.9MB

    • memory/3020-2-0x0000000000210000-0x0000000000216000-memory.dmp

      Filesize

      24KB

    • memory/3020-1-0x0000000000E20000-0x0000000000E60000-memory.dmp

      Filesize

      256KB

    • memory/3056-8-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/3056-18-0x0000000074290000-0x000000007497E000-memory.dmp

      Filesize

      6.9MB

    • memory/3056-12-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/3056-6-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/3056-31-0x0000000074290000-0x000000007497E000-memory.dmp

      Filesize

      6.9MB