Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-07-2024 16:43

General

  • Target

    477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe

  • Size

    240KB

  • MD5

    b41d067615ca60ffe4253297866d79be

  • SHA1

    1aab2b69eb9f918d1e0a23a82a98411709ee2fdb

  • SHA256

    477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c

  • SHA512

    7c5b98c2e3fbdafc0949ca9d32b9c41be044f3b99052e1119472d1999442114ed60d5949929e7b14aa028c77c7adc638ee0507362ab848af7cb4612c9313e29e

  • SSDEEP

    6144:oGB7vPW1gnEHLltCX754KLHrdoBiEd0nJ1iaJC4E2Hjyq3RVlA44I:oOOCnEHXY7ZzreHin7iaJC4E2Hjyq3Rj

Score
10/10

Malware Config

Extracted

Family

xenorat

C2

91.92.248.167

Mutex

Dolid_rat_nd8859g

Attributes
  • delay

    60000

  • install_path

    appdata

  • port

    1280

  • startup_name

    dms

Signatures

  • XenorRat

    XenorRat is a remote access trojan written in C#.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe
    "C:\Users\Admin\AppData\Local\Temp\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1164
    • C:\Users\Admin\AppData\Local\Temp\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe
      C:\Users\Admin\AppData\Local\Temp\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:2816
      • C:\Users\Admin\AppData\Roaming\XenoManager\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe
        "C:\Users\Admin\AppData\Roaming\XenoManager\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4936
        • C:\Users\Admin\AppData\Roaming\XenoManager\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe
          C:\Users\Admin\AppData\Roaming\XenoManager\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe
          4⤵
          • Executes dropped EXE
          PID:4636
        • C:\Users\Admin\AppData\Roaming\XenoManager\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe
          C:\Users\Admin\AppData\Roaming\XenoManager\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe
          4⤵
          • Executes dropped EXE
          PID:380
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 380 -s 80
            5⤵
            • Program crash
            PID:3196
        • C:\Users\Admin\AppData\Roaming\XenoManager\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe
          C:\Users\Admin\AppData\Roaming\XenoManager\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe
          4⤵
          • Executes dropped EXE
          PID:3432
    • C:\Users\Admin\AppData\Local\Temp\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe
      C:\Users\Admin\AppData\Local\Temp\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1172
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks.exe" /Create /TN "dms" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2025.tmp" /F
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:5048
    • C:\Users\Admin\AppData\Local\Temp\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe
      C:\Users\Admin\AppData\Local\Temp\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe
      2⤵
        PID:3136
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 380 -ip 380
      1⤵
        PID:748

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe.log

        Filesize

        522B

        MD5

        8334a471a4b492ece225b471b8ad2fc8

        SHA1

        1cb24640f32d23e8f7800bd0511b7b9c3011d992

        SHA256

        5612afe347d8549cc95a0c710602bcc7d7b224361b613c0a6ba362092300c169

        SHA512

        56ae2e83355c331b00d782797f5664c2f373eac240e811aab978732503ae05eb20b08730d2427ed90efa5a706d71b42b57153596a45a6b5592e3dd9128b81c36

      • C:\Users\Admin\AppData\Local\Temp\tmp2025.tmp

        Filesize

        1KB

        MD5

        37d8f916f69666f7b5814df290e50c2f

        SHA1

        d4acff3a48bb79e17a6174a012f5ab8c84c7cec2

        SHA256

        90dc3324a60e56d6db1f21a9a04887365a999232b2a4a7c994f8e1c3ecf9603a

        SHA512

        2050d02a75e01c132074014bb718392e7022d7a4d73442127cc61273a9d8e3324f0025d535b0a2c249d7f377a299e77b61ea2f821f3e4571ae4ad252071e0b10

      • C:\Users\Admin\AppData\Roaming\XenoManager\477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c.exe

        Filesize

        240KB

        MD5

        b41d067615ca60ffe4253297866d79be

        SHA1

        1aab2b69eb9f918d1e0a23a82a98411709ee2fdb

        SHA256

        477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c

        SHA512

        7c5b98c2e3fbdafc0949ca9d32b9c41be044f3b99052e1119472d1999442114ed60d5949929e7b14aa028c77c7adc638ee0507362ab848af7cb4612c9313e29e

      • memory/1164-4-0x00000000052E0000-0x000000000531E000-memory.dmp

        Filesize

        248KB

      • memory/1164-2-0x0000000002CB0000-0x0000000002CB6000-memory.dmp

        Filesize

        24KB

      • memory/1164-5-0x000000000DE30000-0x000000000DECC000-memory.dmp

        Filesize

        624KB

      • memory/1164-6-0x00000000011B0000-0x00000000011B6000-memory.dmp

        Filesize

        24KB

      • memory/1164-0-0x00000000750AE000-0x00000000750AF000-memory.dmp

        Filesize

        4KB

      • memory/1164-3-0x00000000750A0000-0x0000000075850000-memory.dmp

        Filesize

        7.7MB

      • memory/1164-1-0x00000000007B0000-0x00000000007F0000-memory.dmp

        Filesize

        256KB

      • memory/1164-15-0x00000000750A0000-0x0000000075850000-memory.dmp

        Filesize

        7.7MB

      • memory/1172-35-0x00000000750A0000-0x0000000075850000-memory.dmp

        Filesize

        7.7MB

      • memory/1172-16-0x00000000750A0000-0x0000000075850000-memory.dmp

        Filesize

        7.7MB

      • memory/1172-17-0x00000000750A0000-0x0000000075850000-memory.dmp

        Filesize

        7.7MB

      • memory/2816-7-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

      • memory/2816-28-0x00000000750A0000-0x0000000075850000-memory.dmp

        Filesize

        7.7MB

      • memory/2816-13-0x00000000750A0000-0x0000000075850000-memory.dmp

        Filesize

        7.7MB

      • memory/3136-14-0x00000000750A0000-0x0000000075850000-memory.dmp

        Filesize

        7.7MB