Malware Analysis Report

2024-08-06 18:12

Sample ID 240704-ty711ayhkp
Target 1245.exe
SHA256 7c4c85dc3b36fcec57a3eb5a21eacf1e9cff0745c25c317036b927cb85d24182
Tags
xenorat rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7c4c85dc3b36fcec57a3eb5a21eacf1e9cff0745c25c317036b927cb85d24182

Threat Level: Known bad

The file 1245.exe was found to be: Known bad.

Malicious Activity Summary

xenorat rat trojan

Xenorat family

XenorRat

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Unsigned PE

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Persistence
TA0003
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-07-04 16:29

Signatures

Xenorat family

xenorat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-04 16:29

Reported

2024-07-04 16:35

Platform

win7-20231129-en

Max time kernel

133s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1245.exe"

Signatures

XenorRat

trojan rat xenorat

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\1245.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1245.exe N/A

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2200 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\1245.exe C:\Users\Admin\AppData\Roaming\XenoManager\1245.exe
PID 2200 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\1245.exe C:\Users\Admin\AppData\Roaming\XenoManager\1245.exe
PID 2200 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\1245.exe C:\Users\Admin\AppData\Roaming\XenoManager\1245.exe
PID 2200 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\1245.exe C:\Users\Admin\AppData\Roaming\XenoManager\1245.exe
PID 3016 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Roaming\XenoManager\1245.exe C:\Windows\SysWOW64\schtasks.exe
PID 3016 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Roaming\XenoManager\1245.exe C:\Windows\SysWOW64\schtasks.exe
PID 3016 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Roaming\XenoManager\1245.exe C:\Windows\SysWOW64\schtasks.exe
PID 3016 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Roaming\XenoManager\1245.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1245.exe

"C:\Users\Admin\AppData\Local\Temp\1245.exe"

C:\Users\Admin\AppData\Roaming\XenoManager\1245.exe

"C:\Users\Admin\AppData\Roaming\XenoManager\1245.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "Windows Updater" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1BF9.tmp" /F

Network

Country Destination Domain Proto
N/A 192.168.100.78:4782 tcp
N/A 192.168.100.78:4782 tcp
N/A 192.168.100.78:4782 tcp
N/A 192.168.100.78:4782 tcp
N/A 192.168.100.78:4782 tcp

Files

memory/2200-0-0x00000000748BE000-0x00000000748BF000-memory.dmp

memory/2200-1-0x0000000000ED0000-0x0000000000EE2000-memory.dmp

\Users\Admin\AppData\Roaming\XenoManager\1245.exe

MD5 7302cc01869548ae491f52a9a37a6bb2
SHA1 9450bd5b7d14408e058f16d2305cda6f1ebd102e
SHA256 7c4c85dc3b36fcec57a3eb5a21eacf1e9cff0745c25c317036b927cb85d24182
SHA512 3a6bd57ab2d30414521f1e0ef918e158b18dabbca9d68dd35a99bb3e97e0e3982d11e496354dbdbe3a65395d5bb1195a77d657d25f40185bbe795883b4de5754

memory/3016-9-0x00000000002F0000-0x0000000000302000-memory.dmp

memory/3016-10-0x00000000748B0000-0x0000000074F9E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp1BF9.tmp

MD5 30f51eab1590995c6631c409c1d2302d
SHA1 6eae8dda510b92d8e07b07ca8e6bdde16a4bd9eb
SHA256 b57124c0ce19fb6027c746fe08f80b910c7b3bb96fbe15e79ee7d7d12a3a8e30
SHA512 87336869268dc5578df2c33afd7166c1c2bd392108a436036671848f32e34446946c5628a785ddd50bc94ba5cc99c94e59685c2f4f47e8d41799efe1e7947b60

memory/3016-13-0x00000000748B0000-0x0000000074F9E000-memory.dmp

memory/3016-14-0x00000000748B0000-0x0000000074F9E000-memory.dmp

memory/3016-15-0x00000000748B0000-0x0000000074F9E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-04 16:29

Reported

2024-07-04 16:35

Platform

win10v2004-20240508-en

Max time kernel

132s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1245.exe"

Signatures

XenorRat

trojan rat xenorat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1245.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\1245.exe N/A

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3500 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\1245.exe C:\Users\Admin\AppData\Roaming\XenoManager\1245.exe
PID 3500 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\1245.exe C:\Users\Admin\AppData\Roaming\XenoManager\1245.exe
PID 3500 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\1245.exe C:\Users\Admin\AppData\Roaming\XenoManager\1245.exe
PID 3052 wrote to memory of 404 N/A C:\Users\Admin\AppData\Roaming\XenoManager\1245.exe C:\Windows\SysWOW64\schtasks.exe
PID 3052 wrote to memory of 404 N/A C:\Users\Admin\AppData\Roaming\XenoManager\1245.exe C:\Windows\SysWOW64\schtasks.exe
PID 3052 wrote to memory of 404 N/A C:\Users\Admin\AppData\Roaming\XenoManager\1245.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1245.exe

"C:\Users\Admin\AppData\Local\Temp\1245.exe"

C:\Users\Admin\AppData\Roaming\XenoManager\1245.exe

"C:\Users\Admin\AppData\Roaming\XenoManager\1245.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "Windows Updater" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6590.tmp" /F

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
N/A 192.168.100.78:4782 tcp
N/A 192.168.100.78:4782 tcp
N/A 192.168.100.78:4782 tcp
N/A 192.168.100.78:4782 tcp
N/A 192.168.100.78:4782 tcp

Files

memory/3500-0-0x000000007482E000-0x000000007482F000-memory.dmp

memory/3500-1-0x00000000002E0000-0x00000000002F2000-memory.dmp

C:\Users\Admin\AppData\Roaming\XenoManager\1245.exe

MD5 7302cc01869548ae491f52a9a37a6bb2
SHA1 9450bd5b7d14408e058f16d2305cda6f1ebd102e
SHA256 7c4c85dc3b36fcec57a3eb5a21eacf1e9cff0745c25c317036b927cb85d24182
SHA512 3a6bd57ab2d30414521f1e0ef918e158b18dabbca9d68dd35a99bb3e97e0e3982d11e496354dbdbe3a65395d5bb1195a77d657d25f40185bbe795883b4de5754

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1245.exe.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/3052-15-0x0000000074820000-0x0000000074FD0000-memory.dmp

memory/3052-16-0x0000000074820000-0x0000000074FD0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp6590.tmp

MD5 30f51eab1590995c6631c409c1d2302d
SHA1 6eae8dda510b92d8e07b07ca8e6bdde16a4bd9eb
SHA256 b57124c0ce19fb6027c746fe08f80b910c7b3bb96fbe15e79ee7d7d12a3a8e30
SHA512 87336869268dc5578df2c33afd7166c1c2bd392108a436036671848f32e34446946c5628a785ddd50bc94ba5cc99c94e59685c2f4f47e8d41799efe1e7947b60

memory/3052-19-0x0000000074820000-0x0000000074FD0000-memory.dmp