Overview

overview

10

Static

static

3

c99818a50f...c5.xll

windows7-x64

7

c99818a50f...c5.xll

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-07-2024 16:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c99818a50f8c02af5204158301bf8552993c03ade20f2016b5997d440d2297c5.xll

  • Size

    819KB

  • MD5

    568383287c850ef98c2fde1c642870f2

  • SHA1

    f8487d82118c0439545fddde534bdde0250885ee

  • SHA256

    c99818a50f8c02af5204158301bf8552993c03ade20f2016b5997d440d2297c5

  • SHA512

    11e5d1b7eb2113a5d283e01ea715479f84fb401a2f0940639368cf4453f0a478c8af905aae8fdb3b05c9a090f4838cbfb9b5f0ec509d533b8ffc36ad858df3a0

  • SSDEEP

    12288:1G1N4HkcgMsiOd58bzbBSreqQ0uqZzD1reWabd/84QKycycwU636x2Cd5J:1oOOMX16+QHT+dbQKZBxP5

Score
10/10
xenoratrattrojan

Malware Config

Extracted

Language
xlm4.0
Source

Extracted

Family

xenorat

C2

91.92.248.167

Mutex

Wolid_rat_nd8889g

Attributes
  • delay

    60000

  • install_path

    appdata

  • port

    1279

  • startup_name

    qns

Signatures

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\c99818a50f8c02af5204158301bf8552993c03ade20f2016b5997d440d2297c5.xll"
    1⤵
    • Loads dropped DLL
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:924
    • C:\Users\Admin\AppData\Local\Temp\91604d04-e320-4aea-bbc1-2aee520ed937.exe
      "C:\Users\Admin\AppData\Local\Temp\91604d04-e320-4aea-bbc1-2aee520ed937.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2012
      • C:\Users\Admin\AppData\Local\Temp\91604d04-e320-4aea-bbc1-2aee520ed937.exe
        C:\Users\Admin\AppData\Local\Temp\91604d04-e320-4aea-bbc1-2aee520ed937.exe
        3⤵
        • Executes dropped EXE
        PID:2004
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 80
          4⤵
          • Program crash
          PID:664
      • C:\Users\Admin\AppData\Local\Temp\91604d04-e320-4aea-bbc1-2aee520ed937.exe
        C:\Users\Admin\AppData\Local\Temp\91604d04-e320-4aea-bbc1-2aee520ed937.exe
        3⤵
        • Executes dropped EXE
        PID:2744
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 80
          4⤵
          • Program crash
          PID:3940
      • C:\Users\Admin\AppData\Local\Temp\91604d04-e320-4aea-bbc1-2aee520ed937.exe
        C:\Users\Admin\AppData\Local\Temp\91604d04-e320-4aea-bbc1-2aee520ed937.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1784
        • C:\Users\Admin\AppData\Roaming\XenoManager\91604d04-e320-4aea-bbc1-2aee520ed937.exe
          "C:\Users\Admin\AppData\Roaming\XenoManager\91604d04-e320-4aea-bbc1-2aee520ed937.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4844
          • C:\Users\Admin\AppData\Roaming\XenoManager\91604d04-e320-4aea-bbc1-2aee520ed937.exe
            C:\Users\Admin\AppData\Roaming\XenoManager\91604d04-e320-4aea-bbc1-2aee520ed937.exe
            5⤵
            • Executes dropped EXE
            PID:3864
          • C:\Users\Admin\AppData\Roaming\XenoManager\91604d04-e320-4aea-bbc1-2aee520ed937.exe
            C:\Users\Admin\AppData\Roaming\XenoManager\91604d04-e320-4aea-bbc1-2aee520ed937.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1648
            • C:\Windows\SysWOW64\schtasks.exe
              "schtasks.exe" /Create /TN "qns" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4A81.tmp" /F
              6⤵
              • Scheduled Task/Job: Scheduled Task
              PID:2440
          • C:\Users\Admin\AppData\Roaming\XenoManager\91604d04-e320-4aea-bbc1-2aee520ed937.exe
            C:\Users\Admin\AppData\Roaming\XenoManager\91604d04-e320-4aea-bbc1-2aee520ed937.exe
            5⤵
            • Executes dropped EXE
            PID:4888
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2744 -ip 2744
    1⤵
      PID:1980
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2004 -ip 2004
      1⤵
        PID:5016

      Network

      MITRE ATT&CK Matrix ATT&CK v13

      Initial Access

      Execution

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Persistence

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Privilege Escalation

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Defense Evasion

      Credential Access

      Discovery

      Query Registry

      3
      T1012

      System Information Discovery

      4
      T1082

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Resource Development

      Reconnaissance

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\91604d04-e320-4aea-bbc1-2aee520ed937.exe.log
        Filesize

        522B

        MD5

        8334a471a4b492ece225b471b8ad2fc8

        SHA1

        1cb24640f32d23e8f7800bd0511b7b9c3011d992

        SHA256

        5612afe347d8549cc95a0c710602bcc7d7b224361b613c0a6ba362092300c169

        SHA512

        56ae2e83355c331b00d782797f5664c2f373eac240e811aab978732503ae05eb20b08730d2427ed90efa5a706d71b42b57153596a45a6b5592e3dd9128b81c36

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\91604d04-e320-4aea-bbc1-2aee520ed937.exe
        Filesize

        234KB

        MD5

        f8a5baf3665522e063b7c2a32f6e09d9

        SHA1

        fbc67542afdc39e3da28eda62c77a5fe9cdcb28e

        SHA256

        b7ec8f3a40f0f598986870753221b468160d4485825fe5056ad618300b3a9c0b

        SHA512

        6345049ce349dd282269f8afa99ff8e1fe2441f1527b0a1c90ab8e80a7fe6def964827306dd84efdeee623dc830d2dfc9001aa0f14e12e9034a9764e4870e535

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\c99818a50f8c02af5204158301bf8552993c03ade20f2016b5997d440d2297c5.xll
        Filesize

        819KB

        MD5

        568383287c850ef98c2fde1c642870f2

        SHA1

        f8487d82118c0439545fddde534bdde0250885ee

        SHA256

        c99818a50f8c02af5204158301bf8552993c03ade20f2016b5997d440d2297c5

        SHA512

        11e5d1b7eb2113a5d283e01ea715479f84fb401a2f0940639368cf4453f0a478c8af905aae8fdb3b05c9a090f4838cbfb9b5f0ec509d533b8ffc36ad858df3a0

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\tmp4A81.tmp
        Filesize

        1KB

        MD5

        fe8a09602a61e6b5040126e8590e6e54

        SHA1

        1f0a4857d5cda5eca9ad08b2c1c62065023f917d

        SHA256

        4cb7b28fb34e62465ea2ff1c00cfd9446c9bfab07308718835df98d459a18fda

        SHA512

        357cce623442bb4a5675750103fb4d0901a1829617fba24278b77fbd729a2c8611fd24bbeb61af63094c7253299f2f8b927f57aa7d0cb196e6cfe630e4a8b9e9

        Download Submit
      • memory/924-24-0x00000200BAFD0000-0x00000200BAFE4000-memory.dmp
        Filesize

        80KB

        Download
      • memory/924-2-0x00007FFA72BB0000-0x00007FFA72BC0000-memory.dmp
        Filesize

        64KB

        Download
      • memory/924-3-0x00007FFAB2BCD000-0x00007FFAB2BCE000-memory.dmp
        Filesize

        4KB

        Download
      • memory/924-1-0x00007FFA72BB0000-0x00007FFA72BC0000-memory.dmp
        Filesize

        64KB

        Download
      • memory/924-10-0x00007FFAB2B30000-0x00007FFAB2D25000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/924-9-0x00007FFAB2B30000-0x00007FFAB2D25000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/924-8-0x00007FFAB2B30000-0x00007FFAB2D25000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/924-12-0x00007FFAB2B30000-0x00007FFAB2D25000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/924-11-0x00007FFAB2B30000-0x00007FFAB2D25000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/924-14-0x00007FFA70670000-0x00007FFA70680000-memory.dmp
        Filesize

        64KB

        Download
      • memory/924-13-0x00007FFAB2B30000-0x00007FFAB2D25000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/924-15-0x00007FFAB2B30000-0x00007FFAB2D25000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/924-16-0x00007FFA70670000-0x00007FFA70680000-memory.dmp
        Filesize

        64KB

        Download
      • memory/924-6-0x00007FFA72BB0000-0x00007FFA72BC0000-memory.dmp
        Filesize

        64KB

        Download
      • memory/924-0-0x00007FFA72BB0000-0x00007FFA72BC0000-memory.dmp
        Filesize

        64KB

        Download
      • memory/924-25-0x00007FFAB2B30000-0x00007FFAB2D25000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/924-27-0x00007FFAB2B30000-0x00007FFAB2D25000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/924-28-0x00000200D5780000-0x00000200D5904000-memory.dmp
        Filesize

        1.5MB

        Download
      • memory/924-31-0x00007FFAB2B30000-0x00007FFAB2D25000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/924-30-0x00000200BC3A0000-0x00000200BC3DC000-memory.dmp
        Filesize

        240KB

        Download
      • memory/924-29-0x00007FFAB2B30000-0x00007FFAB2D25000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/924-26-0x00007FFAB2B30000-0x00007FFAB2D25000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/924-20-0x00000200BAEC0000-0x00000200BAFA6000-memory.dmp
        Filesize

        920KB

        Download
      • memory/924-5-0x00007FFAB2B30000-0x00007FFAB2D25000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/924-118-0x00007FFAB2B30000-0x00007FFAB2D25000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/924-38-0x00000200D46E0000-0x00000200D4724000-memory.dmp
        Filesize

        272KB

        Download
      • memory/924-39-0x00007FFAB2B30000-0x00007FFAB2D25000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/924-7-0x00007FFAB2B30000-0x00007FFAB2D25000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/924-116-0x00007FFA72BB0000-0x00007FFA72BC0000-memory.dmp
        Filesize

        64KB

        Download
      • memory/924-117-0x00007FFA72BB0000-0x00007FFA72BC0000-memory.dmp
        Filesize

        64KB

        Download
      • memory/924-115-0x00007FFA72BB0000-0x00007FFA72BC0000-memory.dmp
        Filesize

        64KB

        Download
      • memory/924-114-0x00007FFA72BB0000-0x00007FFA72BC0000-memory.dmp
        Filesize

        64KB

        Download
      • memory/924-37-0x00007FFAB2B30000-0x00007FFAB2D25000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/924-23-0x00000200BAFD0000-0x00000200BAFE4000-memory.dmp
        Filesize

        80KB

        Download
      • memory/924-97-0x00007FFAB2B30000-0x00007FFAB2D25000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/924-96-0x00007FFAB2B30000-0x00007FFAB2D25000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/924-4-0x00007FFA72BB0000-0x00007FFA72BC0000-memory.dmp
        Filesize

        64KB

        Download
      • memory/924-88-0x00007FFAB2B30000-0x00007FFAB2D25000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/924-94-0x00007FFAB2B30000-0x00007FFAB2D25000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/924-95-0x00007FFAB2B30000-0x00007FFAB2D25000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/1784-67-0x0000000000400000-0x0000000000412000-memory.dmp
        Filesize

        72KB

        Download
      • memory/2012-62-0x0000000002970000-0x0000000002976000-memory.dmp
        Filesize

        24KB

        Download
      • memory/2012-61-0x000000000DB90000-0x000000000DC2C000-memory.dmp
        Filesize

        624KB

        Download
      • memory/2012-59-0x00007FFAB2B30000-0x00007FFAB2D25000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/2012-58-0x0000000004EE0000-0x0000000004EE6000-memory.dmp
        Filesize

        24KB

        Download
      • memory/2012-57-0x0000000000580000-0x00000000005C0000-memory.dmp
        Filesize

        256KB

        Download
      • memory/2012-56-0x00007FFAB2B30000-0x00007FFAB2D25000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/2012-60-0x0000000004F80000-0x0000000004FBE000-memory.dmp
        Filesize

        248KB

        Download