Analysis

  • max time kernel
    146s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-07-2024 16:54

General

  • Target

    6621fcab4de5fab7eac4d8d03c87f233.exe

  • Size

    221KB

  • MD5

    6621fcab4de5fab7eac4d8d03c87f233

  • SHA1

    70dd77e26e803239877b30439eb123454bc137cc

  • SHA256

    ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2

  • SHA512

    d132d2399c65b6b0083f7172c04d4708b28b3deceb93fd0c5dfc5bcfdfd9ee459c5b46853d176e08e99a2a8842945e6cd396e4137fac430c67abea388e83789c

  • SSDEEP

    6144:WdwDpybdvNg134Gnq2YZstYaGaqjWq9441D/Kv+I:/cE134GiZ4Ya7mWq9441D/Kvj

Score
10/10

Malware Config

Extracted

Family

xenorat

C2

91.92.248.167

Mutex

Wolid_rat_nd8859g

Attributes
  • delay

    60000

  • install_path

    appdata

  • port

    1280

  • startup_name

    cms

Signatures

  • XenorRat

    XenorRat is a remote access trojan written in C#.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6621fcab4de5fab7eac4d8d03c87f233.exe
    "C:\Users\Admin\AppData\Local\Temp\6621fcab4de5fab7eac4d8d03c87f233.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:924
    • C:\Users\Admin\AppData\Local\Temp\6621fcab4de5fab7eac4d8d03c87f233.exe
      C:\Users\Admin\AppData\Local\Temp\6621fcab4de5fab7eac4d8d03c87f233.exe
      2⤵
        PID:3552
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 80
          3⤵
          • Program crash
          PID:4116
      • C:\Users\Admin\AppData\Local\Temp\6621fcab4de5fab7eac4d8d03c87f233.exe
        C:\Users\Admin\AppData\Local\Temp\6621fcab4de5fab7eac4d8d03c87f233.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1512
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks.exe" /Create /TN "cms" /XML "C:\Users\Admin\AppData\Local\Temp\tmp431F.tmp" /F
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:964
      • C:\Users\Admin\AppData\Local\Temp\6621fcab4de5fab7eac4d8d03c87f233.exe
        C:\Users\Admin\AppData\Local\Temp\6621fcab4de5fab7eac4d8d03c87f233.exe
        2⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:220
        • C:\Users\Admin\AppData\Roaming\XenoManager\6621fcab4de5fab7eac4d8d03c87f233.exe
          "C:\Users\Admin\AppData\Roaming\XenoManager\6621fcab4de5fab7eac4d8d03c87f233.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4852
          • C:\Users\Admin\AppData\Roaming\XenoManager\6621fcab4de5fab7eac4d8d03c87f233.exe
            C:\Users\Admin\AppData\Roaming\XenoManager\6621fcab4de5fab7eac4d8d03c87f233.exe
            4⤵
            • Executes dropped EXE
            PID:3752
          • C:\Users\Admin\AppData\Roaming\XenoManager\6621fcab4de5fab7eac4d8d03c87f233.exe
            C:\Users\Admin\AppData\Roaming\XenoManager\6621fcab4de5fab7eac4d8d03c87f233.exe
            4⤵
            • Executes dropped EXE
            PID:4004
          • C:\Users\Admin\AppData\Roaming\XenoManager\6621fcab4de5fab7eac4d8d03c87f233.exe
            C:\Users\Admin\AppData\Roaming\XenoManager\6621fcab4de5fab7eac4d8d03c87f233.exe
            4⤵
            • Executes dropped EXE
            PID:2968
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 80
              5⤵
              • Program crash
              PID:3784
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3552 -ip 3552
      1⤵
        PID:2400
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2968 -ip 2968
        1⤵
          PID:2712

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\6621fcab4de5fab7eac4d8d03c87f233.exe.log

          Filesize

          706B

          MD5

          d95c58e609838928f0f49837cab7dfd2

          SHA1

          55e7139a1e3899195b92ed8771d1ca2c7d53c916

          SHA256

          0407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339

          SHA512

          405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d

        • C:\Users\Admin\AppData\Local\Temp\tmp431F.tmp

          Filesize

          1KB

          MD5

          9bebe31e5ff2a5eae2b0cbbdb94e5a4f

          SHA1

          731c8074c0b0d2280be5b1ff5d2ecdbaef82c803

          SHA256

          4a7ceb2293c43dca1314f795c40bff88871639dc9db342b63841434ad691546e

          SHA512

          74335ddfcb6b2bba86ecfb45a99ecfc85ec0d76ada26cb795346aab45b2190072147b6d7c345621a324db1ac1205bbb21698d5e23e71902857f92a02a946e05e

        • C:\Users\Admin\AppData\Roaming\XenoManager\6621fcab4de5fab7eac4d8d03c87f233.exe

          Filesize

          221KB

          MD5

          6621fcab4de5fab7eac4d8d03c87f233

          SHA1

          70dd77e26e803239877b30439eb123454bc137cc

          SHA256

          ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2

          SHA512

          d132d2399c65b6b0083f7172c04d4708b28b3deceb93fd0c5dfc5bcfdfd9ee459c5b46853d176e08e99a2a8842945e6cd396e4137fac430c67abea388e83789c

        • memory/220-16-0x0000000074A50000-0x0000000075200000-memory.dmp

          Filesize

          7.7MB

        • memory/220-29-0x0000000074A50000-0x0000000075200000-memory.dmp

          Filesize

          7.7MB

        • memory/924-4-0x0000000074A50000-0x0000000075200000-memory.dmp

          Filesize

          7.7MB

        • memory/924-3-0x000000000E3A0000-0x000000000E3DA000-memory.dmp

          Filesize

          232KB

        • memory/924-7-0x000000000E5C0000-0x000000000E652000-memory.dmp

          Filesize

          584KB

        • memory/924-8-0x00000000052E0000-0x00000000052E6000-memory.dmp

          Filesize

          24KB

        • memory/924-1-0x0000000000F70000-0x0000000000FAC000-memory.dmp

          Filesize

          240KB

        • memory/924-2-0x00000000019B0000-0x00000000019B6000-memory.dmp

          Filesize

          24KB

        • memory/924-0-0x0000000074A5E000-0x0000000074A5F000-memory.dmp

          Filesize

          4KB

        • memory/924-15-0x0000000074A50000-0x0000000075200000-memory.dmp

          Filesize

          7.7MB

        • memory/924-6-0x000000000EAD0000-0x000000000F074000-memory.dmp

          Filesize

          5.6MB

        • memory/924-5-0x000000000E480000-0x000000000E51C000-memory.dmp

          Filesize

          624KB

        • memory/1512-17-0x0000000074A50000-0x0000000075200000-memory.dmp

          Filesize

          7.7MB

        • memory/1512-13-0x0000000074A50000-0x0000000075200000-memory.dmp

          Filesize

          7.7MB

        • memory/1512-38-0x0000000074A50000-0x0000000075200000-memory.dmp

          Filesize

          7.7MB

        • memory/1512-10-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/4852-30-0x0000000074A50000-0x0000000075200000-memory.dmp

          Filesize

          7.7MB

        • memory/4852-37-0x0000000074A50000-0x0000000075200000-memory.dmp

          Filesize

          7.7MB