Analysis

  • max time kernel
    138s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-07-2024 16:56

General

  • Target

    697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

  • Size

    236KB

  • MD5

    5f86d94893b47e542cf857749dfcd185

  • SHA1

    7816d9af40a9e9265708df00af8137db67d8c7aa

  • SHA256

    697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab

  • SHA512

    8cf9bb6ba985843d57f2a013e40d3243b89e5aa0af07d504e9bcc7a2b577028a9cf24258bab14e256b7cb11f75a9a5993eff920879ab11f24c926bce85fb4c7d

  • SSDEEP

    6144:wA0gX+3bpKthw8rZg+mr08M0O5wkoYfMJRNeUqNI:wA0gXgpKNknMX57ocMJRNeUq2

Score
10/10

Malware Config

Extracted

Family

xenorat

C2

91.92.248.167

Mutex

Wolid_rat_nd8859g

Attributes
  • delay

    60000

  • install_path

    appdata

  • port

    1280

  • startup_name

    cms

Signatures

  • XenorRat

    XenorRat is a remote access trojan written in C#.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
    "C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4992
    • C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
      C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4556
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks.exe" /Create /TN "cms" /XML "C:\Users\Admin\AppData\Local\Temp\tmp22B6.tmp" /F
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4828
    • C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
      C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:1388
      • C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
        "C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4692
        • C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
          C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
          4⤵
          • Executes dropped EXE
          PID:2508
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 80
            5⤵
            • Program crash
            PID:380
        • C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
          C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
          4⤵
          • Executes dropped EXE
          PID:3252
        • C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
          C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
          4⤵
          • Executes dropped EXE
          PID:4968
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 80
            5⤵
            • Program crash
            PID:2744
    • C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
      C:\Users\Admin\AppData\Local\Temp\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe
      2⤵
        PID:3756
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4968 -ip 4968
      1⤵
        PID:5032
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2508 -ip 2508
        1⤵
          PID:3524

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe.log

          Filesize

          522B

          MD5

          8334a471a4b492ece225b471b8ad2fc8

          SHA1

          1cb24640f32d23e8f7800bd0511b7b9c3011d992

          SHA256

          5612afe347d8549cc95a0c710602bcc7d7b224361b613c0a6ba362092300c169

          SHA512

          56ae2e83355c331b00d782797f5664c2f373eac240e811aab978732503ae05eb20b08730d2427ed90efa5a706d71b42b57153596a45a6b5592e3dd9128b81c36

        • C:\Users\Admin\AppData\Local\Temp\tmp22B6.tmp

          Filesize

          1KB

          MD5

          3d5fb318f0c4c844c417b4dd9ec02498

          SHA1

          b83b629d7a8f7a016e30cb3a9eb1b76de34bc78b

          SHA256

          981169aaa6f00dccdf0822989180d3bb96c6b45fa9b6a819935da76c24dd795e

          SHA512

          6c141efe1857b1d2ba74ea10fd766166161815d869b5217f79799c650ec2b87f44f36f278b9d1a3f4a754243c5ac4a3abe1aabd74fd3c61903db20403e915806

        • C:\Users\Admin\AppData\Roaming\XenoManager\697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab.exe

          Filesize

          236KB

          MD5

          5f86d94893b47e542cf857749dfcd185

          SHA1

          7816d9af40a9e9265708df00af8137db67d8c7aa

          SHA256

          697098bd0a7aed4fa228af96addb4e6635c6ff69c80f729f3f0e82db62fc95ab

          SHA512

          8cf9bb6ba985843d57f2a013e40d3243b89e5aa0af07d504e9bcc7a2b577028a9cf24258bab14e256b7cb11f75a9a5993eff920879ab11f24c926bce85fb4c7d

        • memory/1388-28-0x00000000747B0000-0x0000000074F60000-memory.dmp

          Filesize

          7.7MB

        • memory/1388-14-0x00000000747B0000-0x0000000074F60000-memory.dmp

          Filesize

          7.7MB

        • memory/2508-29-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

        • memory/3756-16-0x00000000747B0000-0x0000000074F60000-memory.dmp

          Filesize

          7.7MB

        • memory/3756-36-0x00000000747B0000-0x0000000074F60000-memory.dmp

          Filesize

          7.7MB

        • memory/4556-17-0x00000000747B0000-0x0000000074F60000-memory.dmp

          Filesize

          7.7MB

        • memory/4556-12-0x00000000747B0000-0x0000000074F60000-memory.dmp

          Filesize

          7.7MB

        • memory/4556-7-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/4556-35-0x00000000747B0000-0x0000000074F60000-memory.dmp

          Filesize

          7.7MB

        • memory/4992-6-0x0000000004870000-0x0000000004876000-memory.dmp

          Filesize

          24KB

        • memory/4992-3-0x00000000747B0000-0x0000000074F60000-memory.dmp

          Filesize

          7.7MB

        • memory/4992-2-0x0000000002750000-0x0000000002756000-memory.dmp

          Filesize

          24KB

        • memory/4992-0-0x00000000747BE000-0x00000000747BF000-memory.dmp

          Filesize

          4KB

        • memory/4992-5-0x000000000DA60000-0x000000000DAFC000-memory.dmp

          Filesize

          624KB

        • memory/4992-15-0x00000000747B0000-0x0000000074F60000-memory.dmp

          Filesize

          7.7MB

        • memory/4992-4-0x0000000004E50000-0x0000000004E8E000-memory.dmp

          Filesize

          248KB

        • memory/4992-1-0x0000000000420000-0x0000000000460000-memory.dmp

          Filesize

          256KB