Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04-07-2024 17:22
Static task
static1
Behavioral task
behavioral1
Sample
8eaf377f8fc59bb93ada3e1f94571ebbbc3d3732475c86239ee72e4c1f2f31c7.xll
Resource
win7-20240508-en
General
-
Target
8eaf377f8fc59bb93ada3e1f94571ebbbc3d3732475c86239ee72e4c1f2f31c7.xll
-
Size
819KB
-
MD5
5475ac0337614b9651483ca83628c38f
-
SHA1
d03d0806bb24207780b441a090e3ff9e9d263929
-
SHA256
8eaf377f8fc59bb93ada3e1f94571ebbbc3d3732475c86239ee72e4c1f2f31c7
-
SHA512
d4d7d417fbadb98ac94e728c994b4ae7abc505632a1eb79d8f8193c71daa7bbbf2aa709713ec94ffa9b645dcf02b06907cd3fe1538840dfc22411c229bbcdb8c
-
SSDEEP
12288:xG1N4HkcgMsiOd58bzbBSre6Q0uqZzD1reWabd/dbNZEEx/DLn0vkYHipwyA:xoOOMX1K+QHT+d9NZdxYHip
Malware Config
Extracted
Extracted
xenorat
91.92.248.167
Wolid_rat_nd8889g
-
delay
60000
-
install_path
appdata
-
port
1279
-
startup_name
qns
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation c692b596-218c-42d3-aefd-6f62b01c11a0.exe -
Executes dropped EXE 8 IoCs
pid Process 3936 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 2416 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 4308 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 4640 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 4904 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 532 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 4220 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 4452 c692b596-218c-42d3-aefd-6f62b01c11a0.exe -
Loads dropped DLL 2 IoCs
pid Process 2220 EXCEL.EXE 2220 EXCEL.EXE -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 3936 set thread context of 2416 3936 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 83 PID 3936 set thread context of 4308 3936 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 84 PID 3936 set thread context of 4640 3936 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 85 PID 4904 set thread context of 532 4904 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 87 PID 4904 set thread context of 4220 4904 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 88 PID 4904 set thread context of 4452 4904 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 89 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process 2584 4220 WerFault.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 960 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2220 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2220 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2220 EXCEL.EXE Token: SeDebugPrivilege 3936 c692b596-218c-42d3-aefd-6f62b01c11a0.exe Token: SeDebugPrivilege 4904 c692b596-218c-42d3-aefd-6f62b01c11a0.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2220 EXCEL.EXE 2220 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2220 EXCEL.EXE 2220 EXCEL.EXE 2220 EXCEL.EXE 2220 EXCEL.EXE 2220 EXCEL.EXE 2220 EXCEL.EXE 2220 EXCEL.EXE 2220 EXCEL.EXE 2220 EXCEL.EXE 2220 EXCEL.EXE -
Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 2220 wrote to memory of 3936 2220 EXCEL.EXE 82 PID 2220 wrote to memory of 3936 2220 EXCEL.EXE 82 PID 2220 wrote to memory of 3936 2220 EXCEL.EXE 82 PID 3936 wrote to memory of 2416 3936 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 83 PID 3936 wrote to memory of 2416 3936 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 83 PID 3936 wrote to memory of 2416 3936 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 83 PID 3936 wrote to memory of 2416 3936 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 83 PID 3936 wrote to memory of 2416 3936 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 83 PID 3936 wrote to memory of 2416 3936 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 83 PID 3936 wrote to memory of 2416 3936 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 83 PID 3936 wrote to memory of 2416 3936 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 83 PID 3936 wrote to memory of 4308 3936 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 84 PID 3936 wrote to memory of 4308 3936 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 84 PID 3936 wrote to memory of 4308 3936 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 84 PID 3936 wrote to memory of 4308 3936 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 84 PID 3936 wrote to memory of 4308 3936 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 84 PID 3936 wrote to memory of 4308 3936 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 84 PID 3936 wrote to memory of 4308 3936 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 84 PID 3936 wrote to memory of 4308 3936 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 84 PID 3936 wrote to memory of 4640 3936 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 85 PID 3936 wrote to memory of 4640 3936 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 85 PID 3936 wrote to memory of 4640 3936 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 85 PID 3936 wrote to memory of 4640 3936 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 85 PID 3936 wrote to memory of 4640 3936 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 85 PID 3936 wrote to memory of 4640 3936 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 85 PID 3936 wrote to memory of 4640 3936 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 85 PID 3936 wrote to memory of 4640 3936 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 85 PID 2416 wrote to memory of 4904 2416 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 86 PID 2416 wrote to memory of 4904 2416 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 86 PID 2416 wrote to memory of 4904 2416 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 86 PID 4904 wrote to memory of 532 4904 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 87 PID 4904 wrote to memory of 532 4904 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 87 PID 4904 wrote to memory of 532 4904 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 87 PID 4904 wrote to memory of 532 4904 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 87 PID 4904 wrote to memory of 532 4904 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 87 PID 4904 wrote to memory of 532 4904 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 87 PID 4904 wrote to memory of 532 4904 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 87 PID 4904 wrote to memory of 532 4904 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 87 PID 4904 wrote to memory of 4220 4904 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 88 PID 4904 wrote to memory of 4220 4904 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 88 PID 4904 wrote to memory of 4220 4904 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 88 PID 4904 wrote to memory of 4220 4904 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 88 PID 4904 wrote to memory of 4220 4904 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 88 PID 4904 wrote to memory of 4220 4904 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 88 PID 4904 wrote to memory of 4220 4904 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 88 PID 4904 wrote to memory of 4220 4904 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 88 PID 4904 wrote to memory of 4452 4904 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 89 PID 4904 wrote to memory of 4452 4904 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 89 PID 4904 wrote to memory of 4452 4904 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 89 PID 4904 wrote to memory of 4452 4904 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 89 PID 4904 wrote to memory of 4452 4904 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 89 PID 4904 wrote to memory of 4452 4904 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 89 PID 4904 wrote to memory of 4452 4904 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 89 PID 4904 wrote to memory of 4452 4904 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 89 PID 4308 wrote to memory of 960 4308 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 102 PID 4308 wrote to memory of 960 4308 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 102 PID 4308 wrote to memory of 960 4308 c692b596-218c-42d3-aefd-6f62b01c11a0.exe 102
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\8eaf377f8fc59bb93ada3e1f94571ebbbc3d3732475c86239ee72e4c1f2f31c7.xll"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\c692b596-218c-42d3-aefd-6f62b01c11a0.exe"C:\Users\Admin\AppData\Local\Temp\c692b596-218c-42d3-aefd-6f62b01c11a0.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\c692b596-218c-42d3-aefd-6f62b01c11a0.exeC:\Users\Admin\AppData\Local\Temp\c692b596-218c-42d3-aefd-6f62b01c11a0.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Roaming\XenoManager\c692b596-218c-42d3-aefd-6f62b01c11a0.exe"C:\Users\Admin\AppData\Roaming\XenoManager\c692b596-218c-42d3-aefd-6f62b01c11a0.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Roaming\XenoManager\c692b596-218c-42d3-aefd-6f62b01c11a0.exeC:\Users\Admin\AppData\Roaming\XenoManager\c692b596-218c-42d3-aefd-6f62b01c11a0.exe5⤵
- Executes dropped EXE
PID:532
-
-
C:\Users\Admin\AppData\Roaming\XenoManager\c692b596-218c-42d3-aefd-6f62b01c11a0.exeC:\Users\Admin\AppData\Roaming\XenoManager\c692b596-218c-42d3-aefd-6f62b01c11a0.exe5⤵
- Executes dropped EXE
PID:4220 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4220 -s 806⤵
- Program crash
PID:2584
-
-
-
C:\Users\Admin\AppData\Roaming\XenoManager\c692b596-218c-42d3-aefd-6f62b01c11a0.exeC:\Users\Admin\AppData\Roaming\XenoManager\c692b596-218c-42d3-aefd-6f62b01c11a0.exe5⤵
- Executes dropped EXE
PID:4452
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\c692b596-218c-42d3-aefd-6f62b01c11a0.exeC:\Users\Admin\AppData\Local\Temp\c692b596-218c-42d3-aefd-6f62b01c11a0.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "qns" /XML "C:\Users\Admin\AppData\Local\Temp\tmp48FB.tmp" /F4⤵
- Scheduled Task/Job: Scheduled Task
PID:960
-
-
-
C:\Users\Admin\AppData\Local\Temp\c692b596-218c-42d3-aefd-6f62b01c11a0.exeC:\Users\Admin\AppData\Local\Temp\c692b596-218c-42d3-aefd-6f62b01c11a0.exe3⤵
- Executes dropped EXE
PID:4640
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4220 -ip 42201⤵PID:1536
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\c692b596-218c-42d3-aefd-6f62b01c11a0.exe.log
Filesize522B
MD58334a471a4b492ece225b471b8ad2fc8
SHA11cb24640f32d23e8f7800bd0511b7b9c3011d992
SHA2565612afe347d8549cc95a0c710602bcc7d7b224361b613c0a6ba362092300c169
SHA51256ae2e83355c331b00d782797f5664c2f373eac240e811aab978732503ae05eb20b08730d2427ed90efa5a706d71b42b57153596a45a6b5592e3dd9128b81c36
-
C:\Users\Admin\AppData\Local\Temp\8eaf377f8fc59bb93ada3e1f94571ebbbc3d3732475c86239ee72e4c1f2f31c7.xll
Filesize819KB
MD55475ac0337614b9651483ca83628c38f
SHA1d03d0806bb24207780b441a090e3ff9e9d263929
SHA2568eaf377f8fc59bb93ada3e1f94571ebbbc3d3732475c86239ee72e4c1f2f31c7
SHA512d4d7d417fbadb98ac94e728c994b4ae7abc505632a1eb79d8f8193c71daa7bbbf2aa709713ec94ffa9b645dcf02b06907cd3fe1538840dfc22411c229bbcdb8c
-
Filesize
233KB
MD5025593cacb392aadf7266febcb9f700a
SHA1602a4fcbbdaf682dc6311dc72468a00eb148ca86
SHA2566b09a61d15fd9835db561b9f7571c714333a071cce0facd8ac3dc39289ef8998
SHA5128e5c571c4905b418446cea26d8ef978706d1deb209227c602b8dbc5e9b9d23379bf42169887ee81dd287b9c07e43df733ffa7a72e4e279f9dfcec490710ed947
-
Filesize
1KB
MD529896be049a86e4c1084f2462d29067a
SHA1a71baba94016bc1ba2f9bdc0f66edab4d4df3e8e
SHA256318bfbe6e4663260dac588cb50c485d75e2fc7932e92557a0fd4952fc647e1ca
SHA512b4df14c13e4b628688bfa4d898b17f61ecc8e02ebf648e77aa94687d324046fc40eeee59cb984eff65bb4f86feccfb90bcf09734258014f5acf5680a0ec5517c