xenorat | 8d84fc99073709f0c6049b80fa088c9af03c5525148e61b2d258cc3f1d4c7d8e

Analysis

max time kernel
133s
max time network
144s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 01:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d84fc99073709f0c6049b80fa088c9af03c5525148e61b2d258cc3f1d4c7d8e.exe
Size

45KB
MD5

899d4c38a9edf64f8513eaaf6f5aa8e4
SHA1

8dc9f2cf26ef7778031d4a02345cbbc982ab8aac
SHA256

8d84fc99073709f0c6049b80fa088c9af03c5525148e61b2d258cc3f1d4c7d8e
SHA512

a8b7346045f9b22f5fbd8d7db9ed4266da244c9337a630a3c8f05045e0a9872e21e72f82d45120adab9448c2e2b43d35b2b90de35caf7f67e0aaeae4e1fb3056
SSDEEP

768:pdhO/poiiUcjlJIn9bqmH9Xqk5nWEZ5SbTDa0WI7CPW5h:nw+jjgntH9XqcnW85SbTtWIZ

Score

10^/10

xenorat rat trojan

Malware Config

Extracted

Family

xenorat

82.9.14.4

Mutex

Xeno_rat_nd8912d

Attributes

delay
5000
install_path
appdata
port
4545
startup_name
windows

Signatures

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat

Executes dropped EXE 1 IoCs

pid	Process
2980	8d84fc99073709f0c6049b80fa088c9af03c5525148e61b2d258cc3f1d4c7d8e.exe

Loads dropped DLL 1 IoCs

pid	Process
2436	8d84fc99073709f0c6049b80fa088c9af03c5525148e61b2d258cc3f1d4c7d8e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2504	schtasks.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2980	2436	8d84fc99073709f0c6049b80fa088c9af03c5525148e61b2d258cc3f1d4c7d8e.exe	30
PID 2436 wrote to memory of 2980	2436	8d84fc99073709f0c6049b80fa088c9af03c5525148e61b2d258cc3f1d4c7d8e.exe	30
PID 2436 wrote to memory of 2980	2436	8d84fc99073709f0c6049b80fa088c9af03c5525148e61b2d258cc3f1d4c7d8e.exe	30
PID 2436 wrote to memory of 2980	2436	8d84fc99073709f0c6049b80fa088c9af03c5525148e61b2d258cc3f1d4c7d8e.exe	30
PID 2980 wrote to memory of 2504	2980	8d84fc99073709f0c6049b80fa088c9af03c5525148e61b2d258cc3f1d4c7d8e.exe	31
PID 2980 wrote to memory of 2504	2980	8d84fc99073709f0c6049b80fa088c9af03c5525148e61b2d258cc3f1d4c7d8e.exe	31
PID 2980 wrote to memory of 2504	2980	8d84fc99073709f0c6049b80fa088c9af03c5525148e61b2d258cc3f1d4c7d8e.exe	31
PID 2980 wrote to memory of 2504	2980	8d84fc99073709f0c6049b80fa088c9af03c5525148e61b2d258cc3f1d4c7d8e.exe	31

C:\Users\Admin\AppData\Local\Temp\8d84fc99073709f0c6049b80fa088c9af03c5525148e61b2d258cc3f1d4c7d8e.exe
"C:\Users\Admin\AppData\Local\Temp\8d84fc99073709f0c6049b80fa088c9af03c5525148e61b2d258cc3f1d4c7d8e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Users\Admin\AppData\Roaming\XenoManager\8d84fc99073709f0c6049b80fa088c9af03c5525148e61b2d258cc3f1d4c7d8e.exe
  "C:\Users\Admin\AppData\Roaming\XenoManager\8d84fc99073709f0c6049b80fa088c9af03c5525148e61b2d258cc3f1d4c7d8e.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /Create /TN "windows" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB589.tmp" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB589.tmp

Filesize
1KB

MD5
03867a1aff141db9a1c78c7300b798ee

SHA1
d02ae3dcec1e7ddd1d47f9e3f979d975acde01cb

SHA256
82aeaec021ff1c87066ed6326f243f5b286deec286313b76c7f3ce2938b45890

SHA512
dfbebeb925bc4ba64769c121a8eedc1302cfe6527a8e1f84f7257e23245017e6517a1e862d4874b5d74d30f90f3a625e96ba966825bf27e701078fd4ea599632

Download Submit
C:\Users\Admin\AppData\Roaming\XenoManager\8d84fc99073709f0c6049b80fa088c9af03c5525148e61b2d258cc3f1d4c7d8e.exe

Filesize
45KB

MD5
899d4c38a9edf64f8513eaaf6f5aa8e4

SHA1
8dc9f2cf26ef7778031d4a02345cbbc982ab8aac

SHA256
8d84fc99073709f0c6049b80fa088c9af03c5525148e61b2d258cc3f1d4c7d8e

SHA512
a8b7346045f9b22f5fbd8d7db9ed4266da244c9337a630a3c8f05045e0a9872e21e72f82d45120adab9448c2e2b43d35b2b90de35caf7f67e0aaeae4e1fb3056

Download Submit
memory/2436-0-0x00000000744DE000-0x00000000744DF000-memory.dmp

Filesize
4KB

Download
memory/2436-1-0x0000000000800000-0x0000000000812000-memory.dmp

Filesize
72KB

Download
memory/2980-9-0x0000000073DEE000-0x0000000073DEF000-memory.dmp

Filesize
4KB

Download
memory/2980-10-0x0000000000FE0000-0x0000000000FF2000-memory.dmp

Filesize
72KB

Download
memory/2980-13-0x0000000073DE0000-0x00000000744CE000-memory.dmp

Filesize
6.9MB

Download
memory/2980-14-0x0000000073DE0000-0x00000000744CE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads