Analysis
-
max time kernel
145s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
18-07-2024 17:00
Behavioral task
behavioral1
Sample
xeno rat server.exe
Resource
win7-20240708-en
windows7-x64
1 signatures
300 seconds
General
-
Target
xeno rat server.exe
-
Size
2.0MB
-
MD5
3987ee127f2a2cf8a29573d4e111a8e8
-
SHA1
fc253131e832297967f93190217f0ce403e38cb0
-
SHA256
3d00a800474ddf382212e003222805bd74665b69cec43b554f91c3cd9edf04c4
-
SHA512
69d5ac7a691dde1a3ed7f495e9b9180e63152ddaaa3d1b596ad9cbeb4d7b088f3fc4b138ecf87070014cdfa9047be18940b720de60642389921a10053250787b
-
SSDEEP
49152:EnxkNTRWjxoJochWQI3kqXfd+/9AManGhR0vNgtIeGWtOc5Q:ExkNTcaJhDI3kqXf0FtWykQDCiQ
Malware Config
Extracted
Family
xenorat
C2
127.0.0.1
Mutex
Xeno_rat_nd8912d
Attributes
-
delay
5000
-
install_path
nothingset
-
port
5555
-
startup_name
nothingset
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1148 test.exe 2244 test.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 45 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 7e00310000000000e958037411004465736b746f7000680009000400efbee9586670e95803742e0000007ce101000000010000000000000000003e0000000000f2b5fb004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000 xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff xeno rat server.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" xeno rat server.exe Set value (int) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff xeno rat server.exe Key created \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff xeno rat server.exe Key created \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 xeno rat server.exe Set value (int) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\NodeSlot = "1" xeno rat server.exe Key created \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ xeno rat server.exe Key created \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} xeno rat server.exe Set value (int) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" xeno rat server.exe Key created \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff xeno rat server.exe Set value (int) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 xeno rat server.exe Key created \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU xeno rat server.exe Key created \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 xeno rat server.exe Key created \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 xeno rat server.exe Key created \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = ffffffff xeno rat server.exe Key created \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 xeno rat server.exe Set value (int) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7800310000000000e95866701100557365727300640009000400efbe874f7748f25814882e000000c70500000000010000000000000000003a000000000025e87f0055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 5000310000000000e958a974100041646d696e003c0009000400efbee9586670f25814882e00000072e101000000010000000000000000000000000000001d8fee00410064006d0069006e00000014000000 xeno rat server.exe Key created \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 xeno rat server.exe Key created \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 xeno rat server.exe Key created \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff xeno rat server.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" xeno rat server.exe Set value (int) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" xeno rat server.exe Set value (int) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" xeno rat server.exe Set value (int) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff xeno rat server.exe Key created \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags xeno rat server.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ xeno rat server.exe Set value (int) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff xeno rat server.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 2244 test.exe 2244 test.exe 2244 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 2244 test.exe 2244 test.exe 2244 test.exe 2244 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 1148 test.exe 2244 test.exe 2244 test.exe 2244 test.exe 1148 test.exe 1148 test.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2572 xeno rat server.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1148 test.exe Token: SeDebugPrivilege 2244 test.exe Token: SeDebugPrivilege 2572 xeno rat server.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2244 test.exe 2572 xeno rat server.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2572 xeno rat server.exe 2572 xeno rat server.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\xeno rat server.exe"C:\Users\Admin\AppData\Local\Temp\xeno rat server.exe"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2572
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3028
-
C:\Users\Admin\Desktop\test.exe"C:\Users\Admin\Desktop\test.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1148
-
C:\Users\Admin\Desktop\test.exe"C:\Users\Admin\Desktop\test.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2244
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD51a99461e7d709874a2b22399f75beffb
SHA16e45081b803d2ef73e89e3594082cc533528fe8c
SHA256ecd1977de740ca14b2a45beac2659f53345062fda664b243d8c59b5b84fd5fd1
SHA512552795d66c409ac2f4c29f2ae6170b578bf7d4461f680e5822d6d9d67bba5bc5d49e2863017b2aa0f6e0ef874c648be5e5b4ee91e5d4da5c3ba9efbcfadd6790