Overview

overview

10

Static

static

1

Spoofer.rar

windows10-2004-x64

3

Spoofer.rar

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240709-en
  • resource tags

    arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    22-07-2024 16:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Spoofer.rar

  • Size

    422KB

  • MD5

    cdc6779a69ce4a1e319c316dbf21c1e7

  • SHA1

    921679277b6af0283b827c0faf0bbdf8c6fcd3f4

  • SHA256

    c6768339c3b46430d12d13c5fc0571a677f68a420f44cad5d10e09c698bbbe11

  • SHA512

    faf8a677de0f0e8e1dc436686eb4686430c8e9a39b4daded9206fca471bfffc274867997be910a60bba269c0389c493868231da72d7222b1460eca25049141ab

  • SSDEEP

    6144:wvzWowkowg29s20s3/jZiAHgAKD4YtdepFsKMtfcO/LgRTu0tRIUp42y:+WkI2BsAKDjIpKCFTLRA2y

Score
10/10
xenoratrattrojan

Malware Config

Extracted

Family

xenorat

C2

62.133.174.224

Mutex

RuntimeBroker

Attributes
  • delay

    500

  • install_path

    appdata

  • port

    3056

  • startup_name

    RuntimeBroker

Signatures

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat
  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Spoofer.rar
    1⤵
    • Modifies registry class
    PID:4824
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:796
    • C:\Program Files\7-Zip\7zFM.exe
      "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Spoofer.rar"
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:1732
  • C:\Windows\System32\NOTEPAD.EXE
    "C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\ON-Restart.bat
    1⤵
      PID:2896
    • C:\Users\Admin\Desktop\Spoofer.exe
      "C:\Users\Admin\Desktop\Spoofer.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2328
      • C:\Users\Admin\AppData\Roaming\XenoManager\Spoofer.exe
        "C:\Users\Admin\AppData\Roaming\XenoManager\Spoofer.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4252
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks.exe" /Create /TN "RuntimeBroker" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8B53.tmp" /F
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1676

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Spoofer.exe.log
      Filesize

      226B

      MD5

      1294de804ea5400409324a82fdc7ec59

      SHA1

      9a39506bc6cadf99c1f2129265b610c69d1518f7

      SHA256

      494398ec6108c68573c366c96aae23d35e7f9bdbb440a4aab96e86fcad5871d0

      SHA512

      033905cc5b4d0c0ffab2138da47e3223765146fa751c9f84b199284b653a04874c32a23aae577d2e06ce6c6b34fec62331b5fc928e3baf68dc53263ecdfa10c1

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\tmp8B53.tmp
      Filesize

      1KB

      MD5

      09fbaabc7b71c07e7a69ad642ad06e6f

      SHA1

      476a704478db683f543761791888ffcbff864d01

      SHA256

      a51a98dfcc8710229d9c733ca72180add31445baae9cecd1ddf162af6dea0c8c

      SHA512

      74ca867319a4fe2c7dd6bcfb7da85c49fb33d0e7afec8bbc0373a6308f648025d08a2b60912e387ba921ea9164e3c3524627f020ea4ae0e7a696bea633869a7a

      Download Submit

    • C:\Users\Admin\Desktop\ON-Restart.bat
      Filesize

      83B

      MD5

      ffcbe4707b8a6c214c0093dcf0885a4f

      SHA1

      5a7e64e6c2ce16e4c61cfa2fbed4334f1e11e5df

      SHA256

      50971ab38f3042ac5798856645fe67bd116f7b4fe09c017eb39a65ee049e3f26

      SHA512

      a8b95a27e3ca9967c4f8a737fee11848d624071bd036839c1c2ae87878884d15f8b27b55e00e9ed02f3db1d10644c47e62b6988a38a4a69aee127c7752841643

      Download Submit

    • C:\Users\Admin\Desktop\Spoofer.exe
      Filesize

      46KB

      MD5

      8462795ada587c3bccdb59c2f48e5bfe

      SHA1

      ae155c1d78ba4adfbfe5aa022a2deb725fc1dc9a

      SHA256

      b676dadc109d8b1322111502103a943073180b3daa78a04637448b148730736d

      SHA512

      7860b4447fe17084e0225a052d9712b3fe332cdd6e4f59d1057e4613c07c416f1cfe36c1a49bf0f631a4289ac49fb24518c63fb03ed7a6df2af832361e764ff6

      Download Submit

    • memory/2328-21-0x0000000000A80000-0x0000000000A92000-memory.dmp

      Filesize

      72KB

      Download

    • memory/4252-37-0x0000000005C60000-0x0000000005CC6000-memory.dmp

      Filesize

      408KB

      Download