Analysis
-
max time kernel
63s -
max time network
73s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
25-07-2024 23:06
Errors
Reason
Machine shutdown
General
-
Target
reWASD.exe
-
Size
45KB
-
MD5
2aca4f66218f363789af6b07703099c4
-
SHA1
f79e9ed664bc63debb7e30b883886b1b232246b2
-
SHA256
69e4f7493e9dbf92314e0f5190ff19fc251427660369accf81c646ae6ec5024c
-
SHA512
9ab6580367d41b26fd7583e78f23b079a2deb08abe90145da80735d4a53062f69fbd5391ba72f489094f3e0095b0d225180dd09fd0e8257935746a4e1b9b8b8c
-
SSDEEP
768:udhO/poiiUcjlJInlkiH9Xqk5nWEZ5SbTDavWI7CPW5C:4w+jjgnbH9XqcnW85SbTmWIq
Score
10/10
Malware Config
Extracted
Family
xenorat
C2
81.246.210.135
Mutex
xaaxa
Attributes
-
delay
5000
-
install_path
nothingset
-
port
4412
-
startup_name
nothingset
Signatures
-
XenorRat
XenorRat is a remote access trojan written in C#.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\reWASD.exe"C:\Users\Admin\AppData\Local\Temp\reWASD.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
72KB
-
Filesize
40KB
-
Filesize
5.6MB