Overview

overview

10

Static

static

1

1e2f9bb7d4...e7.lnk

windows7-x64

10

1e2f9bb7d4...e7.lnk

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1e2f9bb7d4aee809ae89704f6225503bf72b09ca897986ab70a00332fdf10ae7.lnk

  • Size

    2KB

  • Sample

    240727-bht54azdpg

  • MD5

    4db66f511c6604f1be1ae032b84f8358

  • SHA1

    8ab73293cf42ead05326874845622cea78822c8f

  • SHA256

    1e2f9bb7d4aee809ae89704f6225503bf72b09ca897986ab70a00332fdf10ae7

  • SHA512

    2cf294db093bbe00ce504d2817dced1d62d7eb8af4a7183836fb4af0288f7e5018cd2226bea522ad5464b911317bd184bb36303e766fa4a59239f87878510c67

Score
10/10
xenoratdiscoveryexecutionrattrojan

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://94.156.67.244:5679/abincontents/sthdytjdtuoigfyuqurbjzksbfgbshbfabirgtrht/ioihirabgbrdhbgwhkebgrsryftsevrfsyubkhabvyrgbksdtg/Display1.exe

Extracted

Family

xenorat

C2

45.66.231.63

Mutex

Holid_rat_nd8859g

Attributes
  • delay

    60400

  • install_path

    appdata

  • port

    1243

  • startup_name

    HDdisplay

Targets

    • Target

      1e2f9bb7d4aee809ae89704f6225503bf72b09ca897986ab70a00332fdf10ae7.lnk

    • Size

      2KB

    • MD5

      4db66f511c6604f1be1ae032b84f8358

    • SHA1

      8ab73293cf42ead05326874845622cea78822c8f

    • SHA256

      1e2f9bb7d4aee809ae89704f6225503bf72b09ca897986ab70a00332fdf10ae7

    • SHA512

      2cf294db093bbe00ce504d2817dced1d62d7eb8af4a7183836fb4af0288f7e5018cd2226bea522ad5464b911317bd184bb36303e766fa4a59239f87878510c67

    Score
    10/10
    executionxenoratdiscoveryrattrojan

    • XenorRat

      XenorRat is a remote access trojan written in C#.

      trojanratxenorat

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks