Analysis Overview
SHA256
b85d7c34416d1790525a95f190a2ede356e611659c1199c31de24c2e1c10171e
Threat Level: Known bad
The file fnf nayeem sir mod.exe was found to be: Known bad.
Malicious Activity Summary
XenorRat
Xenorat family
Executes dropped EXE
Unsigned PE
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Scheduled Task/Job: Scheduled Task
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-08-13 13:13
Signatures
Xenorat family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-08-13 13:13
Reported
2024-08-13 13:16
Platform
win11-20240802-en
Max time kernel
149s
Max time network
156s
Command Line
Signatures
XenorRat
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\XenoManager\fnf nayeem sir mod.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\fnf nayeem sir mod.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\XenoManager\fnf nayeem sir mod.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4184 wrote to memory of 2972 | N/A | C:\Users\Admin\AppData\Local\Temp\fnf nayeem sir mod.exe | C:\Users\Admin\AppData\Roaming\XenoManager\fnf nayeem sir mod.exe |
| PID 4184 wrote to memory of 2972 | N/A | C:\Users\Admin\AppData\Local\Temp\fnf nayeem sir mod.exe | C:\Users\Admin\AppData\Roaming\XenoManager\fnf nayeem sir mod.exe |
| PID 4184 wrote to memory of 2972 | N/A | C:\Users\Admin\AppData\Local\Temp\fnf nayeem sir mod.exe | C:\Users\Admin\AppData\Roaming\XenoManager\fnf nayeem sir mod.exe |
| PID 2972 wrote to memory of 4196 | N/A | C:\Users\Admin\AppData\Roaming\XenoManager\fnf nayeem sir mod.exe | C:\Windows\SysWOW64\schtasks.exe |
| PID 2972 wrote to memory of 4196 | N/A | C:\Users\Admin\AppData\Roaming\XenoManager\fnf nayeem sir mod.exe | C:\Windows\SysWOW64\schtasks.exe |
| PID 2972 wrote to memory of 4196 | N/A | C:\Users\Admin\AppData\Roaming\XenoManager\fnf nayeem sir mod.exe | C:\Windows\SysWOW64\schtasks.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\fnf nayeem sir mod.exe
"C:\Users\Admin\AppData\Local\Temp\fnf nayeem sir mod.exe"
C:\Users\Admin\AppData\Roaming\XenoManager\fnf nayeem sir mod.exe
"C:\Users\Admin\AppData\Roaming\XenoManager\fnf nayeem sir mod.exe"
C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /Create /TN "macchanger" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA19F.tmp" /F
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 71.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| N/A | 127.0.0.1:4444 | tcp | |
| N/A | 127.0.0.1:4444 | tcp | |
| N/A | 127.0.0.1:4444 | tcp | |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| N/A | 127.0.0.1:4444 | tcp | |
| N/A | 127.0.0.1:4444 | tcp | |
| N/A | 127.0.0.1:4444 | tcp | |
| N/A | 127.0.0.1:4444 | tcp | |
| N/A | 127.0.0.1:4444 | tcp | |
| N/A | 127.0.0.1:4444 | tcp | |
| N/A | 127.0.0.1:4444 | tcp | |
| N/A | 127.0.0.1:4444 | tcp | |
| N/A | 127.0.0.1:4444 | tcp | |
| N/A | 127.0.0.1:4444 | tcp |
Files
memory/4184-0-0x000000007490E000-0x000000007490F000-memory.dmp
memory/4184-1-0x00000000000A0000-0x00000000000B0000-memory.dmp
C:\Users\Admin\AppData\Roaming\XenoManager\fnf nayeem sir mod.exe
| MD5 | b882799bf2bfee26b5f7c11dc6788134 |
| SHA1 | 6e7550054253349e498b5399ba8539036adb2e1f |
| SHA256 | b85d7c34416d1790525a95f190a2ede356e611659c1199c31de24c2e1c10171e |
| SHA512 | 5f918b654a663d7eec78fc71d48f3bbf91ffca8538f2a9a0f3f172f35cfa93af98f690edb77a44d2c8f8dcadcbf46e272780ba194cf634490b11a75b3b9f8689 |
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fnf nayeem sir mod.exe.log
| MD5 | 1294de804ea5400409324a82fdc7ec59 |
| SHA1 | 9a39506bc6cadf99c1f2129265b610c69d1518f7 |
| SHA256 | 494398ec6108c68573c366c96aae23d35e7f9bdbb440a4aab96e86fcad5871d0 |
| SHA512 | 033905cc5b4d0c0ffab2138da47e3223765146fa751c9f84b199284b653a04874c32a23aae577d2e06ce6c6b34fec62331b5fc928e3baf68dc53263ecdfa10c1 |
memory/2972-15-0x0000000074900000-0x00000000750B1000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmpA19F.tmp
| MD5 | 69f0de83ead64b9f8fb849961a089ced |
| SHA1 | efe9829b38ee7b982d095c34682887acde842a67 |
| SHA256 | c48694792074b0310fc29d3a84e66f11e2cc6d48d3fadb13114fa1811733999b |
| SHA512 | 04a46cc226f9be1f43fdfc05ab5dc70dc4373fe7878f0b60cf4e721729e6e0ed95fefb61e462ef1837e593515ad78fb3571b7d84680a6fd81531d5b6cb429de3 |
memory/2972-18-0x0000000074900000-0x00000000750B1000-memory.dmp
memory/2972-19-0x0000000074900000-0x00000000750B1000-memory.dmp