xenorat | e62a8640510e8a72b5f5b9115b94439df31cfe186970ce831fc2ac200605dcaf

Analysis

max time kernel
134s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26-08-2024 15:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Pago pendientes.doc
Size

141KB
MD5

1eefd150be33d5969d86f5dd82774291
SHA1

383a690269b80ca756e98387d6fcb6f7b9ae6c80
SHA256

e62a8640510e8a72b5f5b9115b94439df31cfe186970ce831fc2ac200605dcaf
SHA512

692e502198fe40e08bdb58f9864051663eb661990c5f0bc2165a86d79f57f5354c5d17b45495cc1562b166222f5ecf45923a77c8310393f67884fac6f471aa5b
SSDEEP

1536:XuonbOonbOonbV2mW7T+Y7Tx/RvvRdvkRRFbBoW5zzyJZjgkZrcrcrcuu9AUl/nl:K1DYGoMACJOue3flR5Pq3HWn08XQYp

Score

10^/10

xenorat discovery rat trojan

Malware Config

Extracted

Family

xenorat

45.66.231.26

Mutex

Uolid_rat_nd8889j

Attributes

delay
60000
install_path
appdata
port
1356
startup_name
ace

Signatures

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	ITFRNLR.exe

Executes dropped EXE 4 IoCs

pid	Process
4060	ITFRNLR.exe
3100	ITFRNLR.exe
4080	ITFRNLR.exe
1072	ITFRNLR.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4060 set thread context of 3100	4060	ITFRNLR.exe	94
PID 4080 set thread context of 1072	4080	ITFRNLR.exe	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2036	1072	WerFault.exe	98

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITFRNLR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITFRNLR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITFRNLR.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4524	WINWORD.EXE
4524	WINWORD.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4060	ITFRNLR.exe
Token: SeDebugPrivilege	4080	ITFRNLR.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4524	WINWORD.EXE
4524	WINWORD.EXE
4524	WINWORD.EXE
4524	WINWORD.EXE
4524	WINWORD.EXE
4524	WINWORD.EXE
4524	WINWORD.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1072	ITFRNLR.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 4060	4524	WINWORD.EXE	92
PID 4524 wrote to memory of 4060	4524	WINWORD.EXE	92
PID 4524 wrote to memory of 4060	4524	WINWORD.EXE	92
PID 4060 wrote to memory of 3100	4060	ITFRNLR.exe	94
PID 4060 wrote to memory of 3100	4060	ITFRNLR.exe	94
PID 4060 wrote to memory of 3100	4060	ITFRNLR.exe	94
PID 4060 wrote to memory of 3100	4060	ITFRNLR.exe	94
PID 4060 wrote to memory of 3100	4060	ITFRNLR.exe	94
PID 4060 wrote to memory of 3100	4060	ITFRNLR.exe	94
PID 4060 wrote to memory of 3100	4060	ITFRNLR.exe	94
PID 4060 wrote to memory of 3100	4060	ITFRNLR.exe	94
PID 3100 wrote to memory of 4080	3100	ITFRNLR.exe	95
PID 3100 wrote to memory of 4080	3100	ITFRNLR.exe	95
PID 3100 wrote to memory of 4080	3100	ITFRNLR.exe	95
PID 4080 wrote to memory of 1072	4080	ITFRNLR.exe	98
PID 4080 wrote to memory of 1072	4080	ITFRNLR.exe	98
PID 4080 wrote to memory of 1072	4080	ITFRNLR.exe	98
PID 4080 wrote to memory of 1072	4080	ITFRNLR.exe	98
PID 4080 wrote to memory of 1072	4080	ITFRNLR.exe	98
PID 4080 wrote to memory of 1072	4080	ITFRNLR.exe	98
PID 4080 wrote to memory of 1072	4080	ITFRNLR.exe	98
PID 4080 wrote to memory of 1072	4080	ITFRNLR.exe	98

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Pago pendientes.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ITFRNLR.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ITFRNLR.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ITFRNLR.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ITFRNLR.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3100
  - - C:\Users\Admin\AppData\Roaming\XenoManager\ITFRNLR.exe
      "C:\Users\Admin\AppData\Roaming\XenoManager\ITFRNLR.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4080
    - - C:\Users\Admin\AppData\Roaming\XenoManager\ITFRNLR.exe
        
        C:\Users\Admin\AppData\Roaming\XenoManager\ITFRNLR.exe
        5⤵
        Executes dropped EXE
        Suspicious use of UnmapMainImage
        
        PID:1072
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 12
        6⤵
        Program crash
        
        PID:2036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1072 -ip 1072
1⤵
PID:4560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ITFRNLR.exe.log

Filesize
706B

MD5
d95c58e609838928f0f49837cab7dfd2

SHA1
55e7139a1e3899195b92ed8771d1ca2c7d53c916

SHA256
0407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339

SHA512
405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCD5B3.tmp\iso690.xsl

Filesize
263KB

MD5
ff0e07eff1333cdf9fc2523d323dd654

SHA1
77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

SHA256
3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

SHA512
b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Filesize
16B

MD5
d29962abc88624befc0135579ae485ec

SHA1
e40a6458296ec6a2427bcb280572d023a9862b31

SHA256
a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

SHA512
4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ITFRNLR.exe

Filesize
354KB

MD5
3badedb0adc943d55394c06b6e43e2c8

SHA1
7f6d929b560edf98f3256970ec09358510ef4441

SHA256
276874edc2fa8fab8faad76b95f323b6e01bea7a058053c4ea674adfc51c59ed

SHA512
9daed3c7ab544e90f82ea9c303c94f7967d80450d23d7582060d46996ef00b688db407f09a7d1c582801439e7f0f65a4149019b9c46959861e519761cde2634c

Download Submit
memory/3100-118-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4060-117-0x00000000049C0000-0x00000000049C6000-memory.dmp

Filesize
24KB

Download
memory/4060-116-0x000000000DC00000-0x000000000DC92000-memory.dmp

Filesize
584KB

Download
memory/4060-115-0x000000000E1B0000-0x000000000E754000-memory.dmp

Filesize
5.6MB

Download
memory/4060-114-0x000000000DB60000-0x000000000DBFC000-memory.dmp

Filesize
624KB

Download
memory/4060-113-0x000000000DA70000-0x000000000DAC6000-memory.dmp

Filesize
344KB

Download
memory/4060-112-0x00000000027B0000-0x00000000027B6000-memory.dmp

Filesize
24KB

Download
memory/4060-111-0x00000000004A0000-0x0000000000502000-memory.dmp

Filesize
392KB

Download
memory/4524-14-0x00007FFC61CD0000-0x00007FFC61EC5000-memory.dmp

Filesize
2.0MB

Download
memory/4524-11-0x00007FFC61CD0000-0x00007FFC61EC5000-memory.dmp

Filesize
2.0MB

Download
memory/4524-19-0x00007FFC61CD0000-0x00007FFC61EC5000-memory.dmp

Filesize
2.0MB

Download
memory/4524-23-0x00007FFC61CD0000-0x00007FFC61EC5000-memory.dmp

Filesize
2.0MB

Download
memory/4524-22-0x00007FFC61CD0000-0x00007FFC61EC5000-memory.dmp

Filesize
2.0MB

Download
memory/4524-21-0x00007FFC61CD0000-0x00007FFC61EC5000-memory.dmp

Filesize
2.0MB

Download
memory/4524-20-0x00007FFC61CD0000-0x00007FFC61EC5000-memory.dmp

Filesize
2.0MB

Download
memory/4524-18-0x00007FFC61CD0000-0x00007FFC61EC5000-memory.dmp

Filesize
2.0MB

Download
memory/4524-17-0x00007FFC61CD0000-0x00007FFC61EC5000-memory.dmp

Filesize
2.0MB

Download
memory/4524-13-0x00007FFC61CD0000-0x00007FFC61EC5000-memory.dmp

Filesize
2.0MB

Download
memory/4524-7-0x00007FFC61CD0000-0x00007FFC61EC5000-memory.dmp

Filesize
2.0MB

Download
memory/4524-6-0x00007FFC61CD0000-0x00007FFC61EC5000-memory.dmp

Filesize
2.0MB

Download
memory/4524-66-0x00007FFC61CD0000-0x00007FFC61EC5000-memory.dmp

Filesize
2.0MB

Download
memory/4524-15-0x00007FFC1F7C0000-0x00007FFC1F7D0000-memory.dmp

Filesize
64KB

Download
memory/4524-0-0x00007FFC21D50000-0x00007FFC21D60000-memory.dmp

Filesize
64KB

Download
memory/4524-10-0x00007FFC61CD0000-0x00007FFC61EC5000-memory.dmp

Filesize
2.0MB

Download
memory/4524-12-0x00007FFC1F7C0000-0x00007FFC1F7D0000-memory.dmp

Filesize
64KB

Download
memory/4524-16-0x00007FFC61CD0000-0x00007FFC61EC5000-memory.dmp

Filesize
2.0MB

Download
memory/4524-8-0x00007FFC61CD0000-0x00007FFC61EC5000-memory.dmp

Filesize
2.0MB

Download
memory/4524-9-0x00007FFC61CD0000-0x00007FFC61EC5000-memory.dmp

Filesize
2.0MB

Download
memory/4524-2-0x00007FFC21D50000-0x00007FFC21D60000-memory.dmp

Filesize
64KB

Download
memory/4524-3-0x00007FFC21D50000-0x00007FFC21D60000-memory.dmp

Filesize
64KB

Download
memory/4524-1-0x00007FFC61D6D000-0x00007FFC61D6E000-memory.dmp

Filesize
4KB

Download
memory/4524-4-0x00007FFC21D50000-0x00007FFC21D60000-memory.dmp

Filesize
64KB

Download
memory/4524-141-0x00007FFC61CD0000-0x00007FFC61EC5000-memory.dmp

Filesize
2.0MB

Download
memory/4524-142-0x00007FFC61D6D000-0x00007FFC61D6E000-memory.dmp

Filesize
4KB

Download
memory/4524-143-0x00007FFC61CD0000-0x00007FFC61EC5000-memory.dmp

Filesize
2.0MB

Download
memory/4524-144-0x00007FFC61CD0000-0x00007FFC61EC5000-memory.dmp

Filesize
2.0MB

Download
memory/4524-150-0x00007FFC61CD0000-0x00007FFC61EC5000-memory.dmp

Filesize
2.0MB

Download
memory/4524-5-0x00007FFC21D50000-0x00007FFC21D60000-memory.dmp

Filesize
64KB

Download
memory/4524-648-0x00007FFC21D50000-0x00007FFC21D60000-memory.dmp

Filesize
64KB

Download
memory/4524-647-0x00007FFC21D50000-0x00007FFC21D60000-memory.dmp

Filesize
64KB

Download
memory/4524-650-0x00007FFC21D50000-0x00007FFC21D60000-memory.dmp

Filesize
64KB

Download
memory/4524-649-0x00007FFC21D50000-0x00007FFC21D60000-memory.dmp

Filesize
64KB

Download
memory/4524-651-0x00007FFC61CD0000-0x00007FFC61EC5000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads