xenorat | e62a8640510e8a72b5f5b9115b94439df31cfe186970ce831fc2ac200605dcaf

Analysis

max time kernel
144s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26-08-2024 15:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Pago pendientes.doc
Size

141KB
MD5

1eefd150be33d5969d86f5dd82774291
SHA1

383a690269b80ca756e98387d6fcb6f7b9ae6c80
SHA256

e62a8640510e8a72b5f5b9115b94439df31cfe186970ce831fc2ac200605dcaf
SHA512

692e502198fe40e08bdb58f9864051663eb661990c5f0bc2165a86d79f57f5354c5d17b45495cc1562b166222f5ecf45923a77c8310393f67884fac6f471aa5b
SSDEEP

1536:XuonbOonbOonbV2mW7T+Y7Tx/RvvRdvkRRFbBoW5zzyJZjgkZrcrcrcuu9AUl/nl:K1DYGoMACJOue3flR5Pq3HWn08XQYp

Score

10^/10

xenorat discovery rat trojan

Malware Config

Extracted

Family

xenorat

45.66.231.26

Mutex

Uolid_rat_nd8889j

Attributes

delay
60000
install_path
appdata
port
1356
startup_name
ace

Signatures

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ITFRNLR.exe

Executes dropped EXE 4 IoCs

pid	Process
2808	ITFRNLR.exe
4864	ITFRNLR.exe
1132	ITFRNLR.exe
4772	ITFRNLR.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2808 set thread context of 4864	2808	ITFRNLR.exe	91
PID 1132 set thread context of 4772	1132	ITFRNLR.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2296	4772	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITFRNLR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITFRNLR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITFRNLR.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1748	WINWORD.EXE
1748	WINWORD.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2808	ITFRNLR.exe
Token: SeDebugPrivilege	1132	ITFRNLR.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1748	WINWORD.EXE
1748	WINWORD.EXE
1748	WINWORD.EXE
1748	WINWORD.EXE
1748	WINWORD.EXE
1748	WINWORD.EXE
1748	WINWORD.EXE

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 2808	1748	WINWORD.EXE	89
PID 1748 wrote to memory of 2808	1748	WINWORD.EXE	89
PID 1748 wrote to memory of 2808	1748	WINWORD.EXE	89
PID 2808 wrote to memory of 4864	2808	ITFRNLR.exe	91
PID 2808 wrote to memory of 4864	2808	ITFRNLR.exe	91
PID 2808 wrote to memory of 4864	2808	ITFRNLR.exe	91
PID 2808 wrote to memory of 4864	2808	ITFRNLR.exe	91
PID 2808 wrote to memory of 4864	2808	ITFRNLR.exe	91
PID 2808 wrote to memory of 4864	2808	ITFRNLR.exe	91
PID 2808 wrote to memory of 4864	2808	ITFRNLR.exe	91
PID 2808 wrote to memory of 4864	2808	ITFRNLR.exe	91
PID 4864 wrote to memory of 1132	4864	ITFRNLR.exe	92
PID 4864 wrote to memory of 1132	4864	ITFRNLR.exe	92
PID 4864 wrote to memory of 1132	4864	ITFRNLR.exe	92
PID 1132 wrote to memory of 4772	1132	ITFRNLR.exe	93
PID 1132 wrote to memory of 4772	1132	ITFRNLR.exe	93
PID 1132 wrote to memory of 4772	1132	ITFRNLR.exe	93
PID 1132 wrote to memory of 4772	1132	ITFRNLR.exe	93
PID 1132 wrote to memory of 4772	1132	ITFRNLR.exe	93
PID 1132 wrote to memory of 4772	1132	ITFRNLR.exe	93
PID 1132 wrote to memory of 4772	1132	ITFRNLR.exe	93
PID 1132 wrote to memory of 4772	1132	ITFRNLR.exe	93

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Pago pendientes.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ITFRNLR.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ITFRNLR.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ITFRNLR.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ITFRNLR.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4864
  - - C:\Users\Admin\AppData\Roaming\XenoManager\ITFRNLR.exe
      "C:\Users\Admin\AppData\Roaming\XenoManager\ITFRNLR.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1132
    - - C:\Users\Admin\AppData\Roaming\XenoManager\ITFRNLR.exe
        
        C:\Users\Admin\AppData\Roaming\XenoManager\ITFRNLR.exe
        5⤵
        Executes dropped EXE
        
        PID:4772
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 80
        6⤵
        Program crash
        
        PID:2296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4772 -ip 4772
1⤵
PID:4348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ITFRNLR.exe.log

Filesize
706B

MD5
d95c58e609838928f0f49837cab7dfd2

SHA1
55e7139a1e3899195b92ed8771d1ca2c7d53c916

SHA256
0407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339

SHA512
405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCDD330.tmp\sist02.xsl

Filesize
245KB

MD5
f883b260a8d67082ea895c14bf56dd56

SHA1
7954565c1f243d46ad3b1e2f1baf3281451fc14b

SHA256
ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

SHA512
d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ITFRNLR.exe

Filesize
354KB

MD5
3badedb0adc943d55394c06b6e43e2c8

SHA1
7f6d929b560edf98f3256970ec09358510ef4441

SHA256
276874edc2fa8fab8faad76b95f323b6e01bea7a058053c4ea674adfc51c59ed

SHA512
9daed3c7ab544e90f82ea9c303c94f7967d80450d23d7582060d46996ef00b688db407f09a7d1c582801439e7f0f65a4149019b9c46959861e519761cde2634c

Download Submit
memory/1748-136-0x00007FFC7AF8D000-0x00007FFC7AF8E000-memory.dmp

Filesize
4KB

Download
memory/1748-639-0x00007FFC3AF70000-0x00007FFC3AF80000-memory.dmp

Filesize
64KB

Download
memory/1748-5-0x00007FFC7AEF0000-0x00007FFC7B0E5000-memory.dmp

Filesize
2.0MB

Download
memory/1748-7-0x00007FFC3AF70000-0x00007FFC3AF80000-memory.dmp

Filesize
64KB

Download
memory/1748-4-0x00007FFC3AF70000-0x00007FFC3AF80000-memory.dmp

Filesize
64KB

Download
memory/1748-11-0x00007FFC7AEF0000-0x00007FFC7B0E5000-memory.dmp

Filesize
2.0MB

Download
memory/1748-10-0x00007FFC7AEF0000-0x00007FFC7B0E5000-memory.dmp

Filesize
2.0MB

Download
memory/1748-12-0x00007FFC7AEF0000-0x00007FFC7B0E5000-memory.dmp

Filesize
2.0MB

Download
memory/1748-643-0x00007FFC7AEF0000-0x00007FFC7B0E5000-memory.dmp

Filesize
2.0MB

Download
memory/1748-8-0x00007FFC7AEF0000-0x00007FFC7B0E5000-memory.dmp

Filesize
2.0MB

Download
memory/1748-14-0x00007FFC38900000-0x00007FFC38910000-memory.dmp

Filesize
64KB

Download
memory/1748-13-0x00007FFC7AEF0000-0x00007FFC7B0E5000-memory.dmp

Filesize
2.0MB

Download
memory/1748-15-0x00007FFC7AEF0000-0x00007FFC7B0E5000-memory.dmp

Filesize
2.0MB

Download
memory/1748-16-0x00007FFC38900000-0x00007FFC38910000-memory.dmp

Filesize
64KB

Download
memory/1748-51-0x00007FFC7AEF0000-0x00007FFC7B0E5000-memory.dmp

Filesize
2.0MB

Download
memory/1748-2-0x00007FFC3AF70000-0x00007FFC3AF80000-memory.dmp

Filesize
64KB

Download
memory/1748-640-0x00007FFC3AF70000-0x00007FFC3AF80000-memory.dmp

Filesize
64KB

Download
memory/1748-642-0x00007FFC3AF70000-0x00007FFC3AF80000-memory.dmp

Filesize
64KB

Download
memory/1748-9-0x00007FFC7AEF0000-0x00007FFC7B0E5000-memory.dmp

Filesize
2.0MB

Download
memory/1748-6-0x00007FFC7AEF0000-0x00007FFC7B0E5000-memory.dmp

Filesize
2.0MB

Download
memory/1748-641-0x00007FFC3AF70000-0x00007FFC3AF80000-memory.dmp

Filesize
64KB

Download
memory/1748-1-0x00007FFC3AF70000-0x00007FFC3AF80000-memory.dmp

Filesize
64KB

Download
memory/1748-142-0x00007FFC7AEF0000-0x00007FFC7B0E5000-memory.dmp

Filesize
2.0MB

Download
memory/1748-139-0x00007FFC7AEF0000-0x00007FFC7B0E5000-memory.dmp

Filesize
2.0MB

Download
memory/1748-138-0x00007FFC7AEF0000-0x00007FFC7B0E5000-memory.dmp

Filesize
2.0MB

Download
memory/1748-137-0x00007FFC7AEF0000-0x00007FFC7B0E5000-memory.dmp

Filesize
2.0MB

Download
memory/1748-3-0x00007FFC3AF70000-0x00007FFC3AF80000-memory.dmp

Filesize
64KB

Download
memory/1748-0-0x00007FFC7AF8D000-0x00007FFC7AF8E000-memory.dmp

Filesize
4KB

Download
memory/2808-108-0x000000000DA10000-0x000000000DAAC000-memory.dmp

Filesize
624KB

Download
memory/2808-111-0x0000000004870000-0x0000000004876000-memory.dmp

Filesize
24KB

Download
memory/2808-110-0x000000000DB50000-0x000000000DBE2000-memory.dmp

Filesize
584KB

Download
memory/2808-109-0x000000000E060000-0x000000000E604000-memory.dmp

Filesize
5.6MB

Download
memory/2808-116-0x00007FFC7AEF0000-0x00007FFC7B0E5000-memory.dmp

Filesize
2.0MB

Download
memory/2808-105-0x00000000003B0000-0x0000000000412000-memory.dmp

Filesize
392KB

Download
memory/2808-104-0x00007FFC7AEF0000-0x00007FFC7B0E5000-memory.dmp

Filesize
2.0MB

Download
memory/2808-107-0x000000000D920000-0x000000000D976000-memory.dmp

Filesize
344KB

Download
memory/2808-106-0x00000000026C0000-0x00000000026C6000-memory.dmp

Filesize
24KB

Download
memory/4864-112-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads