Analysis Overview
SHA256
5a0886fc82bedd52f94509ce17092f6ea671e53622edf852cd7ba20901d25354
Threat Level: Known bad
The file 4D5FC0012E9F61D18E5AEA4AE43349F2.exe was found to be: Known bad.
Malicious Activity Summary
Xenorat family
XenorRat
Loads dropped DLL
Checks computer location settings
Executes dropped EXE
Enumerates physical storage devices
Unsigned PE
System Location Discovery: System Language Discovery
Scheduled Task/Job: Scheduled Task
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-08-30 23:01
Signatures
Xenorat family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-08-30 23:01
Reported
2024-08-30 23:03
Platform
win7-20240704-en
Max time kernel
149s
Max time network
152s
Command Line
Signatures
XenorRat
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\XenoManager\4D5FC0012E9F61D18E5AEA4AE43349F2.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\4D5FC0012E9F61D18E5AEA4AE43349F2.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\4D5FC0012E9F61D18E5AEA4AE43349F2.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\XenoManager\4D5FC0012E9F61D18E5AEA4AE43349F2.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\XenoManager\4D5FC0012E9F61D18E5AEA4AE43349F2.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\4D5FC0012E9F61D18E5AEA4AE43349F2.exe
"C:\Users\Admin\AppData\Local\Temp\4D5FC0012E9F61D18E5AEA4AE43349F2.exe"
C:\Users\Admin\AppData\Roaming\XenoManager\4D5FC0012E9F61D18E5AEA4AE43349F2.exe
"C:\Users\Admin\AppData\Roaming\XenoManager\4D5FC0012E9F61D18E5AEA4AE43349F2.exe"
C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /Create /TN "Updater" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF5B4.tmp" /F
Network
| Country | Destination | Domain | Proto |
| US | 155.138.205.64:1010 | tcp | |
| US | 155.138.205.64:1010 | tcp | |
| US | 155.138.205.64:1010 | tcp |
Files
memory/1232-0-0x000000007407E000-0x000000007407F000-memory.dmp
memory/1232-1-0x0000000000A40000-0x0000000000A50000-memory.dmp
\Users\Admin\AppData\Roaming\XenoManager\4D5FC0012E9F61D18E5AEA4AE43349F2.exe
| MD5 | 4d5fc0012e9f61d18e5aea4ae43349f2 |
| SHA1 | c0cc2d966bbffeaebde61405af31d44e9b36786e |
| SHA256 | 5a0886fc82bedd52f94509ce17092f6ea671e53622edf852cd7ba20901d25354 |
| SHA512 | 2a92c27f153e80577a3adc46d872d75340a29e18782ea6c4134c0a4b81e9b886438c6012697bd55c02ecc37223ce5f089c6a6bfdba9ba25a78daa23953e61564 |
memory/2088-9-0x0000000001220000-0x0000000001230000-memory.dmp
memory/2088-10-0x0000000074070000-0x000000007475E000-memory.dmp
memory/2088-11-0x0000000074070000-0x000000007475E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmpF5B4.tmp
| MD5 | 5d476b4954927a8bfd193c0b380ed5ab |
| SHA1 | 1e5c37fbcde7a67382c2ab2c1d648c96baba812b |
| SHA256 | 4d0f0cd9173857b3dfdd653c39a6a868078a8b83e92233e48264abe7df04e878 |
| SHA512 | fe9f24da1d2809173f6e6ec3b5d169f3c06b379a0d11702ea85b7c05f76aeb4af9c9034b25c524ff88cca975bd8cd4f4887f692fcbaa6f76e38a8513f0557441 |
memory/2088-14-0x0000000074070000-0x000000007475E000-memory.dmp
memory/2088-15-0x0000000074070000-0x000000007475E000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-08-30 23:01
Reported
2024-08-30 23:03
Platform
win10v2004-20240802-en
Max time kernel
150s
Max time network
150s
Command Line
Signatures
XenorRat
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\4D5FC0012E9F61D18E5AEA4AE43349F2.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\XenoManager\4D5FC0012E9F61D18E5AEA4AE43349F2.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\4D5FC0012E9F61D18E5AEA4AE43349F2.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\XenoManager\4D5FC0012E9F61D18E5AEA4AE43349F2.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\XenoManager\4D5FC0012E9F61D18E5AEA4AE43349F2.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\4D5FC0012E9F61D18E5AEA4AE43349F2.exe
"C:\Users\Admin\AppData\Local\Temp\4D5FC0012E9F61D18E5AEA4AE43349F2.exe"
C:\Users\Admin\AppData\Roaming\XenoManager\4D5FC0012E9F61D18E5AEA4AE43349F2.exe
"C:\Users\Admin\AppData\Roaming\XenoManager\4D5FC0012E9F61D18E5AEA4AE43349F2.exe"
C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /Create /TN "Updater" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCE8B.tmp" /F
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 23.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| GB | 2.16.153.206:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 206.153.16.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 155.138.205.64:1010 | tcp | |
| US | 155.138.205.64:1010 | tcp | |
| US | 8.8.8.8:53 | 64.205.138.155.in-addr.arpa | udp |
| US | 155.138.205.64:1010 | tcp | |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 19.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 10.27.171.150.in-addr.arpa | udp |
Files
memory/4048-0-0x000000007491E000-0x000000007491F000-memory.dmp
memory/4048-1-0x00000000006E0000-0x00000000006F0000-memory.dmp
C:\Users\Admin\AppData\Roaming\XenoManager\4D5FC0012E9F61D18E5AEA4AE43349F2.exe
| MD5 | 4d5fc0012e9f61d18e5aea4ae43349f2 |
| SHA1 | c0cc2d966bbffeaebde61405af31d44e9b36786e |
| SHA256 | 5a0886fc82bedd52f94509ce17092f6ea671e53622edf852cd7ba20901d25354 |
| SHA512 | 2a92c27f153e80577a3adc46d872d75340a29e18782ea6c4134c0a4b81e9b886438c6012697bd55c02ecc37223ce5f089c6a6bfdba9ba25a78daa23953e61564 |
memory/4072-14-0x0000000074910000-0x00000000750C0000-memory.dmp
memory/4072-15-0x0000000074910000-0x00000000750C0000-memory.dmp
memory/4072-16-0x0000000074910000-0x00000000750C0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmpCE8B.tmp
| MD5 | 5d476b4954927a8bfd193c0b380ed5ab |
| SHA1 | 1e5c37fbcde7a67382c2ab2c1d648c96baba812b |
| SHA256 | 4d0f0cd9173857b3dfdd653c39a6a868078a8b83e92233e48264abe7df04e878 |
| SHA512 | fe9f24da1d2809173f6e6ec3b5d169f3c06b379a0d11702ea85b7c05f76aeb4af9c9034b25c524ff88cca975bd8cd4f4887f692fcbaa6f76e38a8513f0557441 |
memory/4072-19-0x0000000005A40000-0x0000000005AA6000-memory.dmp