Analysis Overview
SHA256
6bed3b85a45853d8b4ce39d2db9ffbb2d54f90c15bde96caf9b08245e653fcec
Threat Level: Known bad
The file GCclientV1.exe was found to be: Known bad.
Malicious Activity Summary
XenorRat
Xenorat family
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Unsigned PE
System Location Discovery: System Language Discovery
Enumerates physical storage devices
Scheduled Task/Job: Scheduled Task
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-09-02 22:07
Signatures
Xenorat family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-09-02 22:07
Reported
2024-09-02 22:10
Platform
win7-20240705-en
Max time kernel
120s
Max time network
121s
Command Line
Signatures
XenorRat
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\GCclientV1.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\choice.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\GCclientV1.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\GCclientV1.exe
"C:\Users\Admin\AppData\Local\Temp\GCclientV1.exe"
C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe
"C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe"
C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /Create /TN "Client" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD308.tmp" /F
C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /query /v /fo csv
C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /delete /tn "\Client" /f
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe"
C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
Network
| Country | Destination | Domain | Proto |
| US | 108.234.74.132:5129 | tcp | |
| US | 108.234.74.132:5129 | tcp | |
| US | 108.234.74.132:5129 | tcp |
Files
memory/2512-0-0x0000000074D2E000-0x0000000074D2F000-memory.dmp
memory/2512-1-0x0000000000F50000-0x0000000000F62000-memory.dmp
\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe
| MD5 | 6c0987679747dfe56c8a4bc28860cb2f |
| SHA1 | 00ff1ad0b4000be73188c8b6a8d91a4a99c48b57 |
| SHA256 | 6bed3b85a45853d8b4ce39d2db9ffbb2d54f90c15bde96caf9b08245e653fcec |
| SHA512 | 4970b77b4f67de3d6731085f762daf10ebe751449671ccb7fea31076bdc941488f79136fbd697fc3e363d7a2b727604eff676012f0c75602e22b5f5411bb50c5 |
memory/3052-9-0x00000000010D0000-0x00000000010E2000-memory.dmp
memory/3052-10-0x0000000074D20000-0x000000007540E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmpD308.tmp
| MD5 | a1e9c508509e964318440cf83a8a0b98 |
| SHA1 | 0f575d72430d1da2ba1154ec2273d1a355099093 |
| SHA256 | f68ad25ac7180efd22da431ac63ed59ad9fe9c9866fceb86d430e40c52a1b771 |
| SHA512 | e1d1b1d121d2fc71f766784e463da13b21ec1756eb7de16edcac1182f1bf851ff5fb57431c2bd903b19f931237df5a1e1d5ff071ce2020398c44b49cc7646432 |
memory/3052-13-0x0000000074D20000-0x000000007540E000-memory.dmp
memory/3052-14-0x0000000074D20000-0x000000007540E000-memory.dmp
memory/3052-15-0x0000000074D20000-0x000000007540E000-memory.dmp
memory/3052-16-0x0000000074D20000-0x000000007540E000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-09-02 22:07
Reported
2024-09-02 22:10
Platform
win10v2004-20240802-en
Max time kernel
78s
Max time network
140s
Command Line
Signatures
XenorRat
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\GCclientV1.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\choice.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\GCclientV1.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\GCclientV1.exe
"C:\Users\Admin\AppData\Local\Temp\GCclientV1.exe"
C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe
"C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe"
C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /Create /TN "Client" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC9C8.tmp" /F
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /query /v /fo csv
C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /delete /tn "\Client" /f
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe"
C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.31.126.40.in-addr.arpa | udp |
| US | 108.234.74.132:5129 | tcp | |
| US | 108.234.74.132:5129 | tcp | |
| US | 108.234.74.132:5129 | tcp | |
| US | 8.8.8.8:53 | 132.74.234.108.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
Files
memory/3856-0-0x0000000074FBE000-0x0000000074FBF000-memory.dmp
memory/3856-1-0x0000000000410000-0x0000000000422000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe
| MD5 | 6c0987679747dfe56c8a4bc28860cb2f |
| SHA1 | 00ff1ad0b4000be73188c8b6a8d91a4a99c48b57 |
| SHA256 | 6bed3b85a45853d8b4ce39d2db9ffbb2d54f90c15bde96caf9b08245e653fcec |
| SHA512 | 4970b77b4f67de3d6731085f762daf10ebe751449671ccb7fea31076bdc941488f79136fbd697fc3e363d7a2b727604eff676012f0c75602e22b5f5411bb50c5 |
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\GCclientV1.exe.log
| MD5 | 916851e072fbabc4796d8916c5131092 |
| SHA1 | d48a602229a690c512d5fdaf4c8d77547a88e7a2 |
| SHA256 | 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d |
| SHA512 | 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521 |
memory/2708-15-0x0000000074FB0000-0x0000000075760000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmpC9C8.tmp
| MD5 | a1e9c508509e964318440cf83a8a0b98 |
| SHA1 | 0f575d72430d1da2ba1154ec2273d1a355099093 |
| SHA256 | f68ad25ac7180efd22da431ac63ed59ad9fe9c9866fceb86d430e40c52a1b771 |
| SHA512 | e1d1b1d121d2fc71f766784e463da13b21ec1756eb7de16edcac1182f1bf851ff5fb57431c2bd903b19f931237df5a1e1d5ff071ce2020398c44b49cc7646432 |
memory/2708-18-0x0000000006230000-0x0000000006296000-memory.dmp
memory/2708-19-0x0000000074FB0000-0x0000000075760000-memory.dmp
memory/2708-20-0x0000000074FB0000-0x0000000075760000-memory.dmp
memory/2708-21-0x0000000074FB0000-0x0000000075760000-memory.dmp