Analysis Overview
SHA256
e20a68d2f697e867867fa7a54688b02d80f7703a4134747fb1c4f90068cd76c6
Threat Level: Known bad
The file svc.exe was found to be: Known bad.
Malicious Activity Summary
Xenorat family
XenorRat
Executes dropped EXE
Unsigned PE
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of WriteProcessMemory
Scheduled Task/Job: Scheduled Task
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-09-03 00:50
Signatures
Xenorat family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-09-03 00:50
Reported
2024-09-03 00:53
Platform
win11-20240802-en
Max time kernel
133s
Max time network
141s
Command Line
Signatures
XenorRat
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\XenoManager\svc.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\svc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\XenoManager\svc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4796 wrote to memory of 3152 | N/A | C:\Users\Admin\AppData\Local\Temp\svc.exe | C:\Users\Admin\AppData\Roaming\XenoManager\svc.exe |
| PID 4796 wrote to memory of 3152 | N/A | C:\Users\Admin\AppData\Local\Temp\svc.exe | C:\Users\Admin\AppData\Roaming\XenoManager\svc.exe |
| PID 4796 wrote to memory of 3152 | N/A | C:\Users\Admin\AppData\Local\Temp\svc.exe | C:\Users\Admin\AppData\Roaming\XenoManager\svc.exe |
| PID 3152 wrote to memory of 4224 | N/A | C:\Users\Admin\AppData\Roaming\XenoManager\svc.exe | C:\Windows\SysWOW64\schtasks.exe |
| PID 3152 wrote to memory of 4224 | N/A | C:\Users\Admin\AppData\Roaming\XenoManager\svc.exe | C:\Windows\SysWOW64\schtasks.exe |
| PID 3152 wrote to memory of 4224 | N/A | C:\Users\Admin\AppData\Roaming\XenoManager\svc.exe | C:\Windows\SysWOW64\schtasks.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\svc.exe
"C:\Users\Admin\AppData\Local\Temp\svc.exe"
C:\Users\Admin\AppData\Roaming\XenoManager\svc.exe
"C:\Users\Admin\AppData\Roaming\XenoManager\svc.exe"
C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /Create /TN "svchost.exe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9ED0.tmp" /F
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
Network
| Country | Destination | Domain | Proto |
| N/A | 10.200.166.240:4895 | tcp | |
| US | 8.8.8.8:53 | cxcs.microsoft.net | udp |
| GB | 23.62.195.195:443 | cxcs.microsoft.net | tcp |
| GB | 95.101.143.219:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 195.195.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.144.22.2.in-addr.arpa | udp |
| N/A | 10.200.166.240:4895 | tcp | |
| N/A | 10.200.166.240:4895 | tcp | |
| NL | 52.111.243.29:443 | tcp | |
| N/A | 10.200.166.240:4895 | tcp | |
| N/A | 10.200.166.240:4895 | tcp |
Files
memory/4796-0-0x0000000074B3E000-0x0000000074B3F000-memory.dmp
memory/4796-1-0x00000000003D0000-0x00000000003E2000-memory.dmp
C:\Users\Admin\AppData\Roaming\XenoManager\svc.exe
| MD5 | 75cf1faac1fbab522db5273d2916eb02 |
| SHA1 | b3ede9b5b70d9742a576c6f8e70e3961a24612a8 |
| SHA256 | e20a68d2f697e867867fa7a54688b02d80f7703a4134747fb1c4f90068cd76c6 |
| SHA512 | ab2946a0f8d00b66f5a0e86573eb129c3a536ae36351144f51ed6857be975a14d02b0a6df1ab9172a251fbf88baa976ecef3410e45fa4bb2ea406c2c9edbd1e2 |
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\svc.exe.log
| MD5 | 1294de804ea5400409324a82fdc7ec59 |
| SHA1 | 9a39506bc6cadf99c1f2129265b610c69d1518f7 |
| SHA256 | 494398ec6108c68573c366c96aae23d35e7f9bdbb440a4aab96e86fcad5871d0 |
| SHA512 | 033905cc5b4d0c0ffab2138da47e3223765146fa751c9f84b199284b653a04874c32a23aae577d2e06ce6c6b34fec62331b5fc928e3baf68dc53263ecdfa10c1 |
memory/3152-15-0x0000000074B30000-0x00000000752E1000-memory.dmp
memory/3152-16-0x0000000074B30000-0x00000000752E1000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmp9ED0.tmp
| MD5 | 94cd31e71f57eb3085536d649796ff66 |
| SHA1 | 3705ddb2045ae6c6934050d50187fd2ba27f6924 |
| SHA256 | 9f17cee5a66d0bbfddaf89cf99687c101081c0036adc6605b421552b6d075964 |
| SHA512 | 9ff3c9c785823aaf7f269c4eef442180a3a31a865ded4efe746aa6bead40c2d28cbee9515dd8848547d164dca6d13dc4dc5a18112d7be554d7515e180ac8e83f |
memory/3152-19-0x0000000074B30000-0x00000000752E1000-memory.dmp
memory/3152-20-0x0000000074B30000-0x00000000752E1000-memory.dmp