Analysis

  • max time kernel
    19s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04-09-2024 23:21

General

  • Target

    Spoofer.exe

  • Size

    45KB

  • MD5

    9cd971f0e65470ce291b479f21347ec0

  • SHA1

    1ddb30a4c205cd84854798ca74ca09ac5d745233

  • SHA256

    8a498dbf2e73ee2a5920ff22582eb0bc07721ea62c1d70dcfbaf7e41979a1da4

  • SHA512

    b28792401069c0ae200fc41f2e86caacc4f604ba921482ad8a230ad12fcba9126d9b6b019e196869f5b935f0966defd2438aca5773becc7c7b4610c1c8fbe2a2

  • SSDEEP

    768:udhO/poiiUcjlJIns3EH9Xqk5nWEZ5SbTDaauI7CPW5e:4w+jjgn+EH9XqcnW85SbT/uI2

Malware Config

Extracted

Family

xenorat

C2

127.0.0.1

Mutex

Celex

Attributes
  • delay

    5000

  • install_path

    appdata

  • port

    8080

  • startup_name

    Steam_service

Signatures

  • XenorRat

    XenorRat is a remote access trojan written in C#.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Spoofer.exe
    "C:\Users\Admin\AppData\Local\Temp\Spoofer.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2196
    • C:\Users\Admin\AppData\Roaming\XenoManager\Spoofer.exe
      "C:\Users\Admin\AppData\Roaming\XenoManager\Spoofer.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2800
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks.exe" /Create /TN "Steam_service" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2F5A.tmp" /F
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2744

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp2F5A.tmp

    Filesize

    1KB

    MD5

    09fbaabc7b71c07e7a69ad642ad06e6f

    SHA1

    476a704478db683f543761791888ffcbff864d01

    SHA256

    a51a98dfcc8710229d9c733ca72180add31445baae9cecd1ddf162af6dea0c8c

    SHA512

    74ca867319a4fe2c7dd6bcfb7da85c49fb33d0e7afec8bbc0373a6308f648025d08a2b60912e387ba921ea9164e3c3524627f020ea4ae0e7a696bea633869a7a

  • \Users\Admin\AppData\Roaming\XenoManager\Spoofer.exe

    Filesize

    45KB

    MD5

    9cd971f0e65470ce291b479f21347ec0

    SHA1

    1ddb30a4c205cd84854798ca74ca09ac5d745233

    SHA256

    8a498dbf2e73ee2a5920ff22582eb0bc07721ea62c1d70dcfbaf7e41979a1da4

    SHA512

    b28792401069c0ae200fc41f2e86caacc4f604ba921482ad8a230ad12fcba9126d9b6b019e196869f5b935f0966defd2438aca5773becc7c7b4610c1c8fbe2a2

  • memory/2196-0-0x0000000074ACE000-0x0000000074ACF000-memory.dmp

    Filesize

    4KB

  • memory/2196-1-0x0000000000B40000-0x0000000000B52000-memory.dmp

    Filesize

    72KB

  • memory/2800-9-0x0000000000220000-0x0000000000232000-memory.dmp

    Filesize

    72KB

  • memory/2800-10-0x0000000074AC0000-0x00000000751AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2800-13-0x0000000074AC0000-0x00000000751AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2800-14-0x0000000074AC0000-0x00000000751AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2800-15-0x0000000074AC0000-0x00000000751AE000-memory.dmp

    Filesize

    6.9MB