xenorat | 6bed3b85a45853d8b4ce39d2db9ffbb2d54f90c15bde96caf9b08245e653fcec

Resubmissions

05-09-2024 01:30

240905-bwtrgszgpr 10

02-09-2024 22:07

240902-113ydszcjg 10

Analysis

max time kernel
146s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
05-09-2024 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GCclientV1.exe
Size

45KB
MD5

6c0987679747dfe56c8a4bc28860cb2f
SHA1

00ff1ad0b4000be73188c8b6a8d91a4a99c48b57
SHA256

6bed3b85a45853d8b4ce39d2db9ffbb2d54f90c15bde96caf9b08245e653fcec
SHA512

4970b77b4f67de3d6731085f762daf10ebe751449671ccb7fea31076bdc941488f79136fbd697fc3e363d7a2b727604eff676012f0c75602e22b5f5411bb50c5
SSDEEP

768:5dhO/poiiUcjlJIns5C2H9Xqk5nWEZ5SbTDa8uI7CPW5d:3w+jjgnsM2H9XqcnW85SbT5uIV

Score

10^/10

xenorat discovery rat trojan

Malware Config

Extracted

Family

xenorat

108.234.74.132

Mutex

Xeno_rat_nd8912d

Attributes

delay
5000
install_path
temp
port
5129
startup_name
Client

Signatures

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat

Executes dropped EXE 1 IoCs

pid	Process
4664	GCclientV1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GCclientV1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GCclientV1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1404	schtasks.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 4664	2788	GCclientV1.exe	78
PID 2788 wrote to memory of 4664	2788	GCclientV1.exe	78
PID 2788 wrote to memory of 4664	2788	GCclientV1.exe	78
PID 4664 wrote to memory of 1404	4664	GCclientV1.exe	79
PID 4664 wrote to memory of 1404	4664	GCclientV1.exe	79
PID 4664 wrote to memory of 1404	4664	GCclientV1.exe	79

C:\Users\Admin\AppData\Local\Temp\GCclientV1.exe
"C:\Users\Admin\AppData\Local\Temp\GCclientV1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe
  "C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /Create /TN "Client" /XML "C:\Users\Admin\AppData\Local\Temp\tmp95C8.tmp" /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1404

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\GCclientV1.exe.log

Filesize
226B

MD5
1294de804ea5400409324a82fdc7ec59

SHA1
9a39506bc6cadf99c1f2129265b610c69d1518f7

SHA256
494398ec6108c68573c366c96aae23d35e7f9bdbb440a4aab96e86fcad5871d0

SHA512
033905cc5b4d0c0ffab2138da47e3223765146fa751c9f84b199284b653a04874c32a23aae577d2e06ce6c6b34fec62331b5fc928e3baf68dc53263ecdfa10c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\XenoManager\GCclientV1.exe

Filesize
45KB

MD5
6c0987679747dfe56c8a4bc28860cb2f

SHA1
00ff1ad0b4000be73188c8b6a8d91a4a99c48b57

SHA256
6bed3b85a45853d8b4ce39d2db9ffbb2d54f90c15bde96caf9b08245e653fcec

SHA512
4970b77b4f67de3d6731085f762daf10ebe751449671ccb7fea31076bdc941488f79136fbd697fc3e363d7a2b727604eff676012f0c75602e22b5f5411bb50c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp95C8.tmp

Filesize
1KB

MD5
a1e9c508509e964318440cf83a8a0b98

SHA1
0f575d72430d1da2ba1154ec2273d1a355099093

SHA256
f68ad25ac7180efd22da431ac63ed59ad9fe9c9866fceb86d430e40c52a1b771

SHA512
e1d1b1d121d2fc71f766784e463da13b21ec1756eb7de16edcac1182f1bf851ff5fb57431c2bd903b19f931237df5a1e1d5ff071ce2020398c44b49cc7646432

Download Submit
C:\vcredist2010_x64.log-MSI_vc_red.msi.txt

Filesize
379KB

MD5
3ad92216adf5ce022a4fbd3b8755438c

SHA1
8a57a8339720bad4f7b877e053c92d251869eed3

SHA256
9ce0749502430bcb10a1e13f372f362e7eddf530947c37e65891cb0c7fd6518e

SHA512
56ba00d79fddab75fae4d6636289ec5a95a206cafd098a5785be08f51b24697c9b72f02c23cbf1521510049791dbbe80852d602544bcc0b6167939583d1c3cec

Download Submit
C:\vcredist2010_x64.log.html

Filesize
85KB

MD5
900c0b3ec1ff40394973462a23e68c6f

SHA1
c3fd8c51f1eecf97d1112da1553a3693a202e32a

SHA256
a528ad1b6ad3fb1415c1d72e5e72009afa10d833e12b03e4a1c02a40208e732b

SHA512
5f4bc631ab65ceaf2d6fcc18d84a498bec73b093f948ba22bc4914dc3a0f052ba9b4d698e93450dfd41a88fe371c7bfbd169e19ffb55a04a4ec860c37326977d

Download Submit
C:\vcredist2010_x86.log-MSI_vc_red.msi.txt

Filesize
394KB

MD5
fd118703d2ef2227bb225ebfd820d5b6

SHA1
ba15bbb80e2e5700d5d6c3aeeddc7556b4e354f2

SHA256
e91f9c96fab48d62d15e2750516c02dc222bb4f1033b152f2d91b338402a9bca

SHA512
d5f9617712aa0816b2a06d5d550d00303e2ed08034d31b8d874796b46dbd1e0a32b009e0a765f64353065ef548a8cedaf0b6b820dba11946d0a8508a74f8cfde

Download Submit
C:\vcredist2010_x86.log.html

Filesize
80KB

MD5
71064ae0b71894015b25ef016cd8adde

SHA1
5a32f3a7b28c908f6778c61e9ff5ed89ee9f3565

SHA256
80132ba8ceab87410dbf343a90b5bf7e4ea102953b17377f7d3b3dfa6da4c789

SHA512
dee45460113372a2d6785c4adcbb2b508f193dfda0a2ef46bede1e9db5c1e48016a1e157ea5903393e6b270031dee0cd89cdf0a9ba37262a89150d9c6069f7e5

Download Submit
C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log

Filesize
167KB

MD5
54368a3a887402534aa7f240ade49d0a

SHA1
20439e51dc95f0b6d9ee8a2509de9ce1a048cb07

SHA256
655994018df8c1920ee7d4c12ef9584e8c9dd60fa5dc9323ce4136d3853a32ea

SHA512
780038e1e274346835a8b5f3e028a2d9f50aac54727d3229f8a1950f03d7d3c5b8863d1b33b0be046efccf6370a23a28fa38c9f687849861e56fd990ac8e3f2f

Download Submit
C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log

Filesize
195KB

MD5
627ee32465d2ce99763ae850d02d0807

SHA1
13e89083fc335f061b2c0390181e47fb91d9a443

SHA256
851daf8d56019157a46c80f6dd5e46646340ee6801aa5dc72c7f4b0b594cfb64

SHA512
e27b3fc40db74ec60522c21eea48c9bdbf8bc6c0e9a01a976d097a2e0c3ebf7046366fab4fc8f7785879daa58747aa8d8e8769ab6cb4bb906c58e86bdcac286b

Download Submit
C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log

Filesize
171KB

MD5
313cccb9604006d4e7fa612fc143e27c

SHA1
c18a306731c71c6de6fd83d5ed2e729726657418

SHA256
04d065efb4602020c9c62ab872668f53f7fc8656bff2c88fc4a887ea52889a3d

SHA512
e5d0d9ac91042066a7d542d172228d68e994dbc2d3179c5086fb808983b46bb0722abc17aff9b4c8448a65067dc4f2983dd9d3dd19008bc05a8ed1bd222526ed

Download Submit
C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log

Filesize
208KB

MD5
11180d272450f6680b0cda7b5e517e14

SHA1
ebdc05c8eaa2eed73b2e2a9e014893cd974a19d5

SHA256
8779e14b92363a05d68662a3b71e79686a9a9f50aa95603566b207607a71b2d4

SHA512
fbab6ad4c68dfa6b1ec90c0d9b3bf5586e2431596620b5c476696f4d4d0f6d68f02de6803a6fd4dae20e4a064f79b1a6a3034fe20a3138133c5462a992b6333d

Download Submit
C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log

Filesize
170KB

MD5
9f2c141aee56dae4a3acb4bdcf665627

SHA1
e9266b0986d38516c960168f935c258f2736524e

SHA256
be1e428920def43facdba6ce9553c0b04a92571a00f658ef483bd0c3bf9af9a3

SHA512
a3243ff773b7ba0c8a35fcb8c0b1700be3fd9a5878806b123bb1ee83a7f88ff56d11fcc3126b6cdeaa8db7427e54094b0b25b393993d3b1bc1e991f0d8d8b206

Download Submit
C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log

Filesize
190KB

MD5
e3c40cc6d103c451ce7f9d9930e0fa51

SHA1
e6150abbc1c0bcdb35286ccc5c281eaa7f4f973f

SHA256
3e94432d7fac1ce6e4328cfd9fd13edf773711c78326d9afaaea7fab3d42dce9

SHA512
c00bcaa24485e53c119fc09524f368044f79e28cb55306b31ab44b45dd0442249a7d7851d63251bfed3cc524915086cf4eb4cc4ed8ad036918f9b20197760c37

Download Submit
C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log

Filesize
170KB

MD5
d45e655c2862fa1d64df8adaec6c28d2

SHA1
50d3797a00c2a821f6625878ccc176a2cb0e8b25

SHA256
9462d6aa8533711883c035a5ec09969492172856a4dd17bd50fc5edcc0adbfef

SHA512
7428467313730d4f818b22e00ea76ee4b44bbaf3e8ef116eec2204c82ba0f3eecab2a4e6c815c3ff04800ef3c6659a2b327d5da2ff64aad34a7f479c0d106302

Download Submit
C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log

Filesize
198KB

MD5
bab001d634a24b3d5fc19b117a0b3587

SHA1
ac504c1833c066ab0daab15caefcb7e930da3449

SHA256
c887df0b55e7069cb3ce9c6320695738a7f07b93fcbf3cdf285a0517ea15e13c

SHA512
a5b1c6cb1c85f58a7525f28027e9ab6fe4a8c21c9bb7df07884d8fe68708a7892bce1d94dc44f7f383224b6fdd7329e2b51af07d8393e2bf480e7e3e4487299d

Download Submit
C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log

Filesize
123KB

MD5
3415ad7cdf7885210995fae9d729e9bc

SHA1
29ad64a2e49c96754cd175c06508139286ddad5a

SHA256
15db2ea67ed0f92772a7d54788217806388c3d5400a1e6344034f7fd5d297d52

SHA512
99bbc77859a1b51dd49b979432e20bea77806651fe5f6a2330182f2e4abfe657bf58c1657a7948611e12537f2dfacdd98fdecbd7df885699a4899112c9022492

Download Submit
C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log

Filesize
129KB

MD5
56745e9a329c0f2537c1c42ff4a285d8

SHA1
af1ff606f17b41876b9d5034b0814ccdf4464a63

SHA256
0c5b645713902e6bde134e12ee3be7d4c934770468a3e08ed42b216b8d8a15eb

SHA512
9793d78bb75ed2e1a8a0e5de2b1db60d1ae71bab0dbe5bf95a7a0da7187072e2d0388cdeee8c747c084937891e15bfee4cc75e8d4ce12c0d2cd166eac574e6ea

Download Submit
C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log

Filesize
123KB

MD5
7678038883e9902a0fea563c7578acd4

SHA1
e6c8bec5fe612d6da6ee123a00024655f61c57b4

SHA256
72134df6ed98b9de1e9effecf20f0ef80b7c8ac3a5db54c71705c52fc037cd1c

SHA512
3baf7a74cd76f9952e7f6e49583ec90a3183138b38628243044f62f436e255714c507b307050ae5911f2f84d7342b0c17d61a5c3d74e5f52b4dd3a09951ca1fd

Download Submit
C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log

Filesize
135KB

MD5
33c6ed2dc6e88bfb148d54b6892d40f5

SHA1
94fc9dfb1c6d2245142d9287f8ef526333b97ca9

SHA256
3926544b39fc383b0ccb4f59e86e3d3943fb7517cedeb691d82d23c312879434

SHA512
df3c2924fd6e137ed7291fb32a321597c4793f1de626ff5896cddf24d23ce54ae47f9b77ced1ececfb70d64025ab48617c15396102ea12be645b0d2381c0676f

Download Submit
memory/2788-1-0x0000000000F00000-0x0000000000F12000-memory.dmp

Filesize
72KB

Download
memory/2788-0-0x00000000743AE000-0x00000000743AF000-memory.dmp

Filesize
4KB

Download
memory/4664-15-0x00000000743A0000-0x0000000074B51000-memory.dmp

Filesize
7.7MB

Download
memory/4664-16-0x00000000743A0000-0x0000000074B51000-memory.dmp

Filesize
7.7MB

Download
memory/4664-19-0x00000000743A0000-0x0000000074B51000-memory.dmp

Filesize
7.7MB

Download
memory/4664-20-0x00000000743A0000-0x0000000074B51000-memory.dmp

Filesize
7.7MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads