Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
23/09/2024, 17:36
General
- Target svvhooxx.exe
- Size 45KB
- Sample240923-v62dvsvdnj
- SHA256 31ea0b97393741bcea9df8e044162bc159209f61d71792452119791badf14322
Malware Config
Extracted
-
xenorat
-
zenofs.zapto.org
-
Svxcchost
-
install_path
appdata
-
port
5555
-
startup_name
nothingset
Signatures
- Detect XenoRat Payload 2 IoCs
- XenorRat
XenorRat is a remote access trojan written in C#.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\svvhooxx.exe"C:\Users\Admin\AppData\Local\Temp\svvhooxx.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XenoManager\svvhooxx.exe"C:\Users\Admin\AppData\Roaming\XenoManager\svvhooxx.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
svvhooxx.exe.log
svvhooxx.exe
memory/2208-0-0x00000000748EE000-0x00000000748EF000-memory.dmp
memory/2208-1-0x0000000000360000-0x0000000000372000-memory.dmp
memory/3244-15-0x00000000748E0000-0x0000000075090000-memory.dmp
memory/3244-16-0x00000000748E0000-0x0000000075090000-memory.dmp
memory/3244-17-0x0000000005470000-0x00000000054D6000-memory.dmp
memory/3244-18-0x00000000748E0000-0x0000000075090000-memory.dmp
memory/3244-19-0x00000000748E0000-0x0000000075090000-memory.dmp