Analysis

  • max time kernel
    120s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/10/2024, 07:57

General

  • Target

    de2926943fb1ffb6cba2166eaeec84cf9b3a1dbdfdb808dd7d364cf73c4c6462.exe

  • Size

    451KB

  • MD5

    b08ec13cff4a4b999fbc04f79c08b4ed

  • SHA1

    81340aff932cde68070c03c634fb1292f62e8eaf

  • SHA256

    de2926943fb1ffb6cba2166eaeec84cf9b3a1dbdfdb808dd7d364cf73c4c6462

  • SHA512

    6c2921d1e41fd695d20ed40e235e561e772283ad7503d808e44e1eb75856297ce2835038d7c8efcc295c950527073041ec888f91062d03b4e37665be2e714d9c

  • SSDEEP

    6144:ySnzhr6w+x08AE1Owf4pIB89065C9EDMuY1zhmP1iaOfzdXQq+Bwe8bQbi:xVr6wu1AEl470R9Ew31zwP1ifdE8bQb

Malware Config

Extracted

Family

xenorat

C2

109.248.150.212

Mutex

eno_rx_nd8912d

Attributes
  • delay

    5

  • install_path

    appdata

  • port

    4444

  • startup_name

    nothingset

Signatures

  • Detect XenoRat Payload 1 IoCs
  • XenorRat

    XenorRat is a remote access trojan written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\de2926943fb1ffb6cba2166eaeec84cf9b3a1dbdfdb808dd7d364cf73c4c6462.exe
    "C:\Users\Admin\AppData\Local\Temp\de2926943fb1ffb6cba2166eaeec84cf9b3a1dbdfdb808dd7d364cf73c4c6462.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4844
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\de2926943fb1ffb6cba2166eaeec84cf9b3a1dbdfdb808dd7d364cf73c4c6462.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:32
    • C:\Users\Admin\AppData\Local\Temp\de2926943fb1ffb6cba2166eaeec84cf9b3a1dbdfdb808dd7d364cf73c4c6462.exe
      "C:\Users\Admin\AppData\Local\Temp\de2926943fb1ffb6cba2166eaeec84cf9b3a1dbdfdb808dd7d364cf73c4c6462.exe"
      2⤵
        PID:3452
      • C:\Users\Admin\AppData\Local\Temp\de2926943fb1ffb6cba2166eaeec84cf9b3a1dbdfdb808dd7d364cf73c4c6462.exe
        "C:\Users\Admin\AppData\Local\Temp\de2926943fb1ffb6cba2166eaeec84cf9b3a1dbdfdb808dd7d364cf73c4c6462.exe"
        2⤵
          PID:2016
        • C:\Users\Admin\AppData\Local\Temp\de2926943fb1ffb6cba2166eaeec84cf9b3a1dbdfdb808dd7d364cf73c4c6462.exe
          "C:\Users\Admin\AppData\Local\Temp\de2926943fb1ffb6cba2166eaeec84cf9b3a1dbdfdb808dd7d364cf73c4c6462.exe"
          2⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5088
          • C:\Users\Admin\AppData\Roaming\XenoManager\de2926943fb1ffb6cba2166eaeec84cf9b3a1dbdfdb808dd7d364cf73c4c6462.exe
            "C:\Users\Admin\AppData\Roaming\XenoManager\de2926943fb1ffb6cba2166eaeec84cf9b3a1dbdfdb808dd7d364cf73c4c6462.exe"
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1932
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XenoManager\de2926943fb1ffb6cba2166eaeec84cf9b3a1dbdfdb808dd7d364cf73c4c6462.exe"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4820
            • C:\Users\Admin\AppData\Roaming\XenoManager\de2926943fb1ffb6cba2166eaeec84cf9b3a1dbdfdb808dd7d364cf73c4c6462.exe
              "C:\Users\Admin\AppData\Roaming\XenoManager\de2926943fb1ffb6cba2166eaeec84cf9b3a1dbdfdb808dd7d364cf73c4c6462.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1508

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\de2926943fb1ffb6cba2166eaeec84cf9b3a1dbdfdb808dd7d364cf73c4c6462.exe.log

        Filesize

        1KB

        MD5

        8ec831f3e3a3f77e4a7b9cd32b48384c

        SHA1

        d83f09fd87c5bd86e045873c231c14836e76a05c

        SHA256

        7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

        SHA512

        26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

        Filesize

        2KB

        MD5

        968cb9309758126772781b83adb8a28f

        SHA1

        8da30e71accf186b2ba11da1797cf67f8f78b47c

        SHA256

        92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

        SHA512

        4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        18KB

        MD5

        65ada0151f2be8852d5ca63e1045be8e

        SHA1

        00293bcc94a9186e920d490f1f3e8abf6d83d822

        SHA256

        59f2a930d9fe88421bfd7579df9e8703b5ea32959c85f0ee8eb2588aecf2fbb0

        SHA512

        1292b322778b3840624c9193dcbc96763f185fa8e4b5a6948a1a0a46650d10b069bde649110ce7c9b2107f7f40f1af4c4279bc8aa47a82264e13cf397f10b830

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fijoqyyl.irx.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Roaming\XenoManager\de2926943fb1ffb6cba2166eaeec84cf9b3a1dbdfdb808dd7d364cf73c4c6462.exe

        Filesize

        451KB

        MD5

        b08ec13cff4a4b999fbc04f79c08b4ed

        SHA1

        81340aff932cde68070c03c634fb1292f62e8eaf

        SHA256

        de2926943fb1ffb6cba2166eaeec84cf9b3a1dbdfdb808dd7d364cf73c4c6462

        SHA512

        6c2921d1e41fd695d20ed40e235e561e772283ad7503d808e44e1eb75856297ce2835038d7c8efcc295c950527073041ec888f91062d03b4e37665be2e714d9c

      • memory/32-64-0x0000000007080000-0x0000000007091000-memory.dmp

        Filesize

        68KB

      • memory/32-67-0x00000000071C0000-0x00000000071DA000-memory.dmp

        Filesize

        104KB

      • memory/32-71-0x0000000074DC0000-0x0000000075570000-memory.dmp

        Filesize

        7.7MB

      • memory/32-68-0x00000000071A0000-0x00000000071A8000-memory.dmp

        Filesize

        32KB

      • memory/32-46-0x0000000005BE0000-0x0000000005C2C000-memory.dmp

        Filesize

        304KB

      • memory/32-66-0x00000000070C0000-0x00000000070D4000-memory.dmp

        Filesize

        80KB

      • memory/32-65-0x00000000070B0000-0x00000000070BE000-memory.dmp

        Filesize

        56KB

      • memory/32-63-0x0000000007100000-0x0000000007196000-memory.dmp

        Filesize

        600KB

      • memory/32-14-0x0000000002240000-0x0000000002276000-memory.dmp

        Filesize

        216KB

      • memory/32-17-0x0000000074DC0000-0x0000000075570000-memory.dmp

        Filesize

        7.7MB

      • memory/32-62-0x0000000006EF0000-0x0000000006EFA000-memory.dmp

        Filesize

        40KB

      • memory/32-18-0x0000000004E40000-0x0000000005468000-memory.dmp

        Filesize

        6.2MB

      • memory/32-19-0x0000000074DC0000-0x0000000075570000-memory.dmp

        Filesize

        7.7MB

      • memory/32-48-0x0000000072360000-0x00000000723AC000-memory.dmp

        Filesize

        304KB

      • memory/32-32-0x0000000004C10000-0x0000000004C76000-memory.dmp

        Filesize

        408KB

      • memory/32-47-0x0000000006120000-0x0000000006152000-memory.dmp

        Filesize

        200KB

      • memory/32-29-0x0000000004B70000-0x0000000004B92000-memory.dmp

        Filesize

        136KB

      • memory/32-33-0x0000000004CF0000-0x0000000004D56000-memory.dmp

        Filesize

        408KB

      • memory/32-61-0x0000000006E80000-0x0000000006E9A000-memory.dmp

        Filesize

        104KB

      • memory/32-60-0x00000000074C0000-0x0000000007B3A000-memory.dmp

        Filesize

        6.5MB

      • memory/32-35-0x0000000005570000-0x00000000058C4000-memory.dmp

        Filesize

        3.3MB

      • memory/32-45-0x0000000005B50000-0x0000000005B6E000-memory.dmp

        Filesize

        120KB

      • memory/32-59-0x0000000006D20000-0x0000000006DC3000-memory.dmp

        Filesize

        652KB

      • memory/32-58-0x0000000006100000-0x000000000611E000-memory.dmp

        Filesize

        120KB

      • memory/4820-84-0x0000000005A50000-0x0000000005DA4000-memory.dmp

        Filesize

        3.3MB

      • memory/4820-99-0x0000000007560000-0x0000000007574000-memory.dmp

        Filesize

        80KB

      • memory/4820-98-0x0000000007520000-0x0000000007531000-memory.dmp

        Filesize

        68KB

      • memory/4820-97-0x0000000007270000-0x0000000007313000-memory.dmp

        Filesize

        652KB

      • memory/4820-87-0x0000000070C00000-0x0000000070C4C000-memory.dmp

        Filesize

        304KB

      • memory/4820-86-0x0000000006050000-0x000000000609C000-memory.dmp

        Filesize

        304KB

      • memory/4844-9-0x00000000067B0000-0x0000000006804000-memory.dmp

        Filesize

        336KB

      • memory/4844-2-0x0000000005900000-0x0000000005EA4000-memory.dmp

        Filesize

        5.6MB

      • memory/4844-8-0x0000000074DC0000-0x0000000075570000-memory.dmp

        Filesize

        7.7MB

      • memory/4844-5-0x0000000074DC0000-0x0000000075570000-memory.dmp

        Filesize

        7.7MB

      • memory/4844-10-0x0000000009750000-0x00000000097EC000-memory.dmp

        Filesize

        624KB

      • memory/4844-4-0x00000000054B0000-0x00000000054BA000-memory.dmp

        Filesize

        40KB

      • memory/4844-7-0x0000000074DCE000-0x0000000074DCF000-memory.dmp

        Filesize

        4KB

      • memory/4844-0-0x0000000074DCE000-0x0000000074DCF000-memory.dmp

        Filesize

        4KB

      • memory/4844-6-0x00000000058D0000-0x00000000058E2000-memory.dmp

        Filesize

        72KB

      • memory/4844-1-0x0000000000980000-0x00000000009F8000-memory.dmp

        Filesize

        480KB

      • memory/4844-16-0x0000000074DC0000-0x0000000075570000-memory.dmp

        Filesize

        7.7MB

      • memory/4844-3-0x00000000053F0000-0x0000000005482000-memory.dmp

        Filesize

        584KB

      • memory/5088-34-0x0000000074DC0000-0x0000000075570000-memory.dmp

        Filesize

        7.7MB

      • memory/5088-15-0x0000000074DC0000-0x0000000075570000-memory.dmp

        Filesize

        7.7MB

      • memory/5088-11-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB