Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/10/2024, 07:58

General

  • Target

    Xeno_manager.exe

  • Size

    45KB

  • MD5

    32cb2f4e99ecc0113554aad30643b92f

  • SHA1

    9e10547be5ee02d6a8e2be72f92a8747c708c897

  • SHA256

    9037601de282b706cf457116b42b3d36e3ccd7842b13b08efced4337230ced80

  • SHA512

    390e7d66580ffd4e3e807ddc0e95664e945664880034d494713c7d2fa6bdacdc08baace40e36361261ea3a24323e89a15fc529a3696b5c5b9bc9e989530eca35

  • SSDEEP

    768:6SisJmceOo5De+APsZjGsdHbtm+KW7qTN+8Nw:MsJmfOiD+kZ/HbteW2EUw

Malware Config

Extracted

Family

xenorat

C2

87.120.116.115

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    50000

  • install_path

    appdata

  • port

    1390

  • startup_name

    nothingset

Signatures

  • Detect XenoRat Payload 2 IoCs
  • XenorRat

    XenorRat is a remote access trojan written in C#.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Xeno_manager.exe
    "C:\Users\Admin\AppData\Local\Temp\Xeno_manager.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3664
    • C:\Users\Admin\AppData\Roaming\UpdateManager\Xeno_manager.exe
      "C:\Users\Admin\AppData\Roaming\UpdateManager\Xeno_manager.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2412
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks.exe" /Create /TN "UpdateManager" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3FE2.tmp" /F
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:1752

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Xeno_manager.exe.log

    Filesize

    226B

    MD5

    916851e072fbabc4796d8916c5131092

    SHA1

    d48a602229a690c512d5fdaf4c8d77547a88e7a2

    SHA256

    7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

    SHA512

    07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

  • C:\Users\Admin\AppData\Local\Temp\tmp3FE2.tmp

    Filesize

    1KB

    MD5

    4605c526b2fb5221014861df1b02805e

    SHA1

    52a20384950759123efdef6dee59c3b1853dcba8

    SHA256

    9d48dedb381f9459439231a6546f3e7fe55afa82c3a9120afb367420e0b8e4c0

    SHA512

    27a5d80ee9d92d64d0ea04537ac364e58ce882a48ec83550c9446cdaad858bc00210acb3f03c4efe3069e68483d9825e3c0ac9294ec1fb824df6925328a61690

  • C:\Users\Admin\AppData\Roaming\UpdateManager\Xeno_manager.exe

    Filesize

    45KB

    MD5

    32cb2f4e99ecc0113554aad30643b92f

    SHA1

    9e10547be5ee02d6a8e2be72f92a8747c708c897

    SHA256

    9037601de282b706cf457116b42b3d36e3ccd7842b13b08efced4337230ced80

    SHA512

    390e7d66580ffd4e3e807ddc0e95664e945664880034d494713c7d2fa6bdacdc08baace40e36361261ea3a24323e89a15fc529a3696b5c5b9bc9e989530eca35

  • memory/2412-15-0x0000000074C50000-0x0000000075400000-memory.dmp

    Filesize

    7.7MB

  • memory/2412-16-0x0000000074C50000-0x0000000075400000-memory.dmp

    Filesize

    7.7MB

  • memory/3664-0-0x0000000074C5E000-0x0000000074C5F000-memory.dmp

    Filesize

    4KB

  • memory/3664-1-0x0000000000760000-0x0000000000772000-memory.dmp

    Filesize

    72KB