Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
06-12-2024 14:32
Behavioral task
behavioral1
Sample
90f57a9578ce153c8520aee9b42d0407.doc
Resource
win7-20240903-en
General
-
Target
90f57a9578ce153c8520aee9b42d0407.doc
-
Size
35KB
-
MD5
90f57a9578ce153c8520aee9b42d0407
-
SHA1
b669b63e818628044a49c33a2c4edb9840bb030e
-
SHA256
c9ab3c4481da95348f1d65fecb8da349ecdb1826f16d27ee3e5c5a0d49384c52
-
SHA512
a63d6c7d453c82e2ff910b5b1faaddf9a96f312f6ab325b5cdf72d68d46006986e429281cfdb3eea7357f4cec5a4dce29e730602aa120df4afca1c8ea15b13cc
-
SSDEEP
384:wRpiSY5U1zhghLadtb/W5t7c4AZTA6C60jYvA6cSPvuC9:E7n1QvyTA6NJvA6cSeC9
Malware Config
Extracted
xenorat
dns.stipamana.com
Xeno_rat_nd8912d
-
delay
12000
-
install_path
appdata
-
port
4567
-
startup_name
mrec
Signatures
-
Detect XenoRat Payload 1 IoCs
resource yara_rule behavioral2/memory/1128-88-0x0000000000400000-0x0000000000412000-memory.dmp family_xenorat -
Xenorat family
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation NBUTQYX.exe -
Executes dropped EXE 8 IoCs
pid Process 1228 NBUTQYX.exe 1128 NBUTQYX.exe 2664 NBUTQYX.exe 3708 NBUTQYX.exe 1040 NBUTQYX.exe 4036 NBUTQYX.exe 2856 NBUTQYX.exe 3240 NBUTQYX.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 1228 set thread context of 1128 1228 NBUTQYX.exe 88 PID 1228 set thread context of 2664 1228 NBUTQYX.exe 89 PID 1228 set thread context of 3708 1228 NBUTQYX.exe 90 PID 1040 set thread context of 4036 1040 NBUTQYX.exe 95 PID 1040 set thread context of 2856 1040 NBUTQYX.exe 96 PID 1040 set thread context of 3240 1040 NBUTQYX.exe 97 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3684 2664 WerFault.exe 89 -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NBUTQYX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NBUTQYX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NBUTQYX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NBUTQYX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NBUTQYX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NBUTQYX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NBUTQYX.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3980 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 5080 WINWORD.EXE 5080 WINWORD.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1228 NBUTQYX.exe Token: SeDebugPrivilege 1040 NBUTQYX.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 5080 WINWORD.EXE 5080 WINWORD.EXE 5080 WINWORD.EXE 5080 WINWORD.EXE 5080 WINWORD.EXE 5080 WINWORD.EXE 5080 WINWORD.EXE -
Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 5080 wrote to memory of 1228 5080 WINWORD.EXE 86 PID 5080 wrote to memory of 1228 5080 WINWORD.EXE 86 PID 5080 wrote to memory of 1228 5080 WINWORD.EXE 86 PID 1228 wrote to memory of 1128 1228 NBUTQYX.exe 88 PID 1228 wrote to memory of 1128 1228 NBUTQYX.exe 88 PID 1228 wrote to memory of 1128 1228 NBUTQYX.exe 88 PID 1228 wrote to memory of 1128 1228 NBUTQYX.exe 88 PID 1228 wrote to memory of 1128 1228 NBUTQYX.exe 88 PID 1228 wrote to memory of 1128 1228 NBUTQYX.exe 88 PID 1228 wrote to memory of 1128 1228 NBUTQYX.exe 88 PID 1228 wrote to memory of 1128 1228 NBUTQYX.exe 88 PID 1228 wrote to memory of 2664 1228 NBUTQYX.exe 89 PID 1228 wrote to memory of 2664 1228 NBUTQYX.exe 89 PID 1228 wrote to memory of 2664 1228 NBUTQYX.exe 89 PID 1228 wrote to memory of 2664 1228 NBUTQYX.exe 89 PID 1228 wrote to memory of 2664 1228 NBUTQYX.exe 89 PID 1228 wrote to memory of 2664 1228 NBUTQYX.exe 89 PID 1228 wrote to memory of 2664 1228 NBUTQYX.exe 89 PID 1228 wrote to memory of 2664 1228 NBUTQYX.exe 89 PID 1228 wrote to memory of 3708 1228 NBUTQYX.exe 90 PID 1228 wrote to memory of 3708 1228 NBUTQYX.exe 90 PID 1228 wrote to memory of 3708 1228 NBUTQYX.exe 90 PID 1228 wrote to memory of 3708 1228 NBUTQYX.exe 90 PID 1228 wrote to memory of 3708 1228 NBUTQYX.exe 90 PID 1228 wrote to memory of 3708 1228 NBUTQYX.exe 90 PID 1228 wrote to memory of 3708 1228 NBUTQYX.exe 90 PID 1228 wrote to memory of 3708 1228 NBUTQYX.exe 90 PID 3708 wrote to memory of 1040 3708 NBUTQYX.exe 93 PID 3708 wrote to memory of 1040 3708 NBUTQYX.exe 93 PID 3708 wrote to memory of 1040 3708 NBUTQYX.exe 93 PID 1040 wrote to memory of 4036 1040 NBUTQYX.exe 95 PID 1040 wrote to memory of 4036 1040 NBUTQYX.exe 95 PID 1040 wrote to memory of 4036 1040 NBUTQYX.exe 95 PID 1040 wrote to memory of 4036 1040 NBUTQYX.exe 95 PID 1040 wrote to memory of 4036 1040 NBUTQYX.exe 95 PID 1040 wrote to memory of 4036 1040 NBUTQYX.exe 95 PID 1040 wrote to memory of 4036 1040 NBUTQYX.exe 95 PID 1040 wrote to memory of 4036 1040 NBUTQYX.exe 95 PID 1040 wrote to memory of 2856 1040 NBUTQYX.exe 96 PID 1040 wrote to memory of 2856 1040 NBUTQYX.exe 96 PID 1040 wrote to memory of 2856 1040 NBUTQYX.exe 96 PID 1040 wrote to memory of 2856 1040 NBUTQYX.exe 96 PID 1040 wrote to memory of 2856 1040 NBUTQYX.exe 96 PID 1040 wrote to memory of 2856 1040 NBUTQYX.exe 96 PID 1040 wrote to memory of 2856 1040 NBUTQYX.exe 96 PID 1040 wrote to memory of 2856 1040 NBUTQYX.exe 96 PID 1040 wrote to memory of 3240 1040 NBUTQYX.exe 97 PID 1040 wrote to memory of 3240 1040 NBUTQYX.exe 97 PID 1040 wrote to memory of 3240 1040 NBUTQYX.exe 97 PID 1040 wrote to memory of 3240 1040 NBUTQYX.exe 97 PID 1040 wrote to memory of 3240 1040 NBUTQYX.exe 97 PID 1040 wrote to memory of 3240 1040 NBUTQYX.exe 97 PID 1040 wrote to memory of 3240 1040 NBUTQYX.exe 97 PID 1040 wrote to memory of 3240 1040 NBUTQYX.exe 97 PID 1128 wrote to memory of 3980 1128 NBUTQYX.exe 104 PID 1128 wrote to memory of 3980 1128 NBUTQYX.exe 104 PID 1128 wrote to memory of 3980 1128 NBUTQYX.exe 104
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\90f57a9578ce153c8520aee9b42d0407.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\NBUTQYX.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\NBUTQYX.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\NBUTQYX.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\NBUTQYX.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "mrec" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCAC2.tmp" /F4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3980
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\NBUTQYX.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\NBUTQYX.exe3⤵
- Executes dropped EXE
PID:2664 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 804⤵
- Program crash
PID:3684
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\NBUTQYX.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\NBUTQYX.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Roaming\UpdateManager\NBUTQYX.exe"C:\Users\Admin\AppData\Roaming\UpdateManager\NBUTQYX.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Roaming\UpdateManager\NBUTQYX.exeC:\Users\Admin\AppData\Roaming\UpdateManager\NBUTQYX.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4036
-
-
C:\Users\Admin\AppData\Roaming\UpdateManager\NBUTQYX.exeC:\Users\Admin\AppData\Roaming\UpdateManager\NBUTQYX.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2856
-
-
C:\Users\Admin\AppData\Roaming\UpdateManager\NBUTQYX.exeC:\Users\Admin\AppData\Roaming\UpdateManager\NBUTQYX.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3240
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2664 -ip 26641⤵PID:4576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
706B
MD5d95c58e609838928f0f49837cab7dfd2
SHA155e7139a1e3899195b92ed8771d1ca2c7d53c916
SHA2560407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339
SHA512405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d
-
Filesize
1KB
MD533bbfcbd5303d9264901bd293a3e2b9d
SHA1ec065ec36e09d5b8e5a4d6fde005da291e5c4b74
SHA256b922930c42b97dda929255c17a8bc29a1f3c650f9784ac243a7ac6a8a2189478
SHA512db0272881e2560fef51f82fef2e52b6e1168ef8fbfb9ab51a52013a5c5869daac50f9b869d032b0cd2631a7d84684eeca78d6e8d6eca91da0b3bb2c969d239ed
-
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851218[[fn=gb]].xsl
Filesize262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
Filesize
16B
MD5d29962abc88624befc0135579ae485ec
SHA1e40a6458296ec6a2427bcb280572d023a9862b31
SHA256a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
SHA5124311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
-
Filesize
166KB
MD581ab2cef389699b418a0c016114f1c8b
SHA1fc99c84f1c8ee460adc8948b475dd075e24ae249
SHA256ba8b86390a03a48a818a8efb1252236a76bba4cc49a38eb9822e3924c02f9809
SHA5129877e761d9f130963475e989f427b09be323a0ec48b5cb981f506fd34b141e0841ae92eb7d759ed3142046ab096a045eafaf0cc880e7f868685232cc4ca8e6cb