Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-12-2024 14:32

General

  • Target

    90f57a9578ce153c8520aee9b42d0407.doc

  • Size

    35KB

  • MD5

    90f57a9578ce153c8520aee9b42d0407

  • SHA1

    b669b63e818628044a49c33a2c4edb9840bb030e

  • SHA256

    c9ab3c4481da95348f1d65fecb8da349ecdb1826f16d27ee3e5c5a0d49384c52

  • SHA512

    a63d6c7d453c82e2ff910b5b1faaddf9a96f312f6ab325b5cdf72d68d46006986e429281cfdb3eea7357f4cec5a4dce29e730602aa120df4afca1c8ea15b13cc

  • SSDEEP

    384:wRpiSY5U1zhghLadtb/W5t7c4AZTA6C60jYvA6cSPvuC9:E7n1QvyTA6NJvA6cSeC9

Malware Config

Extracted

Family

xenorat

C2

dns.stipamana.com

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    12000

  • install_path

    appdata

  • port

    4567

  • startup_name

    mrec

Signatures

  • Detect XenoRat Payload 1 IoCs
  • XenorRat

    XenorRat is a remote access trojan written in C#.

  • Xenorat family
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\90f57a9578ce153c8520aee9b42d0407.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5080
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\NBUTQYX.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\NBUTQYX.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1228
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\NBUTQYX.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\NBUTQYX.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1128
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks.exe" /Create /TN "mrec" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCAC2.tmp" /F
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:3980
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\NBUTQYX.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\NBUTQYX.exe
        3⤵
        • Executes dropped EXE
        PID:2664
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 80
          4⤵
          • Program crash
          PID:3684
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\NBUTQYX.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\NBUTQYX.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3708
        • C:\Users\Admin\AppData\Roaming\UpdateManager\NBUTQYX.exe
          "C:\Users\Admin\AppData\Roaming\UpdateManager\NBUTQYX.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1040
          • C:\Users\Admin\AppData\Roaming\UpdateManager\NBUTQYX.exe
            C:\Users\Admin\AppData\Roaming\UpdateManager\NBUTQYX.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4036
          • C:\Users\Admin\AppData\Roaming\UpdateManager\NBUTQYX.exe
            C:\Users\Admin\AppData\Roaming\UpdateManager\NBUTQYX.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2856
          • C:\Users\Admin\AppData\Roaming\UpdateManager\NBUTQYX.exe
            C:\Users\Admin\AppData\Roaming\UpdateManager\NBUTQYX.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3240
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2664 -ip 2664
    1⤵
      PID:4576

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NBUTQYX.exe.log

      Filesize

      706B

      MD5

      d95c58e609838928f0f49837cab7dfd2

      SHA1

      55e7139a1e3899195b92ed8771d1ca2c7d53c916

      SHA256

      0407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339

      SHA512

      405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d

    • C:\Users\Admin\AppData\Local\Temp\tmpCAC2.tmp

      Filesize

      1KB

      MD5

      33bbfcbd5303d9264901bd293a3e2b9d

      SHA1

      ec065ec36e09d5b8e5a4d6fde005da291e5c4b74

      SHA256

      b922930c42b97dda929255c17a8bc29a1f3c650f9784ac243a7ac6a8a2189478

      SHA512

      db0272881e2560fef51f82fef2e52b6e1168ef8fbfb9ab51a52013a5c5869daac50f9b869d032b0cd2631a7d84684eeca78d6e8d6eca91da0b3bb2c969d239ed

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851218[[fn=gb]].xsl

      Filesize

      262KB

      MD5

      51d32ee5bc7ab811041f799652d26e04

      SHA1

      412193006aa3ef19e0a57e16acf86b830993024a

      SHA256

      6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

      SHA512

      5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

    • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

      Filesize

      16B

      MD5

      d29962abc88624befc0135579ae485ec

      SHA1

      e40a6458296ec6a2427bcb280572d023a9862b31

      SHA256

      a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

      SHA512

      4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\NBUTQYX.exe

      Filesize

      166KB

      MD5

      81ab2cef389699b418a0c016114f1c8b

      SHA1

      fc99c84f1c8ee460adc8948b475dd075e24ae249

      SHA256

      ba8b86390a03a48a818a8efb1252236a76bba4cc49a38eb9822e3924c02f9809

      SHA512

      9877e761d9f130963475e989f427b09be323a0ec48b5cb981f506fd34b141e0841ae92eb7d759ed3142046ab096a045eafaf0cc880e7f868685232cc4ca8e6cb

    • memory/1128-88-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/1228-96-0x00007FFB7C750000-0x00007FFB7C945000-memory.dmp

      Filesize

      2.0MB

    • memory/1228-87-0x0000000005330000-0x0000000005336000-memory.dmp

      Filesize

      24KB

    • memory/1228-86-0x000000000A9F0000-0x000000000AA82000-memory.dmp

      Filesize

      584KB

    • memory/1228-85-0x000000000AF00000-0x000000000B4A4000-memory.dmp

      Filesize

      5.6MB

    • memory/1228-84-0x000000000A8B0000-0x000000000A94C000-memory.dmp

      Filesize

      624KB

    • memory/1228-83-0x00000000052B0000-0x00000000052E2000-memory.dmp

      Filesize

      200KB

    • memory/1228-82-0x0000000002BB0000-0x0000000002BB6000-memory.dmp

      Filesize

      24KB

    • memory/1228-81-0x0000000000930000-0x000000000095E000-memory.dmp

      Filesize

      184KB

    • memory/1228-80-0x00007FFB7C750000-0x00007FFB7C945000-memory.dmp

      Filesize

      2.0MB

    • memory/5080-58-0x00007FFB7C750000-0x00007FFB7C945000-memory.dmp

      Filesize

      2.0MB

    • memory/5080-7-0x00007FFB7C750000-0x00007FFB7C945000-memory.dmp

      Filesize

      2.0MB

    • memory/5080-19-0x00007FFB7C750000-0x00007FFB7C945000-memory.dmp

      Filesize

      2.0MB

    • memory/5080-18-0x00007FFB7C750000-0x00007FFB7C945000-memory.dmp

      Filesize

      2.0MB

    • memory/5080-16-0x00007FFB7C750000-0x00007FFB7C945000-memory.dmp

      Filesize

      2.0MB

    • memory/5080-12-0x00007FFB7C750000-0x00007FFB7C945000-memory.dmp

      Filesize

      2.0MB

    • memory/5080-34-0x00007FFB7C750000-0x00007FFB7C945000-memory.dmp

      Filesize

      2.0MB

    • memory/5080-37-0x00007FFB7C750000-0x00007FFB7C945000-memory.dmp

      Filesize

      2.0MB

    • memory/5080-36-0x00007FFB7C750000-0x00007FFB7C945000-memory.dmp

      Filesize

      2.0MB

    • memory/5080-45-0x00007FFB7C750000-0x00007FFB7C945000-memory.dmp

      Filesize

      2.0MB

    • memory/5080-1-0x00007FFB3C7D0000-0x00007FFB3C7E0000-memory.dmp

      Filesize

      64KB

    • memory/5080-17-0x00007FFB7C750000-0x00007FFB7C945000-memory.dmp

      Filesize

      2.0MB

    • memory/5080-78-0x00007FFB7C7ED000-0x00007FFB7C7EE000-memory.dmp

      Filesize

      4KB

    • memory/5080-79-0x00007FFB7C750000-0x00007FFB7C945000-memory.dmp

      Filesize

      2.0MB

    • memory/5080-14-0x00007FFB39FD0000-0x00007FFB39FE0000-memory.dmp

      Filesize

      64KB

    • memory/5080-15-0x00007FFB7C750000-0x00007FFB7C945000-memory.dmp

      Filesize

      2.0MB

    • memory/5080-13-0x00007FFB7C750000-0x00007FFB7C945000-memory.dmp

      Filesize

      2.0MB

    • memory/5080-6-0x00007FFB7C750000-0x00007FFB7C945000-memory.dmp

      Filesize

      2.0MB

    • memory/5080-11-0x00007FFB39FD0000-0x00007FFB39FE0000-memory.dmp

      Filesize

      64KB

    • memory/5080-20-0x00007FFB7C750000-0x00007FFB7C945000-memory.dmp

      Filesize

      2.0MB

    • memory/5080-10-0x00007FFB7C750000-0x00007FFB7C945000-memory.dmp

      Filesize

      2.0MB

    • memory/5080-8-0x00007FFB7C750000-0x00007FFB7C945000-memory.dmp

      Filesize

      2.0MB

    • memory/5080-9-0x00007FFB7C750000-0x00007FFB7C945000-memory.dmp

      Filesize

      2.0MB

    • memory/5080-4-0x00007FFB3C7D0000-0x00007FFB3C7E0000-memory.dmp

      Filesize

      64KB

    • memory/5080-97-0x00007FFB7C750000-0x00007FFB7C945000-memory.dmp

      Filesize

      2.0MB

    • memory/5080-98-0x00007FFB7C750000-0x00007FFB7C945000-memory.dmp

      Filesize

      2.0MB

    • memory/5080-99-0x00007FFB7C750000-0x00007FFB7C945000-memory.dmp

      Filesize

      2.0MB

    • memory/5080-5-0x00007FFB3C7D0000-0x00007FFB3C7E0000-memory.dmp

      Filesize

      64KB

    • memory/5080-3-0x00007FFB3C7D0000-0x00007FFB3C7E0000-memory.dmp

      Filesize

      64KB

    • memory/5080-108-0x00007FFB7C750000-0x00007FFB7C945000-memory.dmp

      Filesize

      2.0MB

    • memory/5080-124-0x00007FFB7C750000-0x00007FFB7C945000-memory.dmp

      Filesize

      2.0MB

    • memory/5080-125-0x00007FFB7C750000-0x00007FFB7C945000-memory.dmp

      Filesize

      2.0MB

    • memory/5080-126-0x00007FFB7C750000-0x00007FFB7C945000-memory.dmp

      Filesize

      2.0MB

    • memory/5080-132-0x00007FFB7C750000-0x00007FFB7C945000-memory.dmp

      Filesize

      2.0MB

    • memory/5080-133-0x00007FFB7C750000-0x00007FFB7C945000-memory.dmp

      Filesize

      2.0MB

    • memory/5080-2-0x00007FFB3C7D0000-0x00007FFB3C7E0000-memory.dmp

      Filesize

      64KB

    • memory/5080-0-0x00007FFB7C7ED000-0x00007FFB7C7EE000-memory.dmp

      Filesize

      4KB