Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07/12/2024, 03:34
Behavioral task
behavioral1
Sample
e629bbd6a5b5c253f38cea38d156d81e0f0e391b7e7618ff275e31fa0d3a34c6.doc
Resource
win7-20240903-en
General
-
Target
e629bbd6a5b5c253f38cea38d156d81e0f0e391b7e7618ff275e31fa0d3a34c6.doc
-
Size
35KB
-
MD5
df7222411a3a5c18e0d8fb28befb5ed7
-
SHA1
3680092dcd1918b0f0d11c9d2500db6c161956cb
-
SHA256
e629bbd6a5b5c253f38cea38d156d81e0f0e391b7e7618ff275e31fa0d3a34c6
-
SHA512
794d3f34297d17cc9d078a70489705b45f4b885619879ef2cba4d04498ba198680013a742b9d691b88307f24eb61a065fce4827cf138f2ef7504724cd4dc4cc7
-
SSDEEP
384:wopiSY5UPeL/kyht18/HsowbyD5yQjc60jlj9yD5yQjsyp/d7ryYx:F7C7+BfM4Br
Malware Config
Extracted
xenorat
dns.stipamana.com
Xeno_rat_nd8912d
-
delay
12000
-
install_path
appdata
-
port
4567
-
startup_name
mrec
Signatures
-
Detect XenoRat Payload 1 IoCs
resource yara_rule behavioral2/memory/1916-84-0x0000000000400000-0x0000000000412000-memory.dmp family_xenorat -
Xenorat family
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation SSUNJNDPI.exe -
Executes dropped EXE 8 IoCs
pid Process 1196 SSUNJNDPI.exe 1916 SSUNJNDPI.exe 768 SSUNJNDPI.exe 4648 SSUNJNDPI.exe 4896 SSUNJNDPI.exe 4944 SSUNJNDPI.exe 4872 SSUNJNDPI.exe 1828 SSUNJNDPI.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 1196 set thread context of 1916 1196 SSUNJNDPI.exe 91 PID 1196 set thread context of 768 1196 SSUNJNDPI.exe 92 PID 1196 set thread context of 4648 1196 SSUNJNDPI.exe 93 PID 4896 set thread context of 4944 4896 SSUNJNDPI.exe 95 PID 4896 set thread context of 4872 4896 SSUNJNDPI.exe 96 PID 4896 set thread context of 1828 4896 SSUNJNDPI.exe 98 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3824 4944 WerFault.exe 95 -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSUNJNDPI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSUNJNDPI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSUNJNDPI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSUNJNDPI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSUNJNDPI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSUNJNDPI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSUNJNDPI.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3304 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3596 WINWORD.EXE 3596 WINWORD.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1196 SSUNJNDPI.exe Token: SeDebugPrivilege 4896 SSUNJNDPI.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3596 WINWORD.EXE 3596 WINWORD.EXE 3596 WINWORD.EXE 3596 WINWORD.EXE 3596 WINWORD.EXE 3596 WINWORD.EXE 3596 WINWORD.EXE -
Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 3596 wrote to memory of 1196 3596 WINWORD.EXE 89 PID 3596 wrote to memory of 1196 3596 WINWORD.EXE 89 PID 3596 wrote to memory of 1196 3596 WINWORD.EXE 89 PID 1196 wrote to memory of 1916 1196 SSUNJNDPI.exe 91 PID 1196 wrote to memory of 1916 1196 SSUNJNDPI.exe 91 PID 1196 wrote to memory of 1916 1196 SSUNJNDPI.exe 91 PID 1196 wrote to memory of 1916 1196 SSUNJNDPI.exe 91 PID 1196 wrote to memory of 1916 1196 SSUNJNDPI.exe 91 PID 1196 wrote to memory of 1916 1196 SSUNJNDPI.exe 91 PID 1196 wrote to memory of 1916 1196 SSUNJNDPI.exe 91 PID 1196 wrote to memory of 1916 1196 SSUNJNDPI.exe 91 PID 1196 wrote to memory of 768 1196 SSUNJNDPI.exe 92 PID 1196 wrote to memory of 768 1196 SSUNJNDPI.exe 92 PID 1196 wrote to memory of 768 1196 SSUNJNDPI.exe 92 PID 1196 wrote to memory of 768 1196 SSUNJNDPI.exe 92 PID 1196 wrote to memory of 768 1196 SSUNJNDPI.exe 92 PID 1196 wrote to memory of 768 1196 SSUNJNDPI.exe 92 PID 1196 wrote to memory of 768 1196 SSUNJNDPI.exe 92 PID 1196 wrote to memory of 768 1196 SSUNJNDPI.exe 92 PID 1196 wrote to memory of 4648 1196 SSUNJNDPI.exe 93 PID 1196 wrote to memory of 4648 1196 SSUNJNDPI.exe 93 PID 1196 wrote to memory of 4648 1196 SSUNJNDPI.exe 93 PID 1196 wrote to memory of 4648 1196 SSUNJNDPI.exe 93 PID 1196 wrote to memory of 4648 1196 SSUNJNDPI.exe 93 PID 1196 wrote to memory of 4648 1196 SSUNJNDPI.exe 93 PID 1196 wrote to memory of 4648 1196 SSUNJNDPI.exe 93 PID 1196 wrote to memory of 4648 1196 SSUNJNDPI.exe 93 PID 1916 wrote to memory of 4896 1916 SSUNJNDPI.exe 94 PID 1916 wrote to memory of 4896 1916 SSUNJNDPI.exe 94 PID 1916 wrote to memory of 4896 1916 SSUNJNDPI.exe 94 PID 4896 wrote to memory of 4944 4896 SSUNJNDPI.exe 95 PID 4896 wrote to memory of 4944 4896 SSUNJNDPI.exe 95 PID 4896 wrote to memory of 4944 4896 SSUNJNDPI.exe 95 PID 4896 wrote to memory of 4944 4896 SSUNJNDPI.exe 95 PID 4896 wrote to memory of 4944 4896 SSUNJNDPI.exe 95 PID 4896 wrote to memory of 4944 4896 SSUNJNDPI.exe 95 PID 4896 wrote to memory of 4944 4896 SSUNJNDPI.exe 95 PID 4896 wrote to memory of 4944 4896 SSUNJNDPI.exe 95 PID 4896 wrote to memory of 4872 4896 SSUNJNDPI.exe 96 PID 4896 wrote to memory of 4872 4896 SSUNJNDPI.exe 96 PID 4896 wrote to memory of 4872 4896 SSUNJNDPI.exe 96 PID 4896 wrote to memory of 4872 4896 SSUNJNDPI.exe 96 PID 4896 wrote to memory of 4872 4896 SSUNJNDPI.exe 96 PID 4896 wrote to memory of 4872 4896 SSUNJNDPI.exe 96 PID 4896 wrote to memory of 4872 4896 SSUNJNDPI.exe 96 PID 4896 wrote to memory of 4872 4896 SSUNJNDPI.exe 96 PID 4896 wrote to memory of 1828 4896 SSUNJNDPI.exe 98 PID 4896 wrote to memory of 1828 4896 SSUNJNDPI.exe 98 PID 4896 wrote to memory of 1828 4896 SSUNJNDPI.exe 98 PID 4896 wrote to memory of 1828 4896 SSUNJNDPI.exe 98 PID 4896 wrote to memory of 1828 4896 SSUNJNDPI.exe 98 PID 4896 wrote to memory of 1828 4896 SSUNJNDPI.exe 98 PID 4896 wrote to memory of 1828 4896 SSUNJNDPI.exe 98 PID 4896 wrote to memory of 1828 4896 SSUNJNDPI.exe 98 PID 768 wrote to memory of 3304 768 SSUNJNDPI.exe 107 PID 768 wrote to memory of 3304 768 SSUNJNDPI.exe 107 PID 768 wrote to memory of 3304 768 SSUNJNDPI.exe 107
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\e629bbd6a5b5c253f38cea38d156d81e0f0e391b7e7618ff275e31fa0d3a34c6.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\SSUNJNDPI.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\SSUNJNDPI.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\SSUNJNDPI.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\SSUNJNDPI.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Roaming\UpdateManager\SSUNJNDPI.exe"C:\Users\Admin\AppData\Roaming\UpdateManager\SSUNJNDPI.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Roaming\UpdateManager\SSUNJNDPI.exeC:\Users\Admin\AppData\Roaming\UpdateManager\SSUNJNDPI.exe5⤵
- Executes dropped EXE
PID:4944 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 806⤵
- Program crash
PID:3824
-
-
-
C:\Users\Admin\AppData\Roaming\UpdateManager\SSUNJNDPI.exeC:\Users\Admin\AppData\Roaming\UpdateManager\SSUNJNDPI.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4872
-
-
C:\Users\Admin\AppData\Roaming\UpdateManager\SSUNJNDPI.exeC:\Users\Admin\AppData\Roaming\UpdateManager\SSUNJNDPI.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1828
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\SSUNJNDPI.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\SSUNJNDPI.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "mrec" /XML "C:\Users\Admin\AppData\Local\Temp\tmp191.tmp" /F4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3304
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\SSUNJNDPI.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\SSUNJNDPI.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4648
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4944 -ip 49441⤵PID:2596
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
706B
MD5d95c58e609838928f0f49837cab7dfd2
SHA155e7139a1e3899195b92ed8771d1ca2c7d53c916
SHA2560407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339
SHA512405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
1KB
MD5435b83fb22c37b7961ff5d34702c2249
SHA195add8f33f4385f027bd958b81d6a2b886ac507c
SHA2560c3591b634db538192cae67361a4c4613b2edb8d503756450ac90eae248a25b4
SHA512e023638479b3378bb445e4d6851bb7ad1f1b7196682a4d9732750a7a0ea2266696ddb337a99ea5ffa86836d53b36b9bc339b20adb1a376781ef0980948ef4b35
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
166KB
MD5ec4da29176791ee291b13fb0f8583aa6
SHA1607e0c86284661c3594f2502eaf36d1b216f28ac
SHA25668704e83ea2cfbb078a5fa0ffe4092eb257aa63688c1f05e9ea997f4486a6203
SHA5124127c35a6746ccf610fb4d49c893ff1edc71af266098f04d8e4b540b215f6202bc9f7748e868f6e88a586b9f0dd55649b41e642ca114a7a89b594ba445b7a47b