Analysis

  • max time kernel
    141s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/12/2024, 03:34

General

  • Target

    e629bbd6a5b5c253f38cea38d156d81e0f0e391b7e7618ff275e31fa0d3a34c6.doc

  • Size

    35KB

  • MD5

    df7222411a3a5c18e0d8fb28befb5ed7

  • SHA1

    3680092dcd1918b0f0d11c9d2500db6c161956cb

  • SHA256

    e629bbd6a5b5c253f38cea38d156d81e0f0e391b7e7618ff275e31fa0d3a34c6

  • SHA512

    794d3f34297d17cc9d078a70489705b45f4b885619879ef2cba4d04498ba198680013a742b9d691b88307f24eb61a065fce4827cf138f2ef7504724cd4dc4cc7

  • SSDEEP

    384:wopiSY5UPeL/kyht18/HsowbyD5yQjc60jlj9yD5yQjsyp/d7ryYx:F7C7+BfM4Br

Malware Config

Extracted

Family

xenorat

C2

dns.stipamana.com

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    12000

  • install_path

    appdata

  • port

    4567

  • startup_name

    mrec

Signatures

  • Detect XenoRat Payload 1 IoCs
  • XenorRat

    XenorRat is a remote access trojan written in C#.

  • Xenorat family
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\e629bbd6a5b5c253f38cea38d156d81e0f0e391b7e7618ff275e31fa0d3a34c6.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3596
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\SSUNJNDPI.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\SSUNJNDPI.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1196
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\SSUNJNDPI.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\SSUNJNDPI.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1916
        • C:\Users\Admin\AppData\Roaming\UpdateManager\SSUNJNDPI.exe
          "C:\Users\Admin\AppData\Roaming\UpdateManager\SSUNJNDPI.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4896
          • C:\Users\Admin\AppData\Roaming\UpdateManager\SSUNJNDPI.exe
            C:\Users\Admin\AppData\Roaming\UpdateManager\SSUNJNDPI.exe
            5⤵
            • Executes dropped EXE
            PID:4944
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 80
              6⤵
              • Program crash
              PID:3824
          • C:\Users\Admin\AppData\Roaming\UpdateManager\SSUNJNDPI.exe
            C:\Users\Admin\AppData\Roaming\UpdateManager\SSUNJNDPI.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4872
          • C:\Users\Admin\AppData\Roaming\UpdateManager\SSUNJNDPI.exe
            C:\Users\Admin\AppData\Roaming\UpdateManager\SSUNJNDPI.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1828
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\SSUNJNDPI.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\SSUNJNDPI.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:768
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks.exe" /Create /TN "mrec" /XML "C:\Users\Admin\AppData\Local\Temp\tmp191.tmp" /F
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:3304
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\SSUNJNDPI.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\SSUNJNDPI.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4648
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4944 -ip 4944
    1⤵
      PID:2596

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SSUNJNDPI.exe.log

      Filesize

      706B

      MD5

      d95c58e609838928f0f49837cab7dfd2

      SHA1

      55e7139a1e3899195b92ed8771d1ca2c7d53c916

      SHA256

      0407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339

      SHA512

      405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d

    • C:\Users\Admin\AppData\Local\Temp\TCDAF8.tmp\iso690.xsl

      Filesize

      263KB

      MD5

      ff0e07eff1333cdf9fc2523d323dd654

      SHA1

      77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

      SHA256

      3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

      SHA512

      b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

    • C:\Users\Admin\AppData\Local\Temp\tmp191.tmp

      Filesize

      1KB

      MD5

      435b83fb22c37b7961ff5d34702c2249

      SHA1

      95add8f33f4385f027bd958b81d6a2b886ac507c

      SHA256

      0c3591b634db538192cae67361a4c4613b2edb8d503756450ac90eae248a25b4

      SHA512

      e023638479b3378bb445e4d6851bb7ad1f1b7196682a4d9732750a7a0ea2266696ddb337a99ea5ffa86836d53b36b9bc339b20adb1a376781ef0980948ef4b35

    • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

      Filesize

      2B

      MD5

      f3b25701fe362ec84616a93a45ce9998

      SHA1

      d62636d8caec13f04e28442a0a6fa1afeb024bbb

      SHA256

      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

      SHA512

      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\SSUNJNDPI.exe

      Filesize

      166KB

      MD5

      ec4da29176791ee291b13fb0f8583aa6

      SHA1

      607e0c86284661c3594f2502eaf36d1b216f28ac

      SHA256

      68704e83ea2cfbb078a5fa0ffe4092eb257aa63688c1f05e9ea997f4486a6203

      SHA512

      4127c35a6746ccf610fb4d49c893ff1edc71af266098f04d8e4b540b215f6202bc9f7748e868f6e88a586b9f0dd55649b41e642ca114a7a89b594ba445b7a47b

    • memory/1196-81-0x0000000009DB0000-0x000000000A354000-memory.dmp

      Filesize

      5.6MB

    • memory/1196-82-0x00000000053E0000-0x0000000005472000-memory.dmp

      Filesize

      584KB

    • memory/1196-83-0x00000000051A0000-0x00000000051A6000-memory.dmp

      Filesize

      24KB

    • memory/1196-93-0x00007FFDED430000-0x00007FFDED625000-memory.dmp

      Filesize

      2.0MB

    • memory/1196-79-0x0000000004C70000-0x0000000004CA2000-memory.dmp

      Filesize

      200KB

    • memory/1196-80-0x0000000009760000-0x00000000097FC000-memory.dmp

      Filesize

      624KB

    • memory/1196-78-0x0000000002A80000-0x0000000002A86000-memory.dmp

      Filesize

      24KB

    • memory/1196-77-0x0000000000830000-0x0000000000860000-memory.dmp

      Filesize

      192KB

    • memory/1196-76-0x00007FFDED430000-0x00007FFDED625000-memory.dmp

      Filesize

      2.0MB

    • memory/1916-84-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/3596-18-0x00007FFDED430000-0x00007FFDED625000-memory.dmp

      Filesize

      2.0MB

    • memory/3596-13-0x00007FFDAB100000-0x00007FFDAB110000-memory.dmp

      Filesize

      64KB

    • memory/3596-14-0x00007FFDED430000-0x00007FFDED625000-memory.dmp

      Filesize

      2.0MB

    • memory/3596-8-0x00007FFDED430000-0x00007FFDED625000-memory.dmp

      Filesize

      2.0MB

    • memory/3596-7-0x00007FFDED430000-0x00007FFDED625000-memory.dmp

      Filesize

      2.0MB

    • memory/3596-6-0x00007FFDAD4B0000-0x00007FFDAD4C0000-memory.dmp

      Filesize

      64KB

    • memory/3596-34-0x00007FFDED430000-0x00007FFDED625000-memory.dmp

      Filesize

      2.0MB

    • memory/3596-33-0x00007FFDED430000-0x00007FFDED625000-memory.dmp

      Filesize

      2.0MB

    • memory/3596-35-0x00007FFDED430000-0x00007FFDED625000-memory.dmp

      Filesize

      2.0MB

    • memory/3596-40-0x00007FFDED430000-0x00007FFDED625000-memory.dmp

      Filesize

      2.0MB

    • memory/3596-56-0x00007FFDED430000-0x00007FFDED625000-memory.dmp

      Filesize

      2.0MB

    • memory/3596-15-0x00007FFDED430000-0x00007FFDED625000-memory.dmp

      Filesize

      2.0MB

    • memory/3596-20-0x00007FFDED430000-0x00007FFDED625000-memory.dmp

      Filesize

      2.0MB

    • memory/3596-19-0x00007FFDAB100000-0x00007FFDAB110000-memory.dmp

      Filesize

      64KB

    • memory/3596-1-0x00007FFDED4CD000-0x00007FFDED4CE000-memory.dmp

      Filesize

      4KB

    • memory/3596-16-0x00007FFDED430000-0x00007FFDED625000-memory.dmp

      Filesize

      2.0MB

    • memory/3596-11-0x00007FFDED430000-0x00007FFDED625000-memory.dmp

      Filesize

      2.0MB

    • memory/3596-17-0x00007FFDED430000-0x00007FFDED625000-memory.dmp

      Filesize

      2.0MB

    • memory/3596-12-0x00007FFDED430000-0x00007FFDED625000-memory.dmp

      Filesize

      2.0MB

    • memory/3596-10-0x00007FFDED430000-0x00007FFDED625000-memory.dmp

      Filesize

      2.0MB

    • memory/3596-9-0x00007FFDED430000-0x00007FFDED625000-memory.dmp

      Filesize

      2.0MB

    • memory/3596-5-0x00007FFDED430000-0x00007FFDED625000-memory.dmp

      Filesize

      2.0MB

    • memory/3596-4-0x00007FFDAD4B0000-0x00007FFDAD4C0000-memory.dmp

      Filesize

      64KB

    • memory/3596-3-0x00007FFDAD4B0000-0x00007FFDAD4C0000-memory.dmp

      Filesize

      64KB

    • memory/3596-117-0x00007FFDED430000-0x00007FFDED625000-memory.dmp

      Filesize

      2.0MB

    • memory/3596-116-0x00007FFDED4CD000-0x00007FFDED4CE000-memory.dmp

      Filesize

      4KB

    • memory/3596-118-0x00007FFDED430000-0x00007FFDED625000-memory.dmp

      Filesize

      2.0MB

    • memory/3596-119-0x00007FFDED430000-0x00007FFDED625000-memory.dmp

      Filesize

      2.0MB

    • memory/3596-120-0x00007FFDED430000-0x00007FFDED625000-memory.dmp

      Filesize

      2.0MB

    • memory/3596-121-0x00007FFDED430000-0x00007FFDED625000-memory.dmp

      Filesize

      2.0MB

    • memory/3596-122-0x00007FFDED430000-0x00007FFDED625000-memory.dmp

      Filesize

      2.0MB

    • memory/3596-125-0x00007FFDED430000-0x00007FFDED625000-memory.dmp

      Filesize

      2.0MB

    • memory/3596-129-0x00007FFDED430000-0x00007FFDED625000-memory.dmp

      Filesize

      2.0MB

    • memory/3596-0-0x00007FFDAD4B0000-0x00007FFDAD4C0000-memory.dmp

      Filesize

      64KB

    • memory/3596-2-0x00007FFDAD4B0000-0x00007FFDAD4C0000-memory.dmp

      Filesize

      64KB