xenorat | b4dd75adf11ddcc5140fda99a0619ec0410ec7565b96b18c8e0da718823f91da

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2024 15:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ab4cff638814f6af02b404eb9be4546122f56f93b071c44728d79f71e074277.vbs
Size

10KB
MD5

49c83d8e10443183f49df571416c685b
SHA1

01df897fe262f4aaf0b3d48ccade34587dd83e72
SHA256

7ab4cff638814f6af02b404eb9be4546122f56f93b071c44728d79f71e074277
SHA512

92812130a270b977e5d0c655731b808a4c2d01a67d720921de1072d553199a2c200aa34853bda5937219e90c813f0a3350e59f0072a37c38c8de09a1adba7d49
SSDEEP

192:PQrn65rH/Jjw5jvacpYTvS96XVELDrRiHgk:PQGrHdmvib1yLR/k

Score

10^/10

xenorat discovery macro macro_on_action rat trojan

Malware Config

Extracted

Family

xenorat

dns.stipamana.com

Mutex

Xeno_rat_nd8912d

Attributes

delay
12000
install_path
appdata
port
4567
startup_name
mrec

Signatures

Detect XenoRat Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3480-77-0x0000000000400000-0x0000000000412000-memory.dmp	family_xenorat

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat
Xenorat family
xenorat

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	3484	WScript.exe

Downloads MZ/PE file

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action

resource	yara_rule
behavioral2/files/0x000b000000023b76-29.dat	office_macro_on_action

Suspicious Office macro 1 IoCs

Office document equipped with macros.

macro

resource
behavioral2/files/0x000b000000023b76-29.dat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	DNKFU.exe

Executes dropped EXE 8 IoCs

pid	Process
1700	DNKFU.exe
3480	DNKFU.exe
4176	DNKFU.exe
2548	DNKFU.exe
4072	DNKFU.exe
2180	DNKFU.exe
1696	DNKFU.exe
1688	DNKFU.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 1700 set thread context of 3480	1700	DNKFU.exe	90
PID 1700 set thread context of 4176	1700	DNKFU.exe	91
PID 1700 set thread context of 2548	1700	DNKFU.exe	92
PID 4072 set thread context of 2180	4072	DNKFU.exe	99
PID 4072 set thread context of 1696	4072	DNKFU.exe	100
PID 4072 set thread context of 1688	4072	DNKFU.exe	102

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
1296	2548	WerFault.exe	92
3776	4176	WerFault.exe	91
2164	1688	WerFault.exe	102
1736	2180	WerFault.exe	99
2464	1696	WerFault.exe	100

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DNKFU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DNKFU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DNKFU.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
896	WINWORD.EXE
896	WINWORD.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1700	DNKFU.exe
Token: SeDebugPrivilege	4072	DNKFU.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
896	WINWORD.EXE
896	WINWORD.EXE
896	WINWORD.EXE
896	WINWORD.EXE
896	WINWORD.EXE
896	WINWORD.EXE
896	WINWORD.EXE

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 1700	896	WINWORD.EXE	88
PID 896 wrote to memory of 1700	896	WINWORD.EXE	88
PID 896 wrote to memory of 1700	896	WINWORD.EXE	88
PID 1700 wrote to memory of 3480	1700	DNKFU.exe	90
PID 1700 wrote to memory of 3480	1700	DNKFU.exe	90
PID 1700 wrote to memory of 3480	1700	DNKFU.exe	90
PID 1700 wrote to memory of 3480	1700	DNKFU.exe	90
PID 1700 wrote to memory of 3480	1700	DNKFU.exe	90
PID 1700 wrote to memory of 3480	1700	DNKFU.exe	90
PID 1700 wrote to memory of 3480	1700	DNKFU.exe	90
PID 1700 wrote to memory of 3480	1700	DNKFU.exe	90
PID 1700 wrote to memory of 4176	1700	DNKFU.exe	91
PID 1700 wrote to memory of 4176	1700	DNKFU.exe	91
PID 1700 wrote to memory of 4176	1700	DNKFU.exe	91
PID 1700 wrote to memory of 4176	1700	DNKFU.exe	91
PID 1700 wrote to memory of 4176	1700	DNKFU.exe	91
PID 1700 wrote to memory of 4176	1700	DNKFU.exe	91
PID 1700 wrote to memory of 4176	1700	DNKFU.exe	91
PID 1700 wrote to memory of 4176	1700	DNKFU.exe	91
PID 1700 wrote to memory of 2548	1700	DNKFU.exe	92
PID 1700 wrote to memory of 2548	1700	DNKFU.exe	92
PID 1700 wrote to memory of 2548	1700	DNKFU.exe	92
PID 1700 wrote to memory of 2548	1700	DNKFU.exe	92
PID 1700 wrote to memory of 2548	1700	DNKFU.exe	92
PID 1700 wrote to memory of 2548	1700	DNKFU.exe	92
PID 1700 wrote to memory of 2548	1700	DNKFU.exe	92
PID 1700 wrote to memory of 2548	1700	DNKFU.exe	92
PID 3480 wrote to memory of 4072	3480	DNKFU.exe	98
PID 3480 wrote to memory of 4072	3480	DNKFU.exe	98
PID 3480 wrote to memory of 4072	3480	DNKFU.exe	98
PID 4072 wrote to memory of 2180	4072	DNKFU.exe	99
PID 4072 wrote to memory of 2180	4072	DNKFU.exe	99
PID 4072 wrote to memory of 2180	4072	DNKFU.exe	99
PID 4072 wrote to memory of 2180	4072	DNKFU.exe	99
PID 4072 wrote to memory of 2180	4072	DNKFU.exe	99
PID 4072 wrote to memory of 2180	4072	DNKFU.exe	99
PID 4072 wrote to memory of 2180	4072	DNKFU.exe	99
PID 4072 wrote to memory of 2180	4072	DNKFU.exe	99
PID 4072 wrote to memory of 1696	4072	DNKFU.exe	100
PID 4072 wrote to memory of 1696	4072	DNKFU.exe	100
PID 4072 wrote to memory of 1696	4072	DNKFU.exe	100
PID 4072 wrote to memory of 1696	4072	DNKFU.exe	100
PID 4072 wrote to memory of 1696	4072	DNKFU.exe	100
PID 4072 wrote to memory of 1696	4072	DNKFU.exe	100
PID 4072 wrote to memory of 1696	4072	DNKFU.exe	100
PID 4072 wrote to memory of 1696	4072	DNKFU.exe	100
PID 4072 wrote to memory of 1688	4072	DNKFU.exe	102
PID 4072 wrote to memory of 1688	4072	DNKFU.exe	102
PID 4072 wrote to memory of 1688	4072	DNKFU.exe	102
PID 4072 wrote to memory of 1688	4072	DNKFU.exe	102
PID 4072 wrote to memory of 1688	4072	DNKFU.exe	102
PID 4072 wrote to memory of 1688	4072	DNKFU.exe	102
PID 4072 wrote to memory of 1688	4072	DNKFU.exe	102
PID 4072 wrote to memory of 1688	4072	DNKFU.exe	102

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7ab4cff638814f6af02b404eb9be4546122f56f93b071c44728d79f71e074277.vbs"
1⤵
- Blocklisted process makes network request
PID:3484

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:896
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3480
  - - C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe
      "C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4072
    - - C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe
        
        C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe
        5⤵
        Executes dropped EXE
        
        PID:2180
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 80
        6⤵
        Program crash
        
        PID:1736
    - - C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe
        
        C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe
        5⤵
        Executes dropped EXE
        
        PID:1696
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 80
        6⤵
        Program crash
        
        PID:2464
    - - C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe
        
        C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe
        5⤵
        Executes dropped EXE
        
        PID:1688
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 80
        6⤵
        Program crash
        
        PID:2164
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe
    3⤵
    - Executes dropped EXE
    PID:4176
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 80
      4⤵
      Program crash
      PID:3776
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe
    3⤵
    - Executes dropped EXE
    PID:2548
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 80
      4⤵
      Program crash
      PID:1296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4176 -ip 4176
1⤵
PID:4460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2548 -ip 2548
1⤵
PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2180 -ip 2180
1⤵
PID:3992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1696 -ip 1696
1⤵
PID:4184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1688 -ip 1688
1⤵
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DNKFU.exe.log

Filesize
706B

MD5
d95c58e609838928f0f49837cab7dfd2

SHA1
55e7139a1e3899195b92ed8771d1ca2c7d53c916

SHA256
0407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339

SHA512
405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Fyj.doc

Filesize
193KB

MD5
ce24313f8b01015afc7d6f5e668bd703

SHA1
d86c8ee00b3f4db999a94557e7ae62ee2cd87c0e

SHA256
b7d50f4fb2342f63f86df5da89e7be2d3490adaccb37a5a6df2c1927c46aec60

SHA512
b5e1f7a31e22afdf20b6b206e3815613714758f091481e15f73ca371f2bccb6833fd4b50c4f53869a315948c0a2e94ad7cb1753a764b0d0d234b5f511bf7b710

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCDD6CA.tmp\sist02.xsl

Filesize
245KB

MD5
f883b260a8d67082ea895c14bf56dd56

SHA1
7954565c1f243d46ad3b1e2f1baf3281451fc14b

SHA256
ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

SHA512
d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe

Filesize
174KB

MD5
d0cbf54138d03f82115b5708be94c5c0

SHA1
aeaafe59c0342c0105d764ee69f6292206f661c6

SHA256
c243a7dcd332df7a231b33e346a1db91ad01c7f0a17f10ed8dec3efa34743949

SHA512
fedc40b326466772e5da972798faa3504837ee67cd26f73db2f6a7effae9d1dc511007279ddd3b78b885c8d691c897ffd2a29f82dd37c6a33623eee85ebb1108

Download Submit
memory/896-18-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/896-5-0x00007FFCDB270000-0x00007FFCDB280000-memory.dmp

Filesize
64KB

Download
memory/896-13-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/896-12-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/896-14-0x00007FFCD9210000-0x00007FFCD9220000-memory.dmp

Filesize
64KB

Download
memory/896-10-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/896-9-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/896-8-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/896-7-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/896-6-0x00007FFCDB270000-0x00007FFCDB280000-memory.dmp

Filesize
64KB

Download
memory/896-16-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/896-19-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/896-20-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/896-21-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/896-2-0x00007FFD1B28D000-0x00007FFD1B28E000-memory.dmp

Filesize
4KB

Download
memory/896-17-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/896-15-0x00007FFCD9210000-0x00007FFCD9220000-memory.dmp

Filesize
64KB

Download
memory/896-11-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/896-3-0x00007FFCDB270000-0x00007FFCDB280000-memory.dmp

Filesize
64KB

Download
memory/896-1-0x00007FFCDB270000-0x00007FFCDB280000-memory.dmp

Filesize
64KB

Download
memory/896-108-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/896-107-0x00007FFD1B28D000-0x00007FFD1B28E000-memory.dmp

Filesize
4KB

Download
memory/896-106-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/896-4-0x00007FFCDB270000-0x00007FFCDB280000-memory.dmp

Filesize
64KB

Download
memory/1696-99-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1700-75-0x000000000D530000-0x000000000D5C2000-memory.dmp

Filesize
584KB

Download
memory/1700-76-0x00000000024A0000-0x00000000024A6000-memory.dmp

Filesize
24KB

Download
memory/1700-74-0x000000000DAE0000-0x000000000E084000-memory.dmp

Filesize
5.6MB

Download
memory/1700-73-0x000000000D490000-0x000000000D52C000-memory.dmp

Filesize
624KB

Download
memory/1700-72-0x0000000004B20000-0x0000000004B54000-memory.dmp

Filesize
208KB

Download
memory/1700-71-0x0000000002630000-0x0000000002636000-memory.dmp

Filesize
24KB

Download
memory/1700-70-0x00000000001F0000-0x0000000000220000-memory.dmp

Filesize
192KB

Download
memory/3480-77-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4072-96-0x0000000002D80000-0x0000000002DB4000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads