Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07-12-2024 17:16
General
-
Target
a1b6ec86bff84ed72257daaf6a11811f71027b8a02592d39bda47c36a1a91afb.exe
-
Size
2.2MB
-
MD5
958dad459434404af63b16110f8333be
-
SHA1
2d83e559793d250b8e50643a90c90d78d4a5174f
-
SHA256
a1b6ec86bff84ed72257daaf6a11811f71027b8a02592d39bda47c36a1a91afb
-
SHA512
d98d4bf9cfe745c4b7cc4734a017c586c88013a2dc8c16f8e97f50261001357f5e01314dc8a91d8c624ab7ac56c0cc7478c8ed7268bf5004db8f9de61c03bc81
-
SSDEEP
49152:fegwdsK+fl0+eor1gyVSgg0R4WEggpZWPVcr8823guNNb9C5sx7LfkyoJ:l5OpMp49ggpZyHNho5sNaJ
Malware Config
Extracted
xenorat
96.126.118.61
Microsoft Windows_3371808
-
delay
5000
-
install_path
appdata
-
port
5037
-
startup_name
svchost.exe
Signatures
-
XenorRat
XenorRat is a remote access trojan written in C#.
-
Xenorat family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1b6ec86bff84ed72257daaf6a11811f71027b8a02592d39bda47c36a1a91afb.exe"C:\Users\Admin\AppData\Local\Temp\a1b6ec86bff84ed72257daaf6a11811f71027b8a02592d39bda47c36a1a91afb.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "svchost.exe" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC813.tmp" /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57c3763245eea4e1da4a06034273799f6
SHA110d237c5f2faf43291a43f160e88d278777f8407
SHA256594d1863b51343ff956e34892d90854627f6a73686b89824616e9e17b7410160
SHA512f87d36b8cf5261a9d0cb4ec84da92040cdf2d7cf63e4898e232a52a76358c8e962725eb75be65bceb88d73b439db03448ae2bc34d477e9a0fa9e2186d9cf6338
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
6.8MB
-
Filesize
6.8MB
-
Filesize
6.8MB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
6.8MB
-
Filesize
4KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
408KB
-
Filesize
4KB