Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
08/12/2024, 01:01
General
- Target bf6659af111dfa8daca20d98f53711b282cce11434fff5d245a0c277e6c806ef.vbs
- Size 10KB
- Sample241208-bc823atmbs
- SHA256 bf6659af111dfa8daca20d98f53711b282cce11434fff5d245a0c277e6c806ef
Malware Config
Extracted
-
xenorat
-
dns.stipamana.com
-
Xeno_rat_nd8912d
-
delay
12000
-
install_path
appdata
-
port
4567
-
startup_name
mrec
Signatures
- Detect XenoRat Payload 1 IoCs
- XenorRat
XenorRat is a remote access trojan written in C#.
- Xenorat family
- Blocklisted process makes network request 1 IoCs
- Downloads MZ/PE file
- Office macro that triggers on suspicious action 1 IoCs
Office document macro which triggers in special circumstances - often malicious.
- Suspicious Office macro 1 IoCs
Office document equipped with macros.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 8 IoCs
- Suspicious use of SetThreadContext 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 57 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bf6659af111dfa8daca20d98f53711b282cce11434fff5d245a0c277e6c806ef.vbs"1⤵
- Blocklisted process makes network request
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 804⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe"C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exeC:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exeC:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "mrec" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE196.tmp" /F6⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exeC:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 804⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2660 -ip 26601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1944 -ip 19441⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
DNKFU.exe.log
sist02.xsl
sJ.doc
tmpE196.tmp
CUSTOM.DIC
DNKFU.exe
memory/1332-575-0x0000000005D50000-0x0000000005DB6000-memory.dmp
memory/1936-66-0x0000000000E00000-0x0000000000E30000-memory.dmp
memory/1936-72-0x00000000032E0000-0x00000000032E6000-memory.dmp
memory/1936-71-0x0000000007DF0000-0x0000000007E82000-memory.dmp
memory/1936-70-0x00000000083A0000-0x0000000008944000-memory.dmp
memory/1936-69-0x0000000007D50000-0x0000000007DEC000-memory.dmp
memory/1936-68-0x0000000003220000-0x0000000003254000-memory.dmp
memory/1936-67-0x00000000032C0000-0x00000000032C6000-memory.dmp
memory/3004-12-0x00007FFAA89F0000-0x00007FFAA8BE5000-memory.dmp
memory/3004-9-0x00007FFAA89F0000-0x00007FFAA8BE5000-memory.dmp
memory/3004-17-0x00007FFA668B0000-0x00007FFA668C0000-memory.dmp
memory/3004-6-0x00007FFAA89F0000-0x00007FFAA8BE5000-memory.dmp
memory/3004-4-0x00007FFA68A70000-0x00007FFA68A80000-memory.dmp
memory/3004-11-0x00007FFAA89F0000-0x00007FFAA8BE5000-memory.dmp
memory/3004-7-0x00007FFAA89F0000-0x00007FFAA8BE5000-memory.dmp
memory/3004-16-0x00007FFA668B0000-0x00007FFA668C0000-memory.dmp
memory/3004-13-0x00007FFAA89F0000-0x00007FFAA8BE5000-memory.dmp
memory/3004-15-0x00007FFAA89F0000-0x00007FFAA8BE5000-memory.dmp
memory/3004-14-0x00007FFAA89F0000-0x00007FFAA8BE5000-memory.dmp
memory/3004-8-0x00007FFA68A70000-0x00007FFA68A80000-memory.dmp
memory/3004-10-0x00007FFAA89F0000-0x00007FFAA8BE5000-memory.dmp
memory/3004-1-0x00007FFAA8A8D000-0x00007FFAA8A8E000-memory.dmp
memory/3004-5-0x00007FFA68A70000-0x00007FFA68A80000-memory.dmp
memory/3004-108-0x00007FFAA89F0000-0x00007FFAA8BE5000-memory.dmp
memory/3004-107-0x00007FFAA8A8D000-0x00007FFAA8A8E000-memory.dmp
memory/3004-109-0x00007FFAA89F0000-0x00007FFAA8BE5000-memory.dmp
memory/3004-110-0x00007FFAA89F0000-0x00007FFAA8BE5000-memory.dmp
memory/3004-2-0x00007FFA68A70000-0x00007FFA68A80000-memory.dmp
memory/3004-3-0x00007FFA68A70000-0x00007FFA68A80000-memory.dmp
memory/4076-75-0x0000000000400000-0x0000000000412000-memory.dmp