Overview

overview

10

Static

static

8

4WBVB_Esta...ta.xls

windows7-x64

10

4WBVB_Esta...ta.xls

windows10-2004-x64

Analysis

  • max time kernel
    39s
  • max time network
    44s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-12-2024 08:12

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    4WBVB_Estadodecuenta.xls

  • Size

    192KB

  • MD5

    31795aff2f438defa01c82368886353c

  • SHA1

    3f4c6dfa01693fea70f3113c11aeb5812b0c6cdb

  • SHA256

    75a5568c91850b8332bf8ac3d6a0acbe24a2bbb9a7941994709ba3cbaa255c5a

  • SHA512

    9ceebe6f8c7ee47b23c9e9350b7afdb21064edc45009ad8d1400566959d669b5aa2fd426d19c3302d701e05d5a09e9ed4088c1869168f4237b2b7417e21a49df

  • SSDEEP

    6144:BxEtjPOtioVjDGUU1qfDlavx+W2QnAu+Ly9ckwDwPq5XlsqhwxNNipu:s+VkGUqLsqyi

Score
10/10
xenoratdiscoverymacromacro_on_actionrattrojan

Malware Config

Extracted

Family

xenorat

C2

dns.stipamana.com

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    12000

  • install_path

    appdata

  • port

    4567

  • startup_name

    mrec

Signatures

  • Detect XenoRat Payload 2 IoCs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat
  • Xenorat family
    xenorat
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Office macro that triggers on suspicious action 1 IoCs

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action
  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

    macro
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 23 IoCs
  • Suspicious use of WriteProcessMemory 59 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\4WBVB_Estadodecuenta.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4452
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\TDCNX.vbs"
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      PID:3108
  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4916
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4136
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe
        3⤵
        • Executes dropped EXE
        PID:1088
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 80
          4⤵
          • Program crash
          PID:2232
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2924
        • C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe
          "C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:920
          • C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe
            C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3760
          • C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe
            C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe
            5⤵
            • Executes dropped EXE
            PID:4316
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 80
              6⤵
              • Program crash
              PID:4984
          • C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe
            C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3240
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4768
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks.exe" /Create /TN "mrec" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE59D.tmp" /F
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:5468
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1088 -ip 1088
    1⤵
      PID:4420
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4316 -ip 4316
      1⤵
        PID:1380

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
        Filesize

        717B

        MD5

        822467b728b7a66b081c91795373789a

        SHA1

        d8f2f02e1eef62485a9feffd59ce837511749865

        SHA256

        af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

        SHA512

        bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\571AD299D4068543C8553D40E79010FA
        Filesize

        504B

        MD5

        7a1f814e2a871f3d16dcd5a88a4865f3

        SHA1

        bbb720fedc188a92c19b1303cf42551c4636b948

        SHA256

        da477890ff49815dce6931f9aeda5aeff9b36f548a891d820084e7256a077ee6

        SHA512

        87c5b06faa5f09504a78f057690a548aee5378058f0e4aa704132037e6092a67e57dba9f4a5a635b492378a280d55135ca6f5060ccd35596cde90f16ae12cea5

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
        Filesize

        192B

        MD5

        fa12bc11db076d851de6f8b7a01c54ac

        SHA1

        2d71431d85bfc47c3b6451f2cf4fc560ade45da1

        SHA256

        1a4c5a87390230663dd58a2e6027d0f7b8071dfda8ab3e2df72c3b51878fa045

        SHA512

        8453a7848b9ee2ea057c6a59f1db6fb6a53c89372b54dd1f2e906e34830ad01d02751bb86927fab84276ea09426af8ae714c434d41f032e0ead5ba2621fe9f53

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\571AD299D4068543C8553D40E79010FA
        Filesize

        550B

        MD5

        c0aa824bd77932559dae7e0b346156a3

        SHA1

        9f29ea6ded0ff9dc1c418e928e561bc419c60877

        SHA256

        b46ce6dd8eec48a01eb8bc15189d565866828e81f433b62d85d2a3100b87ad0f

        SHA512

        64dfc7c28a8ec2f186d4d7268889ea9568cd28d9c6dac5b12647b40ad65014e95cb14354c2c1cde280748ad74c257d1ea8ec1be2589e425f7cfe9b298480cc93

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DNKFU.exe.log
        Filesize

        706B

        MD5

        d95c58e609838928f0f49837cab7dfd2

        SHA1

        55e7139a1e3899195b92ed8771d1ca2c7d53c916

        SHA256

        0407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339

        SHA512

        405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\AF3EC652-4BAA-4512-B328-1A306FDDBE53
        Filesize

        176KB

        MD5

        49723108a1986b72eb475aac0f6c7615

        SHA1

        cc92000d6a5b54088fa4462bb0200d594dc6041d

        SHA256

        06a0cd92912f12a6d654164ef9080bf089eb2c6e134ad42c1bf043e3608ca1b0

        SHA512

        c39e199678f45fd735e3566f75048519b7d7fd8b7f34cd8126fc213f6110978352827c6500ae567a121719cd590f40e4a6ce6e92f102546a9e240858b601ff30

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog
        Filesize

        11KB

        MD5

        1a1199225225af70e61d4c0bea75ffe0

        SHA1

        af51a7bca848b59fd5a1514160f90588fee0ff92

        SHA256

        80f03f98bd03c865a98b1df8ec81f8d3e28fb80daaa691d709face4633e789db

        SHA512

        1e304eed097145b77406f7ac930bdfe7517ba6bf3786d16e289f6412a0185d91f54995bb02061e4aade71128fdd5990e164e4e4240451b0f9a614bfa91e3ddfd

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
        Filesize

        2KB

        MD5

        9f10d9e71c11dc4d7ba8d0c19667d83c

        SHA1

        554325795f8c9b9677709a6b8fc24403fc7a2493

        SHA256

        7ddcd04fc8c9a8fcd1f9bc5940d775f9290aeac63a29f49d7d4fba6044550e60

        SHA512

        abd201d1577b4dc162ef416b89f3d23d0523a6775b7699e79a10c375b44be0fbc188a120f92f2382217c0d243c991ed52afbbda30ef3d74784fcc746c746a5bc

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
        Filesize

        2KB

        MD5

        b7c483a92c81f8ce16bb4343cca954ed

        SHA1

        b8e421d0299933b498a56f7f6f5fa481d511fc10

        SHA256

        f73be84f606beb33f3695a0d1725532360fe8ea330a041fc360c0efc045b835a

        SHA512

        c29713a63bf58d31a5c65a9af0c27e76044e4ac71b19698d13337f20dc5e15d0fa63166347cae528fb695653a1f00cae05947101fa6ffdadc5772a441ae5ca49

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Qj.doc
        Filesize

        193KB

        MD5

        ce24313f8b01015afc7d6f5e668bd703

        SHA1

        d86c8ee00b3f4db999a94557e7ae62ee2cd87c0e

        SHA256

        b7d50f4fb2342f63f86df5da89e7be2d3490adaccb37a5a6df2c1927c46aec60

        SHA512

        b5e1f7a31e22afdf20b6b206e3815613714758f091481e15f73ca371f2bccb6833fd4b50c4f53869a315948c0a2e94ad7cb1753a764b0d0d234b5f511bf7b710

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\TCDE1E3.tmp\gb.xsl
        Filesize

        262KB

        MD5

        51d32ee5bc7ab811041f799652d26e04

        SHA1

        412193006aa3ef19e0a57e16acf86b830993024a

        SHA256

        6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

        SHA512

        5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\tmpE59D.tmp
        Filesize

        1KB

        MD5

        5c8fe4f5f1e1e45ed639b7c4c8c8ab0a

        SHA1

        f46c6596614c34e0dc0dd04b31b0d9863ed80d2e

        SHA256

        2bdd53d79e6397484b617c2c307d3b88e0e93e29546ef0dd7389614c1e7d3c20

        SHA512

        c1b2c9a3f452e3f7b09f9d3c76a37f86de76884e1a388f51ef41cc4a9a78a74504a03ea000fbe6204861e251a7bb2a0ddf4d6e0ac51ef184dd9d8c61e60ef9fe

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
        Filesize

        16B

        MD5

        d29962abc88624befc0135579ae485ec

        SHA1

        e40a6458296ec6a2427bcb280572d023a9862b31

        SHA256

        a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

        SHA512

        4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
        Filesize

        1KB

        MD5

        c198cae6d76fa9d3ec01713bdc16bada

        SHA1

        1b2a8b7e3ed28f5a0c8658850409cc7d6f3111be

        SHA256

        e5ba3fbdcebb094791581f6459ed0bc1ff2833dfd1d49d51cbbfb0e86a3e8877

        SHA512

        e5d67fedec7a20fa552306b33ce7cb4420511226011964fc6d14190ca9c1412189380ab00df3593af7d8330224fac7b49f4939f5850e553353152a72570b8e40

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe
        Filesize

        174KB

        MD5

        da302f1f3b3f3a7df3dde94d870a2e22

        SHA1

        4c8e57bce883b2c2357065e95e4f4e1119d7b08d

        SHA256

        e84e765247bd6d7d756789ba7c07d61a12c2e265136e0ca65acdc919d4ca98bc

        SHA512

        0c4e38cb7387e647e2238cfd086c0122c12d9a9b9f827a56515722d4534a1ac3cc5a9c3e538095a696e84c52df1b7a75dd08a03a0e286cc79bdf398b2a93fdec

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\TDCNX.vbs
        Filesize

        10KB

        MD5

        c818cba07e014f95bcf8b133eaba0ee6

        SHA1

        83852a470bf54205d59cf40675034f2129a10771

        SHA256

        6b30fade6f3a26071148b661172fb9d8976c5d1d890a407bd06b5a4ae801b9b3

        SHA512

        c718d0d1d43d7b36f6b3988d5e7de327d14f9d94ae43b62d7a5169c7580b57fbb83e49c2cb209e0328f748668a554878a083a763639b640806f4addd9430e78b

        Download Submit

      • memory/2924-114-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

        Download

      • memory/4136-110-0x00000000073F0000-0x0000000007482000-memory.dmp

        Filesize

        584KB

        Download

      • memory/4136-105-0x0000000000490000-0x00000000004C0000-memory.dmp

        Filesize

        192KB

        Download

      • memory/4136-111-0x0000000004E10000-0x0000000004E16000-memory.dmp

        Filesize

        24KB

        Download

      • memory/4136-109-0x00000000079A0000-0x0000000007F44000-memory.dmp

        Filesize

        5.6MB

        Download

      • memory/4136-108-0x0000000007350000-0x00000000073EC000-memory.dmp

        Filesize

        624KB

        Download

      • memory/4136-107-0x0000000004870000-0x00000000048A4000-memory.dmp

        Filesize

        208KB

        Download

      • memory/4136-106-0x0000000004DA0000-0x0000000004DA6000-memory.dmp

        Filesize

        24KB

        Download

      • memory/4452-80-0x00007FF988270000-0x00007FF988465000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/4452-39-0x00007FF988270000-0x00007FF988465000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/4452-11-0x00007FF988270000-0x00007FF988465000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/4452-12-0x00007FF988270000-0x00007FF988465000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/4452-10-0x00007FF988270000-0x00007FF988465000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/4452-9-0x00007FF988270000-0x00007FF988465000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/4452-7-0x00007FF988270000-0x00007FF988465000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/4452-8-0x00007FF988270000-0x00007FF988465000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/4452-13-0x00007FF946150000-0x00007FF946160000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4452-14-0x00007FF946150000-0x00007FF946160000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4452-38-0x00007FF988270000-0x00007FF988465000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/4452-34-0x00007FF988270000-0x00007FF988465000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/4452-2-0x00007FF9482F0000-0x00007FF948300000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4452-40-0x00007FF988270000-0x00007FF988465000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/4452-6-0x00007FF9482F0000-0x00007FF948300000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4452-4-0x00007FF988270000-0x00007FF988465000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/4452-136-0x00007FF988270000-0x00007FF988465000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/4452-5-0x00007FF9482F0000-0x00007FF948300000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4452-147-0x00007FF988270000-0x00007FF988465000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/4452-148-0x00007FF988270000-0x00007FF988465000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/4452-0-0x00007FF9482F0000-0x00007FF948300000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4452-1-0x00007FF9482F0000-0x00007FF948300000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4452-3-0x00007FF98830D000-0x00007FF98830E000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4768-636-0x0000000005E00000-0x0000000005E66000-memory.dmp

        Filesize

        408KB

        Download

      • memory/4768-637-0x0000000005DD0000-0x0000000005DDA000-memory.dmp

        Filesize

        40KB

        Download