Overview

overview

10

Static

static

8

Estadodecuenta.xls

windows7-x64

10

Estadodecuenta.xls

windows10-2004-x64

Analysis

  • max time kernel
    32s
  • max time network
    47s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-12-2024 08:11

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    Estadodecuenta.xls

  • Size

    192KB

  • MD5

    4b5efde48442f60d1563164c1e728061

  • SHA1

    f371b6ea0311f9175c78102e3a087ab5fc7fe687

  • SHA256

    8464e28250faf8cc3d316329b9b39cbc029659d93db9da3086ce9fc5e37bbcd1

  • SHA512

    cc18300b59ad15c59fd3dd96a88df4cb4526da5b7bb92dffd0c4fe6c616268d0de0197a59b2b403ae6f35d7e027137d7db6baa713e74c3401abd58b1d101cbd8

  • SSDEEP

    3072:PrxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAq3OLFyhxTchWwaZYwP+1oVET5K8lsq/:zxEtjPOtioVjDGUU1qfDlavx+W2QnAqE

Score
10/10
xenoratdiscoverymacromacro_on_actionrattrojan

Malware Config

Extracted

Family

xenorat

C2

dns.stipamana.com

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    12000

  • install_path

    appdata

  • port

    4567

  • startup_name

    mrec

Signatures

  • Detect XenoRat Payload 2 IoCs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat
  • Xenorat family
    xenorat
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Office macro that triggers on suspicious action 1 IoCs

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action
  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

    macro
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 19 IoCs
  • Suspicious use of WriteProcessMemory 59 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Estadodecuenta.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:824
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\PFLLTU.vbs"
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      PID:4820
  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3100
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4604
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3740
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1412
        • C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe
          "C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:908
          • C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe
            C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4844
          • C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe
            C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2384
          • C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe
            C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3164
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2904
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks.exe" /Create /TN "mrec" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6B2.tmp" /F
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:4908

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
    Filesize

    717B

    MD5

    822467b728b7a66b081c91795373789a

    SHA1

    d8f2f02e1eef62485a9feffd59ce837511749865

    SHA256

    af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

    SHA512

    bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\571AD299D4068543C8553D40E79010FA
    Filesize

    504B

    MD5

    7a1f814e2a871f3d16dcd5a88a4865f3

    SHA1

    bbb720fedc188a92c19b1303cf42551c4636b948

    SHA256

    da477890ff49815dce6931f9aeda5aeff9b36f548a891d820084e7256a077ee6

    SHA512

    87c5b06faa5f09504a78f057690a548aee5378058f0e4aa704132037e6092a67e57dba9f4a5a635b492378a280d55135ca6f5060ccd35596cde90f16ae12cea5

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
    Filesize

    471B

    MD5

    e81d1a452656da5266f453cb1a0fbcd4

    SHA1

    142b115501d7af306d8f887be66bc89e92e81521

    SHA256

    0a36be52eebc55142cc433203364f79cbe29bef5a6d0ce4bbf04fa41656de368

    SHA512

    4f782226101f3d628a7853c1ed828b16acd3fded03b3dc3329a68f3cf6f1c2c8a9748ff4abd5970c74244a7656eeafd2f3041743a8961ad0fced2843f2cbc987

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
    Filesize

    192B

    MD5

    0b53f9abf8198793e751cceefc8ba17c

    SHA1

    653d9a7340a1b1432151454138aa7687e5d21e9c

    SHA256

    033814335c495338557f655336712a7296312cfd1a1cf6a5220253a564584d56

    SHA512

    9e28e8e50e4a0cd62d32e87a1241cde5e65d4459cb919aaf9d295463ea5a70d74208e06e27b194062b6980edb12b474033873c8b1f9d38df891e8f8514e05ca8

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\571AD299D4068543C8553D40E79010FA
    Filesize

    550B

    MD5

    26f3ccb9510ec6b4180483a8c4f34681

    SHA1

    35a3b748810a9fa82fb052913b97f81a4d1a272c

    SHA256

    624d192fd230865cf8ec176ddd2a790e3f74c7e9c6116a5366b5754081aa4e16

    SHA512

    75d5ded475fdca54366d4b4568366b13cd4a5758a0e546e804345dac22fe6d88d782c9b96b88b1aa753be610b655d52fde97f43836cad2fb716cfaa0dbd4b451

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
    Filesize

    412B

    MD5

    7fb23a7763b9eb1d8193989e25c93fe1

    SHA1

    7d457fcae41d546fe145980709241463d998234e

    SHA256

    c79ddc812a7b611782ea060b984259dadb501efdf97d614d272c83a21131bc54

    SHA512

    e4c3a9b91ab0c90c50864d2e9b293278c209d3a50b0c0c2447e7e37e24c49b2831449ddaffd3c142844c96431bfcd0a5aca5127444fb8c297a24ed356fd3b401

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DNKFU.exe.log
    Filesize

    706B

    MD5

    d95c58e609838928f0f49837cab7dfd2

    SHA1

    55e7139a1e3899195b92ed8771d1ca2c7d53c916

    SHA256

    0407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339

    SHA512

    405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\02F9273C-77CB-4B56-9623-4D102C9A7FA3
    Filesize

    176KB

    MD5

    ee3a733992b66d1d5454cbb5c8edda82

    SHA1

    2de9b4df966b1f9096fa86901a160d6bb3a9439d

    SHA256

    07e3e52d3e9b5a959230d1c9d4231e21e6bf68ac0598c6eb8def4330bc3d63c3

    SHA512

    e98cd604906c0f25373aefddf62420f84ee07977fde9f7080deec70c5535dc3cc1cc5e66ae73a0c83e9d02e6d6731ae1ebfa1ea0566eb33de66584348f9c9144

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog
    Filesize

    10KB

    MD5

    f3b637a909ab303fa1d23bdadd5b6ba9

    SHA1

    cc31633826ec752feec9172f712d2b6a854506fc

    SHA256

    11c504b1cda6fcf507781dc59b1f4f72bc8f361356e93ee6a6048ba3f0d95127

    SHA512

    f803d3f1d3247bb055d887b50a13c94636fa91bec5a31dfd2099f6d325db07d4c276c69e195d6d3d31ab6fe79dc5e9acd1328e1ceb0fd3a1e17bc2c9e774d84c

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
    Filesize

    2KB

    MD5

    456ed4bb7e96221de98af9e6f0635696

    SHA1

    668a8c2429812023f914d6442fe455d8c27db3d8

    SHA256

    d710170861a402c2c2c6743ad25f9137f92a19dc53937087cb9556247cb9435c

    SHA512

    8f817a6d05c03d6917ff2939f1a54a3944867ecdebaa7c3e2b0efdb0385e4fdf0eb4f56aeccec8cb56665af028a5e60db9aace9e60d92fce271e9a771af973fe

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
    Filesize

    2KB

    MD5

    ff3c5f06ca982218b1313a3d90862b5e

    SHA1

    9c8d301825bf0e25a8b9411f2d6ff941f77d9e17

    SHA256

    b58aec3f01e6ef74e7d38bc7da046458acaec1fd1175a919dcde428e872e0093

    SHA512

    25c73508d401b78ffb71865efe3c97efc61db3b509f0f5c629e7128c2b4b9c715d9f4e7fc20f6f00a2329a97fcc8c95e01ce2c552a5247cea760a205d64c3a9c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Qj.doc
    Filesize

    193KB

    MD5

    ce24313f8b01015afc7d6f5e668bd703

    SHA1

    d86c8ee00b3f4db999a94557e7ae62ee2cd87c0e

    SHA256

    b7d50f4fb2342f63f86df5da89e7be2d3490adaccb37a5a6df2c1927c46aec60

    SHA512

    b5e1f7a31e22afdf20b6b206e3815613714758f091481e15f73ca371f2bccb6833fd4b50c4f53869a315948c0a2e94ad7cb1753a764b0d0d234b5f511bf7b710

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TCD6FA.tmp\sist02.xsl
    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmp6B2.tmp
    Filesize

    1KB

    MD5

    5c8fe4f5f1e1e45ed639b7c4c8c8ab0a

    SHA1

    f46c6596614c34e0dc0dd04b31b0d9863ed80d2e

    SHA256

    2bdd53d79e6397484b617c2c307d3b88e0e93e29546ef0dd7389614c1e7d3c20

    SHA512

    c1b2c9a3f452e3f7b09f9d3c76a37f86de76884e1a388f51ef41cc4a9a78a74504a03ea000fbe6204861e251a7bb2a0ddf4d6e0ac51ef184dd9d8c61e60ef9fe

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe
    Filesize

    174KB

    MD5

    da302f1f3b3f3a7df3dde94d870a2e22

    SHA1

    4c8e57bce883b2c2357065e95e4f4e1119d7b08d

    SHA256

    e84e765247bd6d7d756789ba7c07d61a12c2e265136e0ca65acdc919d4ca98bc

    SHA512

    0c4e38cb7387e647e2238cfd086c0122c12d9a9b9f827a56515722d4534a1ac3cc5a9c3e538095a696e84c52df1b7a75dd08a03a0e286cc79bdf398b2a93fdec

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\PFLLTU.vbs
    Filesize

    10KB

    MD5

    c818cba07e014f95bcf8b133eaba0ee6

    SHA1

    83852a470bf54205d59cf40675034f2129a10771

    SHA256

    6b30fade6f3a26071148b661172fb9d8976c5d1d890a407bd06b5a4ae801b9b3

    SHA512

    c718d0d1d43d7b36f6b3988d5e7de327d14f9d94ae43b62d7a5169c7580b57fbb83e49c2cb209e0328f748668a554878a083a763639b640806f4addd9430e78b

    Download Submit

  • memory/824-17-0x00007FFACA290000-0x00007FFACA485000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/824-109-0x00007FFACA290000-0x00007FFACA485000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/824-15-0x00007FFACA290000-0x00007FFACA485000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/824-13-0x00007FFACA290000-0x00007FFACA485000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/824-35-0x00007FFACA290000-0x00007FFACA485000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/824-36-0x00007FFACA290000-0x00007FFACA485000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/824-42-0x00007FFACA290000-0x00007FFACA485000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/824-41-0x00007FFACA290000-0x00007FFACA485000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/824-18-0x00007FFACA290000-0x00007FFACA485000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/824-16-0x00007FFA87C70000-0x00007FFA87C80000-memory.dmp

    Filesize

    64KB

    Download

  • memory/824-0-0x00007FFA8A310000-0x00007FFA8A320000-memory.dmp

    Filesize

    64KB

    Download

  • memory/824-14-0x00007FFACA290000-0x00007FFACA485000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/824-8-0x00007FFACA290000-0x00007FFACA485000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/824-11-0x00007FFA87C70000-0x00007FFA87C80000-memory.dmp

    Filesize

    64KB

    Download

  • memory/824-12-0x00007FFACA290000-0x00007FFACA485000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/824-10-0x00007FFACA290000-0x00007FFACA485000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/824-9-0x00007FFACA290000-0x00007FFACA485000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/824-7-0x00007FFA8A310000-0x00007FFA8A320000-memory.dmp

    Filesize

    64KB

    Download

  • memory/824-5-0x00007FFACA290000-0x00007FFACA485000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/824-19-0x00007FFACA290000-0x00007FFACA485000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/824-2-0x00007FFA8A310000-0x00007FFA8A320000-memory.dmp

    Filesize

    64KB

    Download

  • memory/824-3-0x00007FFA8A310000-0x00007FFA8A320000-memory.dmp

    Filesize

    64KB

    Download

  • memory/824-1-0x00007FFACA32D000-0x00007FFACA32E000-memory.dmp

    Filesize

    4KB

    Download

  • memory/824-4-0x00007FFA8A310000-0x00007FFA8A320000-memory.dmp

    Filesize

    64KB

    Download

  • memory/824-149-0x00007FFACA290000-0x00007FFACA485000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/824-148-0x00007FFACA290000-0x00007FFACA485000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/824-118-0x00007FFACA290000-0x00007FFACA485000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/824-147-0x00007FFACA290000-0x00007FFACA485000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/824-116-0x00007FFACA32D000-0x00007FFACA32E000-memory.dmp

    Filesize

    4KB

    Download

  • memory/824-6-0x00007FFACA290000-0x00007FFACA485000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2904-273-0x0000000005C90000-0x0000000005CF6000-memory.dmp

    Filesize

    408KB

    Download

  • memory/2904-274-0x0000000005C60000-0x0000000005C6A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/3740-119-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

    Download

  • memory/4604-117-0x00000000051E0000-0x00000000051E6000-memory.dmp

    Filesize

    24KB

    Download

  • memory/4604-115-0x000000000E2A0000-0x000000000E332000-memory.dmp

    Filesize

    584KB

    Download

  • memory/4604-114-0x000000000E850000-0x000000000EDF4000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/4604-113-0x000000000E200000-0x000000000E29C000-memory.dmp

    Filesize

    624KB

    Download

  • memory/4604-112-0x0000000005790000-0x00000000057C4000-memory.dmp

    Filesize

    208KB

    Download

  • memory/4604-111-0x0000000001690000-0x0000000001696000-memory.dmp

    Filesize

    24KB

    Download

  • memory/4604-110-0x0000000000DE0000-0x0000000000E10000-memory.dmp

    Filesize

    192KB

    Download