Overview

overview

10

Static

static

8

ad58a77911...0a.xls

windows7-x64

10

ad58a77911...0a.xls

windows10-2004-x64

10

Analysis

  • max time kernel
    59s
  • max time network
    60s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-12-2024 21:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ad58a779119b226a8f322acfc28bb19997def17a0c4a3f17ab4c57d83269650a.xls

  • Size

    192KB

  • MD5

    6917e598649923e5cf22957e24caffa4

  • SHA1

    6365e7abd6413cec0f51ff997cdba24e263ccbe4

  • SHA256

    ad58a779119b226a8f322acfc28bb19997def17a0c4a3f17ab4c57d83269650a

  • SHA512

    d5c3b9b7ab59a0ac8d94205a7748a06b194d6bd2921ee6fd799306d4802fd5b785aaf31cf422c9dfa4d671571729d10bbfdcea4cba37088cfc7cc88e0671552d

  • SSDEEP

    3072:DrxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAq3OLFyhxTchWwaZYwP+1oVET5K8lsq/:nxEtjPOtioVjDGUU1qfDlavx+W2QnAqE

Score
10/10
xenoratdiscoverymacromacro_on_actionrattrojan

Malware Config

Extracted

Family

xenorat

C2

dns.stipamana.com

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    12000

  • install_path

    appdata

  • port

    4567

  • startup_name

    mrec

Signatures

  • Detect XenoRat Payload 1 IoCs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat
  • Xenorat family
    xenorat
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Office macro that triggers on suspicious action 1 IoCs

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action
  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

    macro
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 21 IoCs
  • Suspicious use of WriteProcessMemory 59 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ad58a779119b226a8f322acfc28bb19997def17a0c4a3f17ab4c57d83269650a.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:396
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\PFLLTU.vbs"
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      PID:4300
  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4964
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2200
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:760
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks.exe" /Create /TN "mrec" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCDB0.tmp" /F
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:3636
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1412
        • C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
          "C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2592
          • C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
            C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4988
          • C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
            C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1968
          • C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
            C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
            5⤵
            • Executes dropped EXE
            PID:784
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 784 -s 80
              6⤵
              • Program crash
              PID:4408
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4656
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 784 -ip 784
    1⤵
      PID:4192

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
      Filesize

      717B

      MD5

      822467b728b7a66b081c91795373789a

      SHA1

      d8f2f02e1eef62485a9feffd59ce837511749865

      SHA256

      af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

      SHA512

      bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5EC004B7FD8CB72D80A747F531B799BC
      Filesize

      504B

      MD5

      468c10fe6e033605fdc3eb77dac1a0b9

      SHA1

      f2afc12dc5c537c067334987f42d0e23457d50ae

      SHA256

      6f1ccbff6df00d9812182caa9e98b2ceea1f056527efff69f28f38b1fac8b817

      SHA512

      7e08a6d72c7d809edd92fe4560008f69fd98d2f0d802bea341acb6ef6fb7beb073e953b838a735761ea0d081749982bb16426e322923596feed78d08ad79e77d

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
      Filesize

      471B

      MD5

      e81d1a452656da5266f453cb1a0fbcd4

      SHA1

      142b115501d7af306d8f887be66bc89e92e81521

      SHA256

      0a36be52eebc55142cc433203364f79cbe29bef5a6d0ce4bbf04fa41656de368

      SHA512

      4f782226101f3d628a7853c1ed828b16acd3fded03b3dc3329a68f3cf6f1c2c8a9748ff4abd5970c74244a7656eeafd2f3041743a8961ad0fced2843f2cbc987

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
      Filesize

      192B

      MD5

      a481b67e8df7aa67d43362b4e2f7d704

      SHA1

      61c59ad5ed40fa3dbf5ab2e1570f7795f71e694b

      SHA256

      0c37ad033da3a2fad2e47f91110bbb48fe5ee0205205d401fcf06c1c18d9b407

      SHA512

      1d7fff182a0fcf05eb6ae26bd74f4212c6890e791fae01f6c3efe38e4bc98aadabb1b4db798d0a581b2b5410dc399fe24d6a5a9e2ad403157e5fec9b37355ef9

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5EC004B7FD8CB72D80A747F531B799BC
      Filesize

      546B

      MD5

      aebbe40ef668316003f84b3ec34cdbb2

      SHA1

      30c1c70ac27af855c584c3a625f7b758193cf9b4

      SHA256

      3ec413f7e44d729d8b619db58852e45f588b01281354a7b9dfbe5f845d8e3b76

      SHA512

      6f37a1419f990181b833deab603656758439e644bdc31384cbf68a2625ea1da35c7f5b3621ab6e5c42a022eea3ac33fd1bcec6f67015b1e78089ec0104f6935b

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
      Filesize

      412B

      MD5

      bcb50fac78c50d0d5f1ac517c93920a5

      SHA1

      60436db795d371f4b9c8fd307ef93091c4d289c7

      SHA256

      d38cb1fa09ed15855256bcaa532e23261a6498b411599ca7e3796896a9bad0cc

      SHA512

      f2593f3c54925f639a8a4fb1b24a2ee30eefcc6b35842e6214e272aba1cc38d0f4e8dd7c46d37b5765ce2af51514102324b705de673bf32a77d345a826d8709e

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\GFKMTE.exe.log
      Filesize

      706B

      MD5

      d95c58e609838928f0f49837cab7dfd2

      SHA1

      55e7139a1e3899195b92ed8771d1ca2c7d53c916

      SHA256

      0407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339

      SHA512

      405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\AB7DA7C1-CCBA-4153-AA04-69B4E5FA8E48
      Filesize

      176KB

      MD5

      429a0d3d3bf29929cd1341eb30099a7e

      SHA1

      c245ada30b72844e1253ade51edde7da533ec9ce

      SHA256

      7e9d31938a1800f8d90b0c05fcc7a351cbad367b64b25b129cacf9c3b62416e3

      SHA512

      974bd8598e59425fca03edd02f818d3051ebb5fcf10b7afc107474a03c242592255beef2004d8faf60d343bdefcf651811c1bacb81f2f9a5581a143cd2af794a

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog
      Filesize

      10KB

      MD5

      6d0b7d17a386ed150dcd9ad2836161e7

      SHA1

      109a9eb7b4b53a5f5705b8a01248b2ce9005f48f

      SHA256

      e7650175b7bb2c49e74be8f2b162f11b7e8b9845b6f7ce2ea610223e2bb89449

      SHA512

      ae4321f921e9a3eba8c4b162150c2ae95a46a71aece9c3f1c3a8301cd4f4f2f95a7fa15213729a8d495a18ce8c99366772af8333039f0e8c987fa075516d2ab9

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
      Filesize

      2KB

      MD5

      cc7c748d75ebabbbe7d1b0c9d39bf029

      SHA1

      6e8144cb8b7f7d0573ecd8a991e315726fa9c6f4

      SHA256

      bb3a16ffa02a8d964fed91d8a1c7eb587731dec6ec08eeb6ad48aef625289302

      SHA512

      39f152d7fe8592f448bf887309c7558f77b1015cc884b15232d2898a1a2eb64aa45eb8200676abedb93d4f3013ac759e847de8dbc457d1cd573f6359f0c530d9

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
      Filesize

      2KB

      MD5

      98e10a4834b46a2814ca0253cf5b2cdc

      SHA1

      1cf9ecee04aab640c64c21a05784c32b538f96f9

      SHA256

      b97a97129cbeb1f768930c3ed7b2c13bfd097e4852c65f837f04392bdfa6b08a

      SHA512

      5d5cd793854dbf6cd038dc75a4d5ec38f8a347b560ff32e55447c4dc2cb43793e0459c63be2e6f7fbcf420918f6e21d114836a203d8aee2abe0aaefc94284b3d

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\TCDD169.tmp\sist02.xsl
      Filesize

      245KB

      MD5

      f883b260a8d67082ea895c14bf56dd56

      SHA1

      7954565c1f243d46ad3b1e2f1baf3281451fc14b

      SHA256

      ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

      SHA512

      d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\¸¸.doc
      Filesize

      195KB

      MD5

      7ea9da3dd3db6f3fadf04ac76b54434b

      SHA1

      b30b950191046d999e71aaa54fb2648c6655ce9b

      SHA256

      947bce97211371e730a2b8b79c2ec4d154904e8faa7bed2583c5c6c420230170

      SHA512

      f94eb382dedb8c3952dbc0f3b9040201455cec641c845bedf5765a2772aa98cb20d92b3e0edadcd92fd7cdb77e7c6f37d26bdd276cceea733237e28f04240f9d

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
      Filesize

      16B

      MD5

      d29962abc88624befc0135579ae485ec

      SHA1

      e40a6458296ec6a2427bcb280572d023a9862b31

      SHA256

      a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

      SHA512

      4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
      Filesize

      1KB

      MD5

      cc40a6eae97c5cdd7a7703ce942ccd3d

      SHA1

      8d949d56d96f6e97707effbc24e07fe2c3fdfb69

      SHA256

      40659bcf06073bc4b2c45b47460555e023593b150d1cd85426379f0e149125f6

      SHA512

      f4debf6fc2b104dee278ae07990cb99ed897b4a8ca44823219bb076c403298ab69b1cf5738dc9f89a3dcb4adf6a94e771546e7f0bc038753eef43b61c5c49fdb

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
      Filesize

      166KB

      MD5

      57fcc042b0f7783567878d217ae69e25

      SHA1

      83032ec361ea8b15ef956536999b754db6a12423

      SHA256

      13bd3ee226114db8e18f2fe414a7e2c4e0937eda7d8a02b2efebaa2af8238564

      SHA512

      4fe2ce713333d9a16d65ca5ccdc3a2e687b84a58b6b1e43b43c3f508edb2cc04478a5595efc43202decf7f86b50fd43382246fbc12553117a9177fb13d987b67

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\PFLLTU.vbs
      Filesize

      10KB

      MD5

      087bcef76143b81090deef4ee4679995

      SHA1

      6ebd4fd212d0583157ae03bb0eb5841c53e281fc

      SHA256

      87334eb3f39cffdfeed453f67a7c338fe378b75c49946451ca1a0e4e151bba00

      SHA512

      b2f93705760d4d1cf5fe0ac354100916d16b6c4fd62117254238a600aabe6257fc791f1ce498bd2d0cfdd47e19f304dc5a68a06b7958658f34859afaa582ed4d

      Download Submit

    • memory/396-12-0x00007FFCF3870000-0x00007FFCF3A65000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/396-5-0x00007FFCF3870000-0x00007FFCF3A65000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/396-30-0x00007FFCF3870000-0x00007FFCF3A65000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/396-24-0x00007FFCF3870000-0x00007FFCF3A65000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/396-25-0x00007FFCF3870000-0x00007FFCF3A65000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/396-13-0x00007FFCB16F0000-0x00007FFCB1700000-memory.dmp

      Filesize

      64KB

      Download

    • memory/396-3-0x00007FFCB38F0000-0x00007FFCB3900000-memory.dmp

      Filesize

      64KB

      Download

    • memory/396-10-0x00007FFCF3870000-0x00007FFCF3A65000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/396-11-0x00007FFCB16F0000-0x00007FFCB1700000-memory.dmp

      Filesize

      64KB

      Download

    • memory/396-9-0x00007FFCF3870000-0x00007FFCF3A65000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/396-8-0x00007FFCF3870000-0x00007FFCF3A65000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/396-7-0x00007FFCF3870000-0x00007FFCF3A65000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/396-122-0x00007FFCF3870000-0x00007FFCF3A65000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/396-2-0x00007FFCB38F0000-0x00007FFCB3900000-memory.dmp

      Filesize

      64KB

      Download

    • memory/396-4-0x00007FFCB38F0000-0x00007FFCB3900000-memory.dmp

      Filesize

      64KB

      Download

    • memory/396-1-0x00007FFCF390D000-0x00007FFCF390E000-memory.dmp

      Filesize

      4KB

      Download

    • memory/396-172-0x00007FFCF3870000-0x00007FFCF3A65000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/396-0-0x00007FFCB38F0000-0x00007FFCB3900000-memory.dmp

      Filesize

      64KB

      Download

    • memory/396-166-0x00007FFCF3870000-0x00007FFCF3A65000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/396-165-0x00007FFCF3870000-0x00007FFCF3A65000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/396-31-0x00007FFCF3870000-0x00007FFCF3A65000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/396-6-0x00007FFCB38F0000-0x00007FFCB3900000-memory.dmp

      Filesize

      64KB

      Download

    • memory/396-148-0x00007FFCF3870000-0x00007FFCF3A65000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/396-147-0x00007FFCF390D000-0x00007FFCF390E000-memory.dmp

      Filesize

      4KB

      Download

    • memory/760-131-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

      Download

    • memory/2200-130-0x0000000002700000-0x0000000002706000-memory.dmp

      Filesize

      24KB

      Download

    • memory/2200-129-0x0000000004F20000-0x0000000004FB2000-memory.dmp

      Filesize

      584KB

      Download

    • memory/2200-128-0x00000000097B0000-0x0000000009D54000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/2200-127-0x0000000004C80000-0x0000000004D1C000-memory.dmp

      Filesize

      624KB

      Download

    • memory/2200-126-0x0000000000DC0000-0x0000000000DF2000-memory.dmp

      Filesize

      200KB

      Download

    • memory/2200-125-0x0000000000D80000-0x0000000000D86000-memory.dmp

      Filesize

      24KB

      Download

    • memory/2200-124-0x0000000000260000-0x0000000000290000-memory.dmp

      Filesize

      192KB

      Download

    • memory/2592-152-0x0000000004A50000-0x0000000004A82000-memory.dmp

      Filesize

      200KB

      Download