Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
11-12-2024 09:47
Behavioral task
behavioral1
Sample
ec6627e48bb4c56abbb2a4563072e631.doc
Resource
win7-20241023-en
General
-
Target
ec6627e48bb4c56abbb2a4563072e631.doc
-
Size
191KB
-
MD5
ec6627e48bb4c56abbb2a4563072e631
-
SHA1
9e237643473c67940eb359bba09825114c7bc726
-
SHA256
548212f42d5dc4965db354d6ce075422dcb3331a213fb0b5b662e08e59234829
-
SHA512
4fb47dcf9e0fe13e038a88cc8c9e06ff1dde996d69281c505a07c3d4cc591e32770c1df8dac3da8d031f4868073ebde8202a7173dfd369b016aa2c69af2385a3
-
SSDEEP
3072:Q877VGZ5Sd3b4e0wNZtsqXNKd5AvDJW4S+I/tZ6X1bpF6m+3b:9GZYwAZHMCDJ8/u5pAm0b
Malware Config
Extracted
xenorat
dns.stipamana.com
Xeno_rat_nd8912d
-
delay
12000
-
install_path
appdata
-
port
4567
-
startup_name
mrec
Signatures
-
Detect XenoRat Payload 3 IoCs
resource yara_rule behavioral1/memory/872-64-0x0000000000400000-0x0000000000412000-memory.dmp family_xenorat behavioral1/memory/872-68-0x0000000000400000-0x0000000000412000-memory.dmp family_xenorat behavioral1/memory/872-66-0x0000000000400000-0x0000000000412000-memory.dmp family_xenorat -
Xenorat family
-
Downloads MZ/PE file
-
Executes dropped EXE 8 IoCs
pid Process 2892 RUSYZH.exe 872 RUSYZH.exe 2140 RUSYZH.exe 1092 RUSYZH.exe 2384 RUSYZH.exe 1244 RUSYZH.exe 804 RUSYZH.exe 1720 RUSYZH.exe -
Loads dropped DLL 5 IoCs
pid Process 596 WINWORD.EXE 596 WINWORD.EXE 596 WINWORD.EXE 596 WINWORD.EXE 2140 RUSYZH.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 2892 set thread context of 2140 2892 RUSYZH.exe 34 PID 2892 set thread context of 872 2892 RUSYZH.exe 35 PID 2892 set thread context of 1092 2892 RUSYZH.exe 36 PID 2384 set thread context of 1244 2384 RUSYZH.exe 38 PID 2384 set thread context of 804 2384 RUSYZH.exe 39 PID 2384 set thread context of 1720 2384 RUSYZH.exe 40 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUSYZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUSYZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUSYZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUSYZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUSYZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUSYZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUSYZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUSYZH.exe -
Office loads VBA resources, possible macro or embedded object present
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2464 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 596 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe 1092 RUSYZH.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2892 RUSYZH.exe Token: SeDebugPrivilege 2384 RUSYZH.exe Token: SeDebugPrivilege 1092 RUSYZH.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 596 WINWORD.EXE 596 WINWORD.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 596 wrote to memory of 2892 596 WINWORD.EXE 31 PID 596 wrote to memory of 2892 596 WINWORD.EXE 31 PID 596 wrote to memory of 2892 596 WINWORD.EXE 31 PID 596 wrote to memory of 2892 596 WINWORD.EXE 31 PID 2892 wrote to memory of 2140 2892 RUSYZH.exe 34 PID 2892 wrote to memory of 2140 2892 RUSYZH.exe 34 PID 2892 wrote to memory of 2140 2892 RUSYZH.exe 34 PID 2892 wrote to memory of 2140 2892 RUSYZH.exe 34 PID 2892 wrote to memory of 2140 2892 RUSYZH.exe 34 PID 2892 wrote to memory of 2140 2892 RUSYZH.exe 34 PID 2892 wrote to memory of 2140 2892 RUSYZH.exe 34 PID 2892 wrote to memory of 2140 2892 RUSYZH.exe 34 PID 2892 wrote to memory of 2140 2892 RUSYZH.exe 34 PID 2892 wrote to memory of 872 2892 RUSYZH.exe 35 PID 2892 wrote to memory of 872 2892 RUSYZH.exe 35 PID 2892 wrote to memory of 872 2892 RUSYZH.exe 35 PID 2892 wrote to memory of 872 2892 RUSYZH.exe 35 PID 2892 wrote to memory of 872 2892 RUSYZH.exe 35 PID 2892 wrote to memory of 872 2892 RUSYZH.exe 35 PID 2892 wrote to memory of 872 2892 RUSYZH.exe 35 PID 2892 wrote to memory of 872 2892 RUSYZH.exe 35 PID 2892 wrote to memory of 872 2892 RUSYZH.exe 35 PID 2892 wrote to memory of 1092 2892 RUSYZH.exe 36 PID 2892 wrote to memory of 1092 2892 RUSYZH.exe 36 PID 2892 wrote to memory of 1092 2892 RUSYZH.exe 36 PID 2892 wrote to memory of 1092 2892 RUSYZH.exe 36 PID 2892 wrote to memory of 1092 2892 RUSYZH.exe 36 PID 2892 wrote to memory of 1092 2892 RUSYZH.exe 36 PID 2892 wrote to memory of 1092 2892 RUSYZH.exe 36 PID 2892 wrote to memory of 1092 2892 RUSYZH.exe 36 PID 2892 wrote to memory of 1092 2892 RUSYZH.exe 36 PID 2140 wrote to memory of 2384 2140 RUSYZH.exe 37 PID 2140 wrote to memory of 2384 2140 RUSYZH.exe 37 PID 2140 wrote to memory of 2384 2140 RUSYZH.exe 37 PID 2140 wrote to memory of 2384 2140 RUSYZH.exe 37 PID 2384 wrote to memory of 1244 2384 RUSYZH.exe 38 PID 2384 wrote to memory of 1244 2384 RUSYZH.exe 38 PID 2384 wrote to memory of 1244 2384 RUSYZH.exe 38 PID 2384 wrote to memory of 1244 2384 RUSYZH.exe 38 PID 2384 wrote to memory of 1244 2384 RUSYZH.exe 38 PID 2384 wrote to memory of 1244 2384 RUSYZH.exe 38 PID 2384 wrote to memory of 1244 2384 RUSYZH.exe 38 PID 2384 wrote to memory of 1244 2384 RUSYZH.exe 38 PID 2384 wrote to memory of 1244 2384 RUSYZH.exe 38 PID 2384 wrote to memory of 804 2384 RUSYZH.exe 39 PID 2384 wrote to memory of 804 2384 RUSYZH.exe 39 PID 2384 wrote to memory of 804 2384 RUSYZH.exe 39 PID 2384 wrote to memory of 804 2384 RUSYZH.exe 39 PID 2384 wrote to memory of 804 2384 RUSYZH.exe 39 PID 2384 wrote to memory of 804 2384 RUSYZH.exe 39 PID 2384 wrote to memory of 804 2384 RUSYZH.exe 39 PID 2384 wrote to memory of 804 2384 RUSYZH.exe 39 PID 2384 wrote to memory of 804 2384 RUSYZH.exe 39 PID 2384 wrote to memory of 1720 2384 RUSYZH.exe 40 PID 2384 wrote to memory of 1720 2384 RUSYZH.exe 40 PID 2384 wrote to memory of 1720 2384 RUSYZH.exe 40 PID 2384 wrote to memory of 1720 2384 RUSYZH.exe 40 PID 2384 wrote to memory of 1720 2384 RUSYZH.exe 40 PID 2384 wrote to memory of 1720 2384 RUSYZH.exe 40 PID 2384 wrote to memory of 1720 2384 RUSYZH.exe 40 PID 2384 wrote to memory of 1720 2384 RUSYZH.exe 40 PID 2384 wrote to memory of 1720 2384 RUSYZH.exe 40 PID 596 wrote to memory of 3048 596 WINWORD.EXE 41 PID 596 wrote to memory of 3048 596 WINWORD.EXE 41
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ec6627e48bb4c56abbb2a4563072e631.doc"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\RUSYZH.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\RUSYZH.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\RUSYZH.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\RUSYZH.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Roaming\UpdateManager\RUSYZH.exe"C:\Users\Admin\AppData\Roaming\UpdateManager\RUSYZH.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Roaming\UpdateManager\RUSYZH.exeC:\Users\Admin\AppData\Roaming\UpdateManager\RUSYZH.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1244
-
-
C:\Users\Admin\AppData\Roaming\UpdateManager\RUSYZH.exeC:\Users\Admin\AppData\Roaming\UpdateManager\RUSYZH.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:804
-
-
C:\Users\Admin\AppData\Roaming\UpdateManager\RUSYZH.exeC:\Users\Admin\AppData\Roaming\UpdateManager\RUSYZH.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1720
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\RUSYZH.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\RUSYZH.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:872
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\RUSYZH.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\RUSYZH.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1092 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "mrec" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF91E.tmp" /F4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2464
-
-
-
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:3048
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD59d9df2517964d8e049d41515f0d287c3
SHA12cf5f49554bbf0b73930d06b07e2bf12638d60b7
SHA25603cddeda34c46e3bc77be33a37ae97dea02f4a2d6a8e4c3d208ca2bfa5bf242f
SHA512807e30b096381211eebc6399bf879ce6f6aca5e0659a458403d4207f845c42f6a5f40eae8d00d94ad99917d94e4384e407428cd2f1c6837f9e8b12918f85c031
-
Filesize
134KB
MD5c5782fb8a119d6092f4816b8b39b5fa0
SHA168f2f0c4884168f1d775a6fc0f550150176ec402
SHA256963bb7cbfda00f3033cfed5058521b0a4a42f797cc0e7473b0008ac1416e30e8
SHA512d0809b3e54024cf08af7548525732d642a7ca00b0e8d30310377b4c9e74cc302c3ab926688da7776beabc055ed5bd5ef56d25e82e19e2ea3b6be08ffee214fe3