Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15-12-2024 12:57
Behavioral task
behavioral1
Sample
ruleaza.exe
Resource
win7-20240708-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
ruleaza.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral3
Sample
ruleaza.exe
Resource
android-x64-20240624-en
android-10-x64
0 signatures
150 seconds
General
-
Target
ruleaza.exe
-
Size
60KB
-
MD5
bc8dd3bc1e1c0dc28e40898a6cb1e8d4
-
SHA1
873efbf4b0461a252eb88b61113511211cfe4b4c
-
SHA256
4154a155effa00a21a92bc505e79d666227a04a572dcd3f0a1c09ad99d9bb1ed
-
SHA512
f61e8c0dbce599e5af66403a249269b27a950263aa22059962bedd171eb199540f5e72258b29bf150dbf0a5ec54b2db3c86a670d367658fde2874c141cf638b4
-
SSDEEP
768:pdhO/poiiUcjlJInLVH9Xqk5nWEZ5SbTDaLuI7CPW5WdxelsWNRPZ:nw+jjgnxH9XqcnW85SbTGuIZtNRZ
Malware Config
Extracted
Family
xenorat
C2
127.0.0.1
Mutex
Xeno_rat_nd8912d
Attributes
-
delay
5000
-
install_path
appdata
-
port
4782
-
startup_name
niggas
Signatures
-
Detect XenoRat Payload 2 IoCs
resource yara_rule behavioral2/memory/3960-1-0x0000000000420000-0x0000000000436000-memory.dmp family_xenorat behavioral2/files/0x000b000000023b93-6.dat family_xenorat -
Xenorat family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation ruleaza.exe -
Executes dropped EXE 1 IoCs
pid Process 3912 ruleaza.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ruleaza.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ruleaza.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4736 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1712 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1712 taskmgr.exe Token: SeSystemProfilePrivilege 1712 taskmgr.exe Token: SeCreateGlobalPrivilege 1712 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe 1712 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3960 wrote to memory of 3912 3960 ruleaza.exe 84 PID 3960 wrote to memory of 3912 3960 ruleaza.exe 84 PID 3960 wrote to memory of 3912 3960 ruleaza.exe 84 PID 3912 wrote to memory of 4736 3912 ruleaza.exe 86 PID 3912 wrote to memory of 4736 3912 ruleaza.exe 86 PID 3912 wrote to memory of 4736 3912 ruleaza.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\ruleaza.exe"C:\Users\Admin\AppData\Local\Temp\ruleaza.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Roaming\XenoManager\ruleaza.exe"C:\Users\Admin\AppData\Roaming\XenoManager\ruleaza.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "niggas" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC728.tmp" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4736
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1712
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a5469ec27df2d2a777bafe0af4dd2869
SHA1a3d57a7f472aca20044193823421ffc74d00ee4b
SHA256cfe4c592f25d99d12fffdd94b5c14cd921434607ce0c028cfcd82b19e64e646f
SHA512593de9c1e241535d3ebebcb900114069d44175acbfef0c23191542c99c8cb9916258e99e17adf871ee7897f9c69cb92fe00a9873bdcea28d6af9703acadae25a
-
Filesize
60KB
MD5bc8dd3bc1e1c0dc28e40898a6cb1e8d4
SHA1873efbf4b0461a252eb88b61113511211cfe4b4c
SHA2564154a155effa00a21a92bc505e79d666227a04a572dcd3f0a1c09ad99d9bb1ed
SHA512f61e8c0dbce599e5af66403a249269b27a950263aa22059962bedd171eb199540f5e72258b29bf150dbf0a5ec54b2db3c86a670d367658fde2874c141cf638b4