Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 17:10
Behavioral task
behavioral1
Sample
GERTGEWSRG.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
GERTGEWSRG.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
GERTGEWSRG.exe
Resource
android-x64-20240624-en
android-10-x64
General
-
Target
GERTGEWSRG.exe
-
Size
45KB
-
MD5
a899ac5a3deacb376283e19b5473f0c6
-
SHA1
0eea6b2835d2eb3bbd047c76bc21929dea157e47
-
SHA256
05c89adfb97d0bc4b3edb18498844a9ccb013161b8034f2946eddedf44ad9407
-
SHA512
bc3561e3474087d88abb1ea137b4688550afa93f0046f69af41ccd34e77ac0f10937194e1ad1f6ea44edc30215f1e9fa47b6dce945b944811a74a290702f6208
-
SSDEEP
768:pdhO/poiiUcjlJIndbqmH9Xqk5nWEZ5SbTDafWI7CPW5x:nw+jjgnNH9XqcnW85SbTuWIp
Malware Config
Extracted
xenorat
127.0.0.1
Xeno_rat_nd8912d
-
delay
1
-
install_path
appdata
-
port
8888
-
startup_name
Windows
Signatures
-
Detect XenoRat Payload 2 IoCs
resource yara_rule behavioral2/memory/3136-1-0x0000000000F40000-0x0000000000F52000-memory.dmp family_xenorat behavioral2/files/0x000b000000023b68-6.dat family_xenorat -
Xenorat family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation GERTGEWSRG.exe -
Executes dropped EXE 1 IoCs
pid Process 4920 GERTGEWSRG.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GERTGEWSRG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GERTGEWSRG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3864 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1948 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1948 taskmgr.exe Token: SeSystemProfilePrivilege 1948 taskmgr.exe Token: SeCreateGlobalPrivilege 1948 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3136 wrote to memory of 4920 3136 GERTGEWSRG.exe 83 PID 3136 wrote to memory of 4920 3136 GERTGEWSRG.exe 83 PID 3136 wrote to memory of 4920 3136 GERTGEWSRG.exe 83 PID 4920 wrote to memory of 3864 4920 GERTGEWSRG.exe 84 PID 4920 wrote to memory of 3864 4920 GERTGEWSRG.exe 84 PID 4920 wrote to memory of 3864 4920 GERTGEWSRG.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\GERTGEWSRG.exe"C:\Users\Admin\AppData\Local\Temp\GERTGEWSRG.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Roaming\XenoManager\GERTGEWSRG.exe"C:\Users\Admin\AppData\Roaming\XenoManager\GERTGEWSRG.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "Windows" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7918.tmp" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3864
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1948
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
Filesize
1KB
MD58bc510bb2e1cba73d463cc2f904ba444
SHA1f1417e4904e78fb89cf15ac088b13070f3846ae5
SHA25631153e237a1c719b72bb844652139e6c2adb847523074323092865250ee3f3e7
SHA51244c2e1d63c69d89b6606e82ca2b066d7b7096f8fddbd1257ed4f3566bb46559858618806d075f4fdc20da1fae5862cedf8890c3ca16f3b541fb8c4c5a0378c42
-
Filesize
45KB
MD5a899ac5a3deacb376283e19b5473f0c6
SHA10eea6b2835d2eb3bbd047c76bc21929dea157e47
SHA25605c89adfb97d0bc4b3edb18498844a9ccb013161b8034f2946eddedf44ad9407
SHA512bc3561e3474087d88abb1ea137b4688550afa93f0046f69af41ccd34e77ac0f10937194e1ad1f6ea44edc30215f1e9fa47b6dce945b944811a74a290702f6208