Analysis
-
max time kernel
149s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 17:24
Behavioral task
behavioral1
Sample
serrteter.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral2
Sample
serrteter.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
serrteter.exe
Resource
android-x64-20240624-en
android-10-x64
General
-
Target
serrteter.exe
-
Size
45KB
-
MD5
369a6ea15eb8ebde64fc1e043ad44382
-
SHA1
7f45dbf3268ec3bbfdd06c2086294b26d9beebac
-
SHA256
b543df56136a5f5cab011ce1d88dd866aa47578c37bf5edab19db2c3d8c4e771
-
SHA512
d88c224419abefae5da3ea3cb4b479c1bd1063a70ad3659d138886e194aca5a82e124e6dc74e108501fbbb0cdcd58c0bf9f8b53330e00a7bc74e978f1ac58533
-
SSDEEP
768:FdhO/poiiUcjlJInazH9Xqk5nWEZ5SbTDa+WI7CPW5N:bw+jjgnYH9XqcnW85SbTPWIF
Malware Config
Extracted
xenorat
0.0.0.0
Xeno_rat_nd8912d
-
delay
1
-
install_path
appdata
-
port
8888
-
startup_name
Windows
Signatures
-
Detect XenoRat Payload 2 IoCs
resource yara_rule behavioral2/memory/3752-1-0x0000000000AE0000-0x0000000000AF2000-memory.dmp family_xenorat behavioral2/files/0x0007000000023ca0-6.dat family_xenorat -
Xenorat family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation serrteter.exe -
Executes dropped EXE 1 IoCs
pid Process 3084 serrteter.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language serrteter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language serrteter.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4324 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1108 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1108 taskmgr.exe Token: SeSystemProfilePrivilege 1108 taskmgr.exe Token: SeCreateGlobalPrivilege 1108 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe 1108 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3752 wrote to memory of 3084 3752 serrteter.exe 83 PID 3752 wrote to memory of 3084 3752 serrteter.exe 83 PID 3752 wrote to memory of 3084 3752 serrteter.exe 83 PID 3084 wrote to memory of 4324 3084 serrteter.exe 84 PID 3084 wrote to memory of 4324 3084 serrteter.exe 84 PID 3084 wrote to memory of 4324 3084 serrteter.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\serrteter.exe"C:\Users\Admin\AppData\Local\Temp\serrteter.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Roaming\XenoManager\serrteter.exe"C:\Users\Admin\AppData\Roaming\XenoManager\serrteter.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "Windows" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA846.tmp" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4324
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1108
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
Filesize
1KB
MD579b13ab7e7c490fbdcc8d5bacb4dd5b6
SHA12acf0c440abd9593318dfb9c155a517d24eb5e5b
SHA2563764851eba7ab072cb22d8bd9a1723624a27fd164278f39bb94b966c433789fc
SHA5127997a5a238daf7d519f103b3cdfdf3d67dfef13a1d49d6493dcd7086870429e34744034aaed6b090f563674af769329dc705de35d1f9c081f2b1afe3623efada
-
Filesize
45KB
MD5369a6ea15eb8ebde64fc1e043ad44382
SHA17f45dbf3268ec3bbfdd06c2086294b26d9beebac
SHA256b543df56136a5f5cab011ce1d88dd866aa47578c37bf5edab19db2c3d8c4e771
SHA512d88c224419abefae5da3ea3cb4b479c1bd1063a70ad3659d138886e194aca5a82e124e6dc74e108501fbbb0cdcd58c0bf9f8b53330e00a7bc74e978f1ac58533