Analysis
-
max time kernel
300s -
max time network
293s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27-12-2024 01:31
General
-
Target
123.exe
-
Size
45KB
-
MD5
5a778e834f35c916c39c65d60e039fd0
-
SHA1
68f3eaf6f75f5121f478c9ddb18ac0bd87622c1a
-
SHA256
e7fa7df68f52c8211dcf98a83ce68d333c1c9ad47c695e1c81d251c71dab2267
-
SHA512
3a2af26f175124f04abcd7587a80caa948c3489c6a386274af865f2a0c47be62998b355abf8d92562cf022a2e8a2a1d7e269c9bbd3a4a58054822e15addc74e1
-
SSDEEP
768:RdhO/poiiUcjlJIn7rtUH9Xqk5nWEZ5SbTDaQWI7CPW5U:Pw+jjgn7BUH9XqcnW85SbThWIM
Malware Config
Extracted
Family
xenorat
C2
192.168.0.144
Mutex
Xeno_rat_nd8912d
Attributes
-
delay
5000
-
install_path
appdata
-
port
4444
-
startup_name
nothingset
Signatures
-
Detect XenoRat Payload 2 IoCs
resource yara_rule behavioral1/memory/4360-1-0x0000000000BF0000-0x0000000000C02000-memory.dmp family_xenorat behavioral1/files/0x0007000000023cb2-6.dat family_xenorat -
Xenorat family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 123.exe -
Executes dropped EXE 1 IoCs
pid Process 1020 123.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 123.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 123.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3268 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3268 taskmgr.exe Token: SeSystemProfilePrivilege 3268 taskmgr.exe Token: SeCreateGlobalPrivilege 3268 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe 3268 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4360 wrote to memory of 1020 4360 123.exe 82 PID 4360 wrote to memory of 1020 4360 123.exe 82 PID 4360 wrote to memory of 1020 4360 123.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\123.exe"C:\Users\Admin\AppData\Local\Temp\123.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Roaming\XenoManager\123.exe"C:\Users\Admin\AppData\Roaming\XenoManager\123.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1020
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3268
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
Filesize
45KB
MD55a778e834f35c916c39c65d60e039fd0
SHA168f3eaf6f75f5121f478c9ddb18ac0bd87622c1a
SHA256e7fa7df68f52c8211dcf98a83ce68d333c1c9ad47c695e1c81d251c71dab2267
SHA5123a2af26f175124f04abcd7587a80caa948c3489c6a386274af865f2a0c47be62998b355abf8d92562cf022a2e8a2a1d7e269c9bbd3a4a58054822e15addc74e1