Analysis
-
max time kernel
38s -
max time network
34s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-01-2025 23:08
General
-
Target
eulenreal.exe
-
Size
74KB
-
MD5
507b3e8756680aa9eb98924d2aa13434
-
SHA1
137d3cdcfe15f23df7458ac47363fd7f186d807c
-
SHA256
f369cdebe099937c116c8768d9764902a2a47d36e94504182b1e86c7cde7a135
-
SHA512
e9f64908ba4e3c9bd589f5e10da3b4010ea18685e81b4f40cdaa74ef79f486da0546dee1900f5aa5ff3cafd4a9a195813cb664927aeb5700a5823a1cbefe6ff9
-
SSDEEP
1536:ow+jjgntH9XqcnW85SbT8quIu8+Qlr6SYCmQqy15X:ow+jq191UbT8qD+Q4wqy15X
Malware Config
Extracted
Family
xenorat
C2
127.0.0.1
Mutex
Eulen
Attributes
-
delay
1
-
install_path
temp
-
port
18889
-
startup_name
Update
Signatures
-
Detect XenoRat Payload 2 IoCs
resource yara_rule behavioral1/memory/2708-1-0x0000000000450000-0x0000000000468000-memory.dmp family_xenorat behavioral1/files/0x000b000000023b75-6.dat family_xenorat -
Xenorat family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation eulenreal.exe -
Executes dropped EXE 1 IoCs
pid Process 2252 eulenreal.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eulenreal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eulenreal.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1228 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1576 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1576 taskmgr.exe Token: SeSystemProfilePrivilege 1576 taskmgr.exe Token: SeCreateGlobalPrivilege 1576 taskmgr.exe -
Suspicious use of FindShellTrayWindow 43 IoCs
pid Process 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe -
Suspicious use of SendNotifyMessage 43 IoCs
pid Process 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe 1576 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2252 2708 eulenreal.exe 83 PID 2708 wrote to memory of 2252 2708 eulenreal.exe 83 PID 2708 wrote to memory of 2252 2708 eulenreal.exe 83 PID 2252 wrote to memory of 1228 2252 eulenreal.exe 84 PID 2252 wrote to memory of 1228 2252 eulenreal.exe 84 PID 2252 wrote to memory of 1228 2252 eulenreal.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\eulenreal.exe"C:\Users\Admin\AppData\Local\Temp\eulenreal.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\XenoManager\eulenreal.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\eulenreal.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "Update" /XML "C:\Users\Admin\AppData\Local\Temp\tmp78F9.tmp" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1228
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD5507b3e8756680aa9eb98924d2aa13434
SHA1137d3cdcfe15f23df7458ac47363fd7f186d807c
SHA256f369cdebe099937c116c8768d9764902a2a47d36e94504182b1e86c7cde7a135
SHA512e9f64908ba4e3c9bd589f5e10da3b4010ea18685e81b4f40cdaa74ef79f486da0546dee1900f5aa5ff3cafd4a9a195813cb664927aeb5700a5823a1cbefe6ff9
-
Filesize
1KB
MD5f2f26e53e992e705ae12d6eb5ce04c21
SHA163d8e22b507b4a5b404b9091232bd0dd6ec24766
SHA2560e089dcb626b2bf3e64586f9c16bcc80f7f9a09c34c9a698f35c7a0a918c79f4
SHA5128d2b2aeeba5e9e7432518507597d73e704641ac40d1c6e5aceff3caefdee79f6ef6498dc15b4d0d76131d6473029c482e17345705ec3ece9e50d5e8470f86cfa