Analysis
-
max time kernel
75s -
max time network
73s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-01-2025 23:15
General
-
Target
eulen.exe
-
Size
74KB
-
MD5
3844571d2d25e1112db4d525422f8ad2
-
SHA1
3ee0f8874270f73c417a2a56e506a49b850cef8e
-
SHA256
c4c21224b91351cbd943ca77e14c1c458815104ab9ffa5d252615d75e736f725
-
SHA512
fd0ac668e7f85b5bba70bc01db2ae4c63b85519ad8059aaec4142be92ea4642d242fc6fea4fc78bc4cf36b1b67ec4e4564c8effaab6987042acb738187179705
-
SSDEEP
1536:Tw+jjgn2yH9XqcnW85SbTBqWIy8+Qlr6SYCmQqy15X:Tw+jq2s91UbTBqH+Q4wqy15X
Malware Config
Extracted
Family
xenorat
C2
147.185.221.25
Mutex
Eulen
Attributes
-
delay
1
-
install_path
temp
-
port
18889
-
startup_name
Update
Signatures
-
Detect XenoRat Payload 2 IoCs
resource yara_rule behavioral1/memory/32-1-0x00000000008F0000-0x0000000000908000-memory.dmp family_xenorat behavioral1/files/0x000b000000023b6e-6.dat family_xenorat -
Xenorat family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation eulen.exe -
Executes dropped EXE 1 IoCs
pid Process 1164 eulen.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eulen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eulen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3892 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2672 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2672 taskmgr.exe Token: SeSystemProfilePrivilege 2672 taskmgr.exe Token: SeCreateGlobalPrivilege 2672 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe 2672 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 32 wrote to memory of 1164 32 eulen.exe 83 PID 32 wrote to memory of 1164 32 eulen.exe 83 PID 32 wrote to memory of 1164 32 eulen.exe 83 PID 1164 wrote to memory of 3892 1164 eulen.exe 84 PID 1164 wrote to memory of 3892 1164 eulen.exe 84 PID 1164 wrote to memory of 3892 1164 eulen.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\eulen.exe"C:\Users\Admin\AppData\Local\Temp\eulen.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Users\Admin\AppData\Local\Temp\XenoManager\eulen.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\eulen.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "Update" /XML "C:\Users\Admin\AppData\Local\Temp\tmp80F7.tmp" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3892
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2672
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1528
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
Filesize
74KB
MD53844571d2d25e1112db4d525422f8ad2
SHA13ee0f8874270f73c417a2a56e506a49b850cef8e
SHA256c4c21224b91351cbd943ca77e14c1c458815104ab9ffa5d252615d75e736f725
SHA512fd0ac668e7f85b5bba70bc01db2ae4c63b85519ad8059aaec4142be92ea4642d242fc6fea4fc78bc4cf36b1b67ec4e4564c8effaab6987042acb738187179705
-
Filesize
1KB
MD589dc616a1bd6468611d1519a7a59cc6a
SHA1ad4a7de6aa7c8b03f4b900ca306c8885f44adf58
SHA256c98cf4e9c0641617e4df28ce0a0f294939fa0027c14d18d6952d1c6a5f84282c
SHA512b1e39c66cfac7da9b2adb1051e4b64f8ae0f2f35cddcb5e0852ae0e9d6448ecde519a466e4a229669c1de7bf49c4ff3ad59fbbe0b370ad908e7d31b3141ef017