xenorat | c1660f29a63ef53452026f41494cfef417c10354ba6218d2105ec7d7aef87ec6

General

Target

PENTESTING.exe
Size

45KB
MD5

16956f8d3753f83bf7e896c77a5d57c0
SHA1

fd61d797498534ff0a3f9c99f9d92439df912001
SHA256

c1660f29a63ef53452026f41494cfef417c10354ba6218d2105ec7d7aef87ec6
SHA512

e49384fe9d9e23e2f40a3703cce2c4f7f9a54ed1ca66f9ffddd8d64eb18f15bbbec76c6db977f8716aeadeec4cc52158fd9e59db56f1b4961f7084422b893851
SSDEEP

768:ldhO/poiiUcjlJInAqH9Xqk5nWEZ5SbTDa3WI7CPW50:7w+jjgnrH9XqcnW85SbTuWIM

Score

10^/10

xenorat discovery rat trojan

Malware Config

Extracted

Family

xenorat

C2

127.0.0.1

Mutex

PENTESTING

Attributes

delay
5000
install_path
temp
port
4444
startup_name
Windows Servieces for Defender

Signatures

Detect XenoRat Payload 3 IoCs

resource	yara_rule
behavioral1/memory/2936-1-0x00000000013B0000-0x00000000013C2000-memory.dmp	family_xenorat
behavioral1/files/0x0008000000019394-4.dat	family_xenorat
behavioral1/memory/2896-9-0x0000000000AC0000-0x0000000000AD2000-memory.dmp	family_xenorat

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat
Xenorat family
xenorat

Executes dropped EXE 1 IoCs

pid	Process
2896	PENTESTING.exe

Loads dropped DLL 1 IoCs

pid	Process
2936	PENTESTING.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PENTESTING.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PENTESTING.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3004	schtasks.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2896	2936	PENTESTING.exe	29
PID 2936 wrote to memory of 2896	2936	PENTESTING.exe	29
PID 2936 wrote to memory of 2896	2936	PENTESTING.exe	29
PID 2936 wrote to memory of 2896	2936	PENTESTING.exe	29
PID 2896 wrote to memory of 3004	2896	PENTESTING.exe	30
PID 2896 wrote to memory of 3004	2896	PENTESTING.exe	30
PID 2896 wrote to memory of 3004	2896	PENTESTING.exe	30
PID 2896 wrote to memory of 3004	2896	PENTESTING.exe	30

C:\Users\Admin\AppData\Local\Temp\PENTESTING.exe
"C:\Users\Admin\AppData\Local\Temp\PENTESTING.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Users\Admin\AppData\Local\Temp\XenoManager\PENTESTING.exe
  "C:\Users\Admin\AppData\Local\Temp\XenoManager\PENTESTING.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /Create /TN "Windows Servieces for Defender" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFA37.tmp" /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpFA37.tmp

Filesize
1KB

MD5
a247ebed4d178c3d18cde61319da03f8

SHA1
4db31b193d264643419f986324ed99d29fd49471

SHA256
7bf644501f2b4d8cb0b0460a86fb35cb9ab604a49f8b3861583eb421fe9dc936

SHA512
c71a9b8ba6b903ee5a914d9f4e46aaa931c4f0f13b0e36bd4041ba486b049b39153aab0509ea126601e846f19a41fb6c4ba53513c0585ff5a696019b30f29114

Download Submit
\Users\Admin\AppData\Local\Temp\XenoManager\PENTESTING.exe

Filesize
45KB

MD5
16956f8d3753f83bf7e896c77a5d57c0

SHA1
fd61d797498534ff0a3f9c99f9d92439df912001

SHA256
c1660f29a63ef53452026f41494cfef417c10354ba6218d2105ec7d7aef87ec6

SHA512
e49384fe9d9e23e2f40a3703cce2c4f7f9a54ed1ca66f9ffddd8d64eb18f15bbbec76c6db977f8716aeadeec4cc52158fd9e59db56f1b4961f7084422b893851

Download Submit
memory/2896-9-0x0000000000AC0000-0x0000000000AD2000-memory.dmp

Filesize
72KB

Download
memory/2896-10-0x00000000744D0000-0x0000000074BBE000-memory.dmp

Filesize
6.9MB

Download
memory/2896-13-0x00000000744D0000-0x0000000074BBE000-memory.dmp

Filesize
6.9MB

Download
memory/2896-14-0x00000000744D0000-0x0000000074BBE000-memory.dmp

Filesize
6.9MB

Download
memory/2896-15-0x00000000744D0000-0x0000000074BBE000-memory.dmp

Filesize
6.9MB

Download
memory/2936-0-0x00000000744DE000-0x00000000744DF000-memory.dmp

Filesize
4KB

Download
memory/2936-1-0x00000000013B0000-0x00000000013C2000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads