xenorat | c1660f29a63ef53452026f41494cfef417c10354ba6218d2105ec7d7aef87ec6

General

Target

PENTESTING.exe
Size

45KB
MD5

16956f8d3753f83bf7e896c77a5d57c0
SHA1

fd61d797498534ff0a3f9c99f9d92439df912001
SHA256

c1660f29a63ef53452026f41494cfef417c10354ba6218d2105ec7d7aef87ec6
SHA512

e49384fe9d9e23e2f40a3703cce2c4f7f9a54ed1ca66f9ffddd8d64eb18f15bbbec76c6db977f8716aeadeec4cc52158fd9e59db56f1b4961f7084422b893851
SSDEEP

768:ldhO/poiiUcjlJInAqH9Xqk5nWEZ5SbTDa3WI7CPW50:7w+jjgnrH9XqcnW85SbTuWIM

Score

10^/10

xenorat discovery rat trojan

Malware Config

Extracted

Family

xenorat

C2

127.0.0.1

Mutex

PENTESTING

Attributes

delay
5000
install_path
temp
port
4444
startup_name
Windows Servieces for Defender

Signatures

Detect XenoRat Payload 2 IoCs

resource	yara_rule
behavioral2/memory/2896-1-0x0000000000CA0000-0x0000000000CB2000-memory.dmp	family_xenorat
behavioral2/files/0x0008000000023e54-7.dat	family_xenorat

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat
Xenorat family
xenorat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
31	1904	Process not Found

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3932017190-1449707826-1445630-1000\Control Panel\International\Geo\Nation	PENTESTING.exe

Executes dropped EXE 1 IoCs

pid	Process
1860	PENTESTING.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PENTESTING.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PENTESTING.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4976	MicrosoftEdgeUpdate.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4756	schtasks.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 1860	2896	PENTESTING.exe	88
PID 2896 wrote to memory of 1860	2896	PENTESTING.exe	88
PID 2896 wrote to memory of 1860	2896	PENTESTING.exe	88
PID 1860 wrote to memory of 4756	1860	PENTESTING.exe	90
PID 1860 wrote to memory of 4756	1860	PENTESTING.exe	90
PID 1860 wrote to memory of 4756	1860	PENTESTING.exe	90

C:\Users\Admin\AppData\Local\Temp\PENTESTING.exe
"C:\Users\Admin\AppData\Local\Temp\PENTESTING.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Users\Admin\AppData\Local\Temp\XenoManager\PENTESTING.exe
  "C:\Users\Admin\AppData\Local\Temp\XenoManager\PENTESTING.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /Create /TN "Windows Servieces for Defender" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE0BB.tmp" /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4756

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NUY4NDFFMkItQTNDNC00RUMwLTg4NkQtQTgwMTc0M0UxMzlCfSIgdXNlcmlkPSJ7QzRGNzQzRTktQjE0RS00RTI5LUE1QjgtQkJENkM2RDdDOTZFfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7ODgzQUUzNjEtRTYyNi00NjAyLTk4RDQtOUU5MzdFMjdBODc5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDY0MzMiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODc1OTU2NTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MDA2OTQzMTY3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:4976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PENTESTING.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\XenoManager\PENTESTING.exe

Filesize
45KB

MD5
16956f8d3753f83bf7e896c77a5d57c0

SHA1
fd61d797498534ff0a3f9c99f9d92439df912001

SHA256
c1660f29a63ef53452026f41494cfef417c10354ba6218d2105ec7d7aef87ec6

SHA512
e49384fe9d9e23e2f40a3703cce2c4f7f9a54ed1ca66f9ffddd8d64eb18f15bbbec76c6db977f8716aeadeec4cc52158fd9e59db56f1b4961f7084422b893851

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE0BB.tmp

Filesize
1KB

MD5
a247ebed4d178c3d18cde61319da03f8

SHA1
4db31b193d264643419f986324ed99d29fd49471

SHA256
7bf644501f2b4d8cb0b0460a86fb35cb9ab604a49f8b3861583eb421fe9dc936

SHA512
c71a9b8ba6b903ee5a914d9f4e46aaa931c4f0f13b0e36bd4041ba486b049b39153aab0509ea126601e846f19a41fb6c4ba53513c0585ff5a696019b30f29114

Download Submit
memory/1860-15-0x0000000073DA0000-0x0000000074550000-memory.dmp

Filesize
7.7MB

Download
memory/1860-18-0x0000000073DA0000-0x0000000074550000-memory.dmp

Filesize
7.7MB

Download
memory/1860-19-0x0000000073DA0000-0x0000000074550000-memory.dmp

Filesize
7.7MB

Download
memory/2896-0-0x0000000073DAE000-0x0000000073DAF000-memory.dmp

Filesize
4KB

Download
memory/2896-1-0x0000000000CA0000-0x0000000000CB2000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads