Overview

overview

10

Static

static

10

BootstrapperNew 1.exe

windows7-x64

10

BootstrapperNew 1.exe

windows10-ltsc 2021-x64

BootstrapperNew 1.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    688s
  • max time network
    690s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16-02-2025 17:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    BootstrapperNew 1.exe

  • Size

    50KB

  • MD5

    e04ffbc3f3dd5111ff1334d266652b79

  • SHA1

    b84171d543dd9f345813f0220142b9cfd9132e12

  • SHA256

    cd2c66350bccdd0152b592b3e7cb2c999e7923171f21a2ce887ac0d4eaf2032a

  • SHA512

    d65f661bd54f6aec9b7b5c10c87b90071c84c0c6d5a04d3a0727c1fdcf4099f5da2e3aeba7502e71c55059f8618c7dba85e1eb24dee8014b798ecc6eded93c3a

  • SSDEEP

    768:qdhO/poiiUcjlJInvdH9Xqk5nWEZ5SbTDaCWI7CPW5ispY:Mw+jjgnFH9XqcnW85SbTbWIqspY

Score
10/10
xenoratdefense_evasiondiscoveryprivilege_escalationratspywarestealertrojan

Malware Config

Extracted

Family

xenorat

C2

108.77.173.66

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    3000

  • install_path

    appdata

  • port

    4758

  • startup_name

    Solara Bootstrapper Dependinces

Signatures

  • Detect XenoRat Payload 10 IoCs
  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat
  • Xenorat family
    xenorat
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Abuse Elevation Control Mechanism: Bypass User Account Control 1 TTPs 1 IoCs

    UAC Bypass Attempt via SilentCleanup Task.

    defense_evasionprivilege_escalation
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BootstrapperNew 1.exe
    "C:\Users\Admin\AppData\Local\Temp\BootstrapperNew 1.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2692
    • C:\Users\Admin\AppData\Roaming\XenoManager\BootstrapperNew 1.exe
      "C:\Users\Admin\AppData\Roaming\XenoManager\BootstrapperNew 1.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2740
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks.exe" /Create /TN "Solara Bootstrapper Dependinces" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF67F.tmp" /F
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2840
      • C:\Windows\SysWOW64\SCHTASKS.exe
        "SCHTASKS.exe" /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I
        3⤵
        • Abuse Elevation Control Mechanism: Bypass User Account Control
        • System Location Discovery: System Language Discovery
        PID:1580
      • C:\Users\Admin\AppData\Roaming\XenoManager\BootstrapperNew 1.exe
        "C:\Users\Admin\AppData\Roaming\XenoManager\BootstrapperNew 1.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:732
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks.exe" /Create /TN "Solara Bootstrapper Dependinces" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5ABD.tmp" /F
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:1632
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks.exe" /Create /TN "XenoUpdateManager" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7F4E.tmp" /F
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2868
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x510
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\cb5p5oj5.5wg
    Filesize

    20KB

    MD5

    c9ff7748d8fcef4cf84a5501e996a641

    SHA1

    02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

    SHA256

    4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

    SHA512

    d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nuxoe00k.ort
    Filesize

    148KB

    MD5

    90a1d4b55edf36fa8b4cc6974ed7d4c4

    SHA1

    aba1b8d0e05421e7df5982899f626211c3c4b5c1

    SHA256

    7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

    SHA512

    ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\p4z5znfa.dfs
    Filesize

    92KB

    MD5

    6093b9b9effe107a1958b5e8775d196a

    SHA1

    f86ede48007734aebe75f41954ea1ef64924b05e

    SHA256

    a10b04d057393f5974c776ed253909cafcd014752a57da2971ae0dddfa889ab0

    SHA512

    2d9c20a201655ffcce71bfafa71b79fe08eb8aa02b5666588302608f6a14126a5a1f4213a963eb528514e2ea2b17871c4c5f9b5ef89c1940c40c0718ec367a77

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmpF67F.tmp
    Filesize

    1KB

    MD5

    0579f29ab936caa1c006d50f1afabd69

    SHA1

    afa6d1ab1e9b31cd9bf7acfac2bba38df09c431f

    SHA256

    23f8fa9c340f4d121e145654beba9923b9aec6e950b76162d1e4278dad391717

    SHA512

    26dd4b0bf8d4c71592ec86add436b3b91c0e278d26bf372bad755f900e1153c669b5c88b0b8d7d8a19f95bf781a644471f8b69e1ac27bac95544435c83a9f3ce

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\xazr3uw3.tij
    Filesize

    46KB

    MD5

    02d2c46697e3714e49f46b680b9a6b83

    SHA1

    84f98b56d49f01e9b6b76a4e21accf64fd319140

    SHA256

    522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

    SHA512

    60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

    Download Submit

  • \Users\Admin\AppData\Roaming\XenoManager\BootstrapperNew 1.exe
    Filesize

    50KB

    MD5

    e04ffbc3f3dd5111ff1334d266652b79

    SHA1

    b84171d543dd9f345813f0220142b9cfd9132e12

    SHA256

    cd2c66350bccdd0152b592b3e7cb2c999e7923171f21a2ce887ac0d4eaf2032a

    SHA512

    d65f661bd54f6aec9b7b5c10c87b90071c84c0c6d5a04d3a0727c1fdcf4099f5da2e3aeba7502e71c55059f8618c7dba85e1eb24dee8014b798ecc6eded93c3a

    Download Submit

  • memory/732-79-0x00000000009D0000-0x00000000009DA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2692-1-0x00000000012B0000-0x00000000012C2000-memory.dmp

    Filesize

    72KB

    Download

  • memory/2692-0-0x0000000074A5E000-0x0000000074A5F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2740-15-0x0000000000410000-0x000000000041C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/2740-22-0x0000000000C40000-0x0000000000C4A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2740-23-0x0000000006E90000-0x0000000006F8A000-memory.dmp

    Filesize

    1000KB

    Download

  • memory/2740-39-0x0000000004700000-0x000000000470C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/2740-40-0x0000000004860000-0x000000000486A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2740-19-0x0000000000BF0000-0x0000000000BF8000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2740-14-0x0000000074A50000-0x000000007513E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2740-13-0x0000000074A50000-0x000000007513E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2740-10-0x0000000074A50000-0x000000007513E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2740-9-0x0000000000C50000-0x0000000000C62000-memory.dmp

    Filesize

    72KB

    Download