xenorat | 43b01081f0d1f67e96a18d4068fe042670d70bd3adc208f9936964e12d109038

General

Target
helpshit.exe
Size 45KB
Sample250222-kt955asmcw
SHA256 43b01081f0d1f67e96a18d4068fe042670d70bd3adc208f9936964e12d109038
MD5 d3e5f30eb4b8e64d810c0f74edcc5de0
SHA1 a9b765ce3eec47607585d197335eca6b6dabce94
SHA512 e71fa2f0197b471927df6446d0619e63ac231c2735d84525c18abab5e5079ae11cadcdbb9c2bf7a5f6903bf33043c15a86826862392e03ae313f5bf86c8718ea
SSDEEP 768:adhO/poiiUcjlJInE3H9Xqk5nWEZ5SbTDauuI7CPW5M:8w+jjgn6H9XqcnW85SbT7uI0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xenorat discovery rat trojan

Malware Config

Extracted

Family

xenorat

C2

127.0.0.1

Mutex

Helpshit

Attributes

delay
5000
install_path
temp
port
4444
startup_name
Ms.help

Signatures

Detect XenoRat Payload 2 IoCs

resource	yara_rule
behavioral2/memory/4148-1-0x0000000000230000-0x0000000000242000-memory.dmp	family_xenorat
behavioral2/files/0x0008000000023d25-6.dat	family_xenorat

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat
Xenorat family
xenorat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Control Panel\International\Geo\Nation	helpshit.exe

Executes dropped EXE 1 IoCs

pid	Process
4336	helpshit.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	helpshit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	helpshit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2700	schtasks.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 4336	4148	helpshit.exe	87
PID 4148 wrote to memory of 4336	4148	helpshit.exe	87
PID 4148 wrote to memory of 4336	4148	helpshit.exe	87
PID 4336 wrote to memory of 2700	4336	helpshit.exe	91
PID 4336 wrote to memory of 2700	4336	helpshit.exe	91
PID 4336 wrote to memory of 2700	4336	helpshit.exe	91

C:\Users\Admin\AppData\Local\Temp\helpshit.exe
"C:\Users\Admin\AppData\Local\Temp\helpshit.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Users\Admin\AppData\Local\Temp\XenoManager\helpshit.exe
  "C:\Users\Admin\AppData\Local\Temp\XenoManager\helpshit.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /Create /TN "Ms.help" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD570.tmp" /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

helpshit.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\helpshit.exe.log
Size 226B
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
MD5 SHA1 SHA512

Submit Download

helpshit.exe

Path C:\Users\Admin\AppData\Local\Temp\XenoManager\helpshit.exe
Size 45KB
SHA256 43b01081f0d1f67e96a18d4068fe042670d70bd3adc208f9936964e12d109038
MD5 d3e5f30eb4b8e64d810c0f74edcc5de0
SHA1 a9b765ce3eec47607585d197335eca6b6dabce94
SHA512 e71fa2f0197b471927df6446d0619e63ac231c2735d84525c18abab5e5079ae11cadcdbb9c2bf7a5f6903bf33043c15a86826862392e03ae313f5bf86c8718ea
SSDEEP 768:adhO/poiiUcjlJInE3H9Xqk5nWEZ5SbTDauuI7CPW5M:8w+jjgn6H9XqcnW85SbT7uI0
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpD570.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpD570.tmp
Size 1KB
SHA256 65519623c05caf9759b349ed8ab24885216895b6dcf53ec9e3f3d58899facd20
MD5 d5393ccbf85509a340c2262d268ce947
SHA1 292bd383e7d4c1dd2460b7c8c75b21fb6f7ef619
SHA512 d6e7a6e3500f87fd3dc4f994a6b07faddf8fba85e9bf4bfe113ba1fbd95391abf8569c21dfe91fc4b75266c57652661521fb4ab8271d1b19ed9f0ce31eeeb8a1
MD5 SHA1 SHA512

Submit Download

memory/4148-0-0x000000007521E000-0x000000007521F000-memory.dmp

Download

memory/4148-1-0x0000000000230000-0x0000000000242000-memory.dmp

Download

memory/4336-15-0x0000000075210000-0x00000000759C0000-memory.dmp

Download

memory/4336-18-0x0000000075210000-0x00000000759C0000-memory.dmp

Download

memory/4336-19-0x0000000075210000-0x00000000759C0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads