Malware Analysis Report

2025-04-13 23:04

Sample ID 250323-xnqwhs1yft
Target SecurityHealth.exe
SHA256 c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8
Tags
xenorat discovery rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8

Threat Level: Known bad

The file SecurityHealth.exe was found to be: Known bad.

Malicious Activity Summary

xenorat discovery rat trojan

Detect XenoRat Payload

XenorRat

Xenorat family

Loads dropped DLL

.NET Reactor proctector

Executes dropped EXE

Checks computer location settings

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Scheduled Task/Job: Scheduled Task

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-03-23 19:00

Signatures

Detect XenoRat Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xenorat family

xenorat

.NET Reactor proctector

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2025-03-23 19:00

Reported

2025-03-23 19:02

Platform

win10v2004-20250314-en

Max time kernel

134s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SecurityHealth.exe"

Signatures

Detect XenoRat Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

XenorRat

trojan rat xenorat

Xenorat family

xenorat

.NET Reactor proctector

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\SecurityHealth.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\SecurityHealth.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SecurityHealth.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\XenoManager\SecurityHealth.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\SecurityHealth.exe

"C:\Users\Admin\AppData\Local\Temp\SecurityHealth.exe"

C:\Users\Admin\AppData\Local\Temp\XenoManager\SecurityHealth.exe

"C:\Users\Admin\AppData\Local\Temp\XenoManager\SecurityHealth.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "SecurityHealth" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9858.tmp" /F

Network

Country Destination Domain Proto
NL 217.195.153.81:50002 tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tcp
US 150.171.28.10:443 tcp
US 150.171.28.10:443 tcp
US 150.171.28.10:443 tcp
NL 217.195.153.81:50002 tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.180.3:80 c.pki.goog tcp
NL 217.195.153.81:50002 tcp
NL 217.195.153.81:50002 tcp
NL 217.195.153.81:50002 tcp

Files

memory/5032-0-0x000000007524E000-0x000000007524F000-memory.dmp

memory/5032-1-0x0000000000490000-0x00000000004B6000-memory.dmp

memory/5032-3-0x0000000075240000-0x00000000759F0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XenoManager\SecurityHealth.exe

MD5 e56cee3aba6280693ac9bcd2c4f184ec
SHA1 e2ec215868b0a2528e5ee25eb89f9661527e2f78
SHA256 c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8
SHA512 466732320ee94693bc8327826b1021e414c8b03c35c0a0302c5f98404b2886b1274a327804e8449f298454e76e6e69693746a77f767f6145a96430f4a15e4929

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecurityHealth.exe.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/2428-16-0x0000000075240000-0x00000000759F0000-memory.dmp

memory/5032-17-0x0000000075240000-0x00000000759F0000-memory.dmp

memory/2428-18-0x0000000075240000-0x00000000759F0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp9858.tmp

MD5 0299ea7325b876385ff4781e402a92a0
SHA1 3de64c1c9044cbc17adc011a8dbf97b90e5fb1ea
SHA256 cd8e54d55deb6d823cf91ad6092058d9a7ef5d927a70df5e99a67bed95fbc535
SHA512 ca678702da2577a53a1d0bfc0415b461548187b31d4e2455905f940e49041fe5471a7de630bcc58d8d06368a7bb373aa2d80e7752f7d6505ef7d4ae11a8cd637

memory/2428-21-0x0000000075240000-0x00000000759F0000-memory.dmp

memory/2428-22-0x0000000075240000-0x00000000759F0000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2025-03-23 19:00

Reported

2025-03-23 19:02

Platform

win7-20240903-en

Max time kernel

133s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SecurityHealth.exe"

Signatures

Detect XenoRat Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

XenorRat

trojan rat xenorat

Xenorat family

xenorat

.NET Reactor proctector

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\SecurityHealth.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecurityHealth.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SecurityHealth.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\XenoManager\SecurityHealth.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\SecurityHealth.exe

"C:\Users\Admin\AppData\Local\Temp\SecurityHealth.exe"

C:\Users\Admin\AppData\Local\Temp\XenoManager\SecurityHealth.exe

"C:\Users\Admin\AppData\Local\Temp\XenoManager\SecurityHealth.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "SecurityHealth" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEEA3.tmp" /F

Network

Country Destination Domain Proto
NL 217.195.153.81:50002 tcp
NL 217.195.153.81:50002 tcp
NL 217.195.153.81:50002 tcp
NL 217.195.153.81:50002 tcp
NL 217.195.153.81:50002 tcp

Files

memory/2468-0-0x0000000074E9E000-0x0000000074E9F000-memory.dmp

memory/2468-1-0x0000000001340000-0x0000000001366000-memory.dmp

memory/2468-2-0x0000000074E90000-0x000000007557E000-memory.dmp

\Users\Admin\AppData\Local\Temp\XenoManager\SecurityHealth.exe

MD5 e56cee3aba6280693ac9bcd2c4f184ec
SHA1 e2ec215868b0a2528e5ee25eb89f9661527e2f78
SHA256 c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8
SHA512 466732320ee94693bc8327826b1021e414c8b03c35c0a0302c5f98404b2886b1274a327804e8449f298454e76e6e69693746a77f767f6145a96430f4a15e4929

memory/2032-10-0x0000000001130000-0x0000000001156000-memory.dmp

memory/2468-11-0x0000000074E90000-0x000000007557E000-memory.dmp

memory/2032-12-0x0000000074E90000-0x000000007557E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpEEA3.tmp

MD5 0299ea7325b876385ff4781e402a92a0
SHA1 3de64c1c9044cbc17adc011a8dbf97b90e5fb1ea
SHA256 cd8e54d55deb6d823cf91ad6092058d9a7ef5d927a70df5e99a67bed95fbc535
SHA512 ca678702da2577a53a1d0bfc0415b461548187b31d4e2455905f940e49041fe5471a7de630bcc58d8d06368a7bb373aa2d80e7752f7d6505ef7d4ae11a8cd637

memory/2032-15-0x0000000074E90000-0x000000007557E000-memory.dmp

memory/2032-16-0x0000000074E90000-0x000000007557E000-memory.dmp