Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-ltsc_2021_x64 -
resource
win10ltsc2021-20250314-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system -
submitted
23/03/2025, 19:51
General
-
Target
microsoft.exe
-
Size
45KB
-
MD5
a7d5bf091a81df104f97facf96bafde8
-
SHA1
93e8d49b836e4bac8b36e2428176831351c51c88
-
SHA256
525cd3c91deab270ede58401517e6c5bc999e3b0fae7dce1cb94fd50c7c20840
-
SHA512
156bd78011c6155fe7e7cb550e32cbafe77369f5debeca231d9d9782f5c02d8b1345650790442a3372c92c84d26414b1cca4499c456d4a2e8ce405a89207b2e1
-
SSDEEP
768:tdhO/poiiUcjlJIn+ylF2I8H9Xqk5nWEZ5SbTDabuI7CPW5q:jw+jjgnRlF2I8H9XqcnW85SbTOuIC
Malware Config
Extracted
Family
xenorat
C2
221.150.223.183
Mutex
microsoft_x
Attributes
-
delay
5000
-
install_path
appdata
-
port
4444
-
startup_name
Microsoft
Signatures
-
Detect XenoRat Payload 2 IoCs
resource yara_rule behavioral1/memory/1612-1-0x0000000000CE0000-0x0000000000CF2000-memory.dmp family_xenorat behavioral1/files/0x0007000000028234-2.dat family_xenorat -
Xenorat family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000\Control Panel\International\Geo\Nation microsoft.exe -
Executes dropped EXE 1 IoCs
pid Process 3944 microsoft.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsoft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsoft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000_Classes\Local Settings taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4056 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3916 taskmgr.exe Token: SeSystemProfilePrivilege 3916 taskmgr.exe Token: SeCreateGlobalPrivilege 3916 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe 3916 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1612 wrote to memory of 3944 1612 microsoft.exe 85 PID 1612 wrote to memory of 3944 1612 microsoft.exe 85 PID 1612 wrote to memory of 3944 1612 microsoft.exe 85 PID 3944 wrote to memory of 4056 3944 microsoft.exe 86 PID 3944 wrote to memory of 4056 3944 microsoft.exe 86 PID 3944 wrote to memory of 4056 3944 microsoft.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\microsoft.exe"C:\Users\Admin\AppData\Local\Temp\microsoft.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Roaming\XenoManager\microsoft.exe"C:\Users\Admin\AppData\Roaming\XenoManager\microsoft.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "Microsoft" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB17D.tmp" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4056
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3916
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5012
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5685b4b5103b4562a703510c6d0b8fb17
SHA168fb107ba0aebdb4664a99bb0e26605e11f30926
SHA2562b7a058b9d2b11adc4df10cb24e13a16a127700433856a2880e199410fd9bb27
SHA51250021e5f9cf1254258d21e76bcd0abd11fdad37ef4b2b5fad15b03c14e5e9f030001a14c853e485002754e8ce16b4c90e31d03187522d1fc72944fc4967d5653
-
Filesize
45KB
MD5a7d5bf091a81df104f97facf96bafde8
SHA193e8d49b836e4bac8b36e2428176831351c51c88
SHA256525cd3c91deab270ede58401517e6c5bc999e3b0fae7dce1cb94fd50c7c20840
SHA512156bd78011c6155fe7e7cb550e32cbafe77369f5debeca231d9d9782f5c02d8b1345650790442a3372c92c84d26414b1cca4499c456d4a2e8ce405a89207b2e1