Malware Analysis Report

2025-04-13 23:04

Sample ID 250324-mjzbzs1lw7
Target c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8.exe
SHA256 c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8
Tags
xenorat discovery rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8

Threat Level: Known bad

The file c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8.exe was found to be: Known bad.

Malicious Activity Summary

xenorat discovery rat trojan

Xenorat family

XenorRat

Detect XenoRat Payload

.NET Reactor proctector

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Scheduled Task/Job: Scheduled Task

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-03-24 10:30

Signatures

Detect XenoRat Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xenorat family

xenorat

.NET Reactor proctector

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-03-24 10:30

Reported

2025-03-24 10:32

Platform

win7-20241010-en

Max time kernel

133s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8.exe"

Signatures

Detect XenoRat Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

XenorRat

trojan rat xenorat

Xenorat family

xenorat

.NET Reactor proctector

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\XenoManager\c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1796 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8.exe C:\Users\Admin\AppData\Local\Temp\XenoManager\c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8.exe
PID 1796 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8.exe C:\Users\Admin\AppData\Local\Temp\XenoManager\c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8.exe
PID 1796 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8.exe C:\Users\Admin\AppData\Local\Temp\XenoManager\c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8.exe
PID 1796 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8.exe C:\Users\Admin\AppData\Local\Temp\XenoManager\c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8.exe
PID 1180 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8.exe C:\Windows\SysWOW64\schtasks.exe
PID 1180 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8.exe C:\Windows\SysWOW64\schtasks.exe
PID 1180 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8.exe C:\Windows\SysWOW64\schtasks.exe
PID 1180 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8.exe

"C:\Users\Admin\AppData\Local\Temp\c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8.exe"

C:\Users\Admin\AppData\Local\Temp\XenoManager\c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8.exe

"C:\Users\Admin\AppData\Local\Temp\XenoManager\c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "SecurityHealth" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB7CB.tmp" /F

Network

Country Destination Domain Proto
NL 217.195.153.81:50002 tcp
NL 217.195.153.81:50002 tcp
NL 217.195.153.81:50002 tcp
NL 217.195.153.81:50002 tcp
NL 217.195.153.81:50002 tcp

Files

memory/1796-0-0x0000000074C1E000-0x0000000074C1F000-memory.dmp

memory/1796-1-0x0000000000DF0000-0x0000000000E16000-memory.dmp

memory/1796-2-0x0000000074C10000-0x00000000752FE000-memory.dmp

\Users\Admin\AppData\Local\Temp\XenoManager\c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8.exe

MD5 e56cee3aba6280693ac9bcd2c4f184ec
SHA1 e2ec215868b0a2528e5ee25eb89f9661527e2f78
SHA256 c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8
SHA512 466732320ee94693bc8327826b1021e414c8b03c35c0a0302c5f98404b2886b1274a327804e8449f298454e76e6e69693746a77f767f6145a96430f4a15e4929

memory/1180-10-0x0000000001310000-0x0000000001336000-memory.dmp

memory/1796-11-0x0000000074C10000-0x00000000752FE000-memory.dmp

memory/1180-12-0x0000000074C10000-0x00000000752FE000-memory.dmp

memory/1180-13-0x0000000074C10000-0x00000000752FE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpB7CB.tmp

MD5 42870fb0ad2caa100355e541329128e3
SHA1 cbfba6b1b432ddddbb1cbcfeb9b6284f635f314f
SHA256 7f344e7862ac67421e2212127a9512085bbb32107cf20c5eea42b7c08a4213d4
SHA512 bf89ed1f67f6b1b786c7962470a29a04dafa569e3c381c14eecfd9efcb645eab3d54021db62f52380077083840c79688e0c5e1719acd126159ed4015a2b87abb

memory/1180-16-0x0000000074C10000-0x00000000752FE000-memory.dmp

memory/1180-17-0x0000000074C10000-0x00000000752FE000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-03-24 10:30

Reported

2025-03-24 10:32

Platform

win10v2004-20250314-en

Max time kernel

133s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8.exe"

Signatures

Detect XenoRat Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

XenorRat

trojan rat xenorat

Xenorat family

xenorat

.NET Reactor proctector

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\XenoManager\c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8.exe

"C:\Users\Admin\AppData\Local\Temp\c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8.exe"

C:\Users\Admin\AppData\Local\Temp\XenoManager\c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8.exe

"C:\Users\Admin\AppData\Local\Temp\XenoManager\c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "SecurityHealth" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC832.tmp" /F

Network

Country Destination Domain Proto
NL 217.195.153.81:50002 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
NL 217.195.153.81:50002 tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.180.3:80 c.pki.goog tcp
NL 217.195.153.81:50002 tcp
NL 217.195.153.81:50002 tcp
NL 217.195.153.81:50002 tcp

Files

memory/1880-0-0x000000007449E000-0x000000007449F000-memory.dmp

memory/1880-1-0x0000000000DC0000-0x0000000000DE6000-memory.dmp

memory/1880-2-0x0000000074490000-0x0000000074C40000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XenoManager\c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8.exe

MD5 e56cee3aba6280693ac9bcd2c4f184ec
SHA1 e2ec215868b0a2528e5ee25eb89f9661527e2f78
SHA256 c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8
SHA512 466732320ee94693bc8327826b1021e414c8b03c35c0a0302c5f98404b2886b1274a327804e8449f298454e76e6e69693746a77f767f6145a96430f4a15e4929

memory/1456-17-0x0000000074490000-0x0000000074C40000-memory.dmp

memory/1880-16-0x0000000074490000-0x0000000074C40000-memory.dmp

memory/1456-18-0x0000000074490000-0x0000000074C40000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\c1f70fb2c07ec6e8a69d1bfc4998703481adf5301b44af75b125f11776da77f8.exe.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

C:\Users\Admin\AppData\Local\Temp\tmpC832.tmp

MD5 42870fb0ad2caa100355e541329128e3
SHA1 cbfba6b1b432ddddbb1cbcfeb9b6284f635f314f
SHA256 7f344e7862ac67421e2212127a9512085bbb32107cf20c5eea42b7c08a4213d4
SHA512 bf89ed1f67f6b1b786c7962470a29a04dafa569e3c381c14eecfd9efcb645eab3d54021db62f52380077083840c79688e0c5e1719acd126159ed4015a2b87abb

memory/1456-21-0x0000000074490000-0x0000000074C40000-memory.dmp