Analysis
-
max time kernel
130s -
max time network
123s -
platform
windows10-ltsc_2021_x64 -
resource
win10ltsc2021-20250314-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system -
submitted
02/04/2025, 18:20
General
-
Target
Client.exe
-
Size
112KB
-
MD5
53abc47921f3af6d9cfac59b5e272c36
-
SHA1
808dc707df535523605bf4f917161f23f0307782
-
SHA256
ac542f56167f262766ff228daaa27f96f18fdf0c931e7fb9640d4d51f5b093df
-
SHA512
5595b7a3cafb527f9f5b4263df98e29167f9461016d22acdb8654124d3adf345305218242c3feec7c87de3de486f485969fe3b3b2065ac376fb6ed5a5e55170d
-
SSDEEP
768:NdhO/poiiUcjlJInu7ElmH9Xqk5nWEZ5SbTDawuI7CPW5aZLKEe+eJaS:Dw+jjgnmElmH9XqcnW85SbT9uIyZzS
Malware Config
Extracted
Family
xenorat
C2
178.83.80.11
Mutex
WinStart
Attributes
-
delay
5000
-
install_path
appdata
-
port
4444
-
startup_name
WinStart
Signatures
-
Detect XenoRat Payload 2 IoCs
resource yara_rule behavioral1/memory/2404-1-0x00000000002E0000-0x0000000000302000-memory.dmp family_xenorat behavioral1/files/0x0008000000028188-2.dat family_xenorat -
Xenorat family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000\Control Panel\International\Geo\Nation Client.exe -
Executes dropped EXE 1 IoCs
pid Process 2628 Client.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000_Classes\Local Settings taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1628 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5712 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 5712 taskmgr.exe Token: SeSystemProfilePrivilege 5712 taskmgr.exe Token: SeCreateGlobalPrivilege 5712 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe 5712 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2404 wrote to memory of 2628 2404 Client.exe 81 PID 2404 wrote to memory of 2628 2404 Client.exe 81 PID 2404 wrote to memory of 2628 2404 Client.exe 81 PID 2628 wrote to memory of 1628 2628 Client.exe 86 PID 2628 wrote to memory of 1628 2628 Client.exe 86 PID 2628 wrote to memory of 1628 2628 Client.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Roaming\XenoManager\Client.exe"C:\Users\Admin\AppData\Roaming\XenoManager\Client.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "WinStart" /XML "C:\Users\Admin\AppData\Local\Temp\tmp66F7.tmp" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1628
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5712
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3200
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5e8866bed06a0b5155010fbbf77e2c1b6
SHA1ac340e71878732fdb9baa7370e46e0d131b587ea
SHA2561dd2854ea9bd999669c85d57a63402a9cd2879ad3c94b86981e9eb3251d87a2a
SHA5121d702e5d9273af39aea0df3fcce0df4979f9c361d52673d7a0916c2b55765536596d8dc1aadb3c27d2e3a001c3a5269e7146fc44d20af11c08394932ff633990
-
Filesize
112KB
MD553abc47921f3af6d9cfac59b5e272c36
SHA1808dc707df535523605bf4f917161f23f0307782
SHA256ac542f56167f262766ff228daaa27f96f18fdf0c931e7fb9640d4d51f5b093df
SHA5125595b7a3cafb527f9f5b4263df98e29167f9461016d22acdb8654124d3adf345305218242c3feec7c87de3de486f485969fe3b3b2065ac376fb6ed5a5e55170d