Analysis Overview
SHA256
a62e0cdbe939efc7bfe4a8b074207e4585ee5a90100fff7bd932e32c5a452feb
Threat Level: Known bad
The file ProtonyteAntiVirusSetup.exe was found to be: Known bad.
Malicious Activity Summary
Xenorat family
XenorRat
Unsigned PE
MITRE ATT&CK Matrix
Analysis: static1
Detonation Overview
Reported
2024-05-22 16:32
Signatures
Xenorat family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-22 16:32
Reported
2024-05-22 16:35
Platform
win11-20240508-en
Max time kernel
146s
Max time network
150s
Command Line
Signatures
XenorRat
Processes
C:\Users\Admin\AppData\Local\Temp\ProtonyteAntiVirusSetup.exe
"C:\Users\Admin\AppData\Local\Temp\ProtonyteAntiVirusSetup.exe"
Network
| Country | Destination | Domain | Proto |
| AT | 84.115.217.252:4444 | tcp | |
| AT | 84.115.217.252:4444 | tcp | |
| AT | 84.115.217.252:4444 | tcp | |
| AT | 84.115.217.252:4444 | tcp | |
| AT | 84.115.217.252:4444 | tcp |
Files
memory/1232-0-0x000000007488E000-0x000000007488F000-memory.dmp
memory/1232-1-0x0000000000BD0000-0x0000000000BE2000-memory.dmp
memory/1232-2-0x0000000074880000-0x0000000075031000-memory.dmp
memory/1232-3-0x000000007488E000-0x000000007488F000-memory.dmp
memory/1232-4-0x0000000074880000-0x0000000075031000-memory.dmp