Overview

overview

10

Static

static

10

XenoRat.exe

windows7-x64

10

XenoRat.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    133s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-07-2024 17:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    XenoRat.exe

  • Size

    45KB

  • MD5

    3afe27a9c4712a61208c88278b611add

  • SHA1

    d53eedc05a1bb370f271f32f40abfb12929c4293

  • SHA256

    f028a4628d7d5156c4f841ebaf32ac8ee1287c18bb44c3517b402e871faa1eb0

  • SHA512

    0d60a1009d31a617b487cdc52503bcb414a1cb8281fb9f17306c0b216d879381557930e05c3fd146568ccfe72dc7ec53870a1c74a4b4563fce0ac47f14750665

  • SSDEEP

    768:1dhO/poiiUcjlJInXYH9Xqk5nWEZ5SbTDa+uI7CPW5k:Lw+jjgnIH9XqcnW85SbT7uI8

Score
10/10
xenoratrattrojan

Malware Config

Extracted

Family

xenorat

C2

taking-headquarters.gl.at.ply.gg

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    5000

  • install_path

    nothingset

  • port

    3069

  • startup_name

    nothingset

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\XenoRat.exe
    "C:\Users\Admin\AppData\Local\Temp\XenoRat.exe"
    1⤵
      PID:2256
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4108,i,8998666007764333392,14724298544432336038,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
      1⤵
        PID:4292

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2256-0-0x0000000074F6E000-0x0000000074F6F000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2256-1-0x00000000000B0000-0x00000000000C2000-memory.dmp

        Filesize

        72KB

        Download

      • memory/2256-2-0x0000000074F60000-0x0000000075710000-memory.dmp

        Filesize

        7.7MB

        Download

      • memory/2256-3-0x0000000074F6E000-0x0000000074F6F000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2256-4-0x0000000074F60000-0x0000000075710000-memory.dmp

        Filesize

        7.7MB

        Download