Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
29-09-2024 13:59
General
-
Target
cce.exe
-
Size
45KB
-
MD5
18adc608d089e4f05ad09c9e9b1be433
-
SHA1
f82e2c7e1c863566f17266340ff4107818bcab78
-
SHA256
3f43d97c072c3f0036843ff4f0f7b9545e867bb1bcaedad4306878570f11e5cd
-
SHA512
21057e5bc02bf313dd04e4061df0606f2f5634b8d688d7c7072a2f22aac2e170273fa651355a8bd7c8bb9a819a47f9769a7e2af12a22c985bca17edcf0d6edac
-
SSDEEP
768:cdhO/poiiUcjlJIn1lH9Xqk5nWEZ5SbTDa0WI7CPW5h:Ww+jjgnLH9XqcnW85SbTtWI5
Score
10/10
Malware Config
Extracted
Family
xenorat
C2
0.tcp.eu.ngrok.io
Mutex
Xeno_rat_nd8912d
Attributes
-
delay
5000
-
install_path
nothingset
-
port
17931
-
startup_name
nothingset
Signatures
-
Detect XenoRat Payload 1 IoCs
-
XenorRat
XenorRat is a remote access trojan written in C#.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\cce.exe"C:\Users\Admin\AppData\Local\Temp\cce.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB