Analysis
-
max time kernel
138s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-12-2024 19:32
General
-
Target
nai.exe
-
Size
45KB
-
MD5
4cbfc61732f67fdd690ff9d578af8f14
-
SHA1
dcb062b56bbe4b9660f4a07e3d7f59a92f6bf3d3
-
SHA256
fa4f97a38443e919cba50e6fe7cf121f4b69305b57eedca93128f016ff289a0f
-
SHA512
768f53ea46ca839fa2f6ddad154d4b0a1c0de3b1c926cfdb986f8790086c92e1de3366796345623195a643a3cf3c9743b5d9990e02c8d736c1a85b76eb225408
-
SSDEEP
768:bdhO/poiiUcjlJInvvH9Xqk5nWEZ5SbTDaJWI7CPW5R:Jw+jjgn3H9XqcnW85SbTAWIJ
Score
10/10
Malware Config
Extracted
Family
xenorat
C2
127.0.0.1
Mutex
Xeno_rat_nd8912d
Attributes
-
delay
5000
-
install_path
nothingset
-
port
4444
-
startup_name
nothingset
Signatures
-
Detect XenoRat Payload 1 IoCs
-
XenorRat
XenorRat is a remote access trojan written in C#.
-
Xenorat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\nai.exe"C:\Users\Admin\AppData\Local\Temp\nai.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB