Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
29-12-2024 14:46
General
-
Target
ag.exe
-
Size
45KB
-
MD5
0a257417be0b566dc344d4f8cfd62ace
-
SHA1
3cbae1f578344bc133910e30f3ea0b5b6a3017e5
-
SHA256
0f6272e9838fd19e33cbe0eebb86f7c40d5f05a816714c7b6800f49815ddabd1
-
SHA512
703e8c9380866cab8c426755ef20801bad96ac200749240a67633a21321c7dddef3d608f384427a7d045de5642d122650ed2050557d00699da731c8a1008f73c
-
SSDEEP
768:tdhO/poiiUcjlJInUFzH9Xqk5nWEZ5SbTDa5WI7CPW5V:jw+jjgnQH9XqcnW85SbTQWId
Score
10/10
Malware Config
Extracted
Family
xenorat
C2
release-adrian.gl.at.ply.gg
Mutex
Xeno_rat_nd8912d
Attributes
-
delay
5000
-
install_path
nothingset
-
port
42627
-
startup_name
nothingset
Signatures
-
Detect XenoRat Payload 1 IoCs
-
XenorRat
XenorRat is a remote access trojan written in C#.
-
Xenorat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ag.exe"C:\Users\Admin\AppData\Local\Temp\ag.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB