xenorat | 7cc5e330c3c53f76341b2901bb1f48a32a0d0b4a897d1bc33925270696f40bce

Analysis

max time kernel
149s
max time network
156s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
03-01-2025 19:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fb46f2f43c2cca4250c3acf5254b827.exe
Size

211KB
MD5

6fb46f2f43c2cca4250c3acf5254b827
SHA1

8967e19260d8638a0afb7171d917ad7b70df0900
SHA256

7cc5e330c3c53f76341b2901bb1f48a32a0d0b4a897d1bc33925270696f40bce
SHA512

24565194f406feb006e53905523ab6193f244ee627f9c5b5c98459018cef9213cb9566d269e98f30bb1c93fa34e339c8deca96ff76be14ad37b6398e96bc1502
SSDEEP

3072:Ew+jqFlFfG91UbT7CgZGWJk5ArMtnoLTL8k8xhX:NWmG91UbSg8WJkxWL8N

Score

10^/10

xenorat discovery rat trojan

Malware Config

Extracted

Family

xenorat

64.52.80.67

Mutex

Xeno_rat_nd8912d

Attributes

delay
5000
install_path
appdata
port
4444
startup_name
SnapHack

Signatures

Detect XenoRat Payload 3 IoCs

resource	yara_rule
behavioral1/memory/2412-1-0x0000000000DE0000-0x0000000000E1A000-memory.dmp	family_xenorat
behavioral1/files/0x0009000000016ccc-4.dat	family_xenorat
behavioral1/memory/2532-9-0x0000000001330000-0x000000000136A000-memory.dmp	family_xenorat

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat
Xenorat family
xenorat

Executes dropped EXE 1 IoCs

pid	Process
2532	6fb46f2f43c2cca4250c3acf5254b827.exe

Loads dropped DLL 1 IoCs

pid	Process
2412	6fb46f2f43c2cca4250c3acf5254b827.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6fb46f2f43c2cca4250c3acf5254b827.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6fb46f2f43c2cca4250c3acf5254b827.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2912	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe
2532	6fb46f2f43c2cca4250c3acf5254b827.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2532	6fb46f2f43c2cca4250c3acf5254b827.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2532	2412	6fb46f2f43c2cca4250c3acf5254b827.exe	29
PID 2412 wrote to memory of 2532	2412	6fb46f2f43c2cca4250c3acf5254b827.exe	29
PID 2412 wrote to memory of 2532	2412	6fb46f2f43c2cca4250c3acf5254b827.exe	29
PID 2412 wrote to memory of 2532	2412	6fb46f2f43c2cca4250c3acf5254b827.exe	29
PID 2532 wrote to memory of 2912	2532	6fb46f2f43c2cca4250c3acf5254b827.exe	30
PID 2532 wrote to memory of 2912	2532	6fb46f2f43c2cca4250c3acf5254b827.exe	30
PID 2532 wrote to memory of 2912	2532	6fb46f2f43c2cca4250c3acf5254b827.exe	30
PID 2532 wrote to memory of 2912	2532	6fb46f2f43c2cca4250c3acf5254b827.exe	30

C:\Users\Admin\AppData\Local\Temp\6fb46f2f43c2cca4250c3acf5254b827.exe
"C:\Users\Admin\AppData\Local\Temp\6fb46f2f43c2cca4250c3acf5254b827.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Users\Admin\AppData\Roaming\XenoManager\6fb46f2f43c2cca4250c3acf5254b827.exe
  "C:\Users\Admin\AppData\Roaming\XenoManager\6fb46f2f43c2cca4250c3acf5254b827.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /Create /TN "SnapHack" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3E58.tmp" /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3E58.tmp

Filesize
1KB

MD5
aafd4746858ce39a598c17625c5ae741

SHA1
aa2dc561503dc626411857607667723c0662b0bd

SHA256
08d8d0db0e4f50754ce3c57b5a033232efc7bc052cc299796889753edbd9e11e

SHA512
fe48dd221c4c4f971d265f1ef86dd028529cfce34c2f7cb5e9ebd966922e7e6802aa611e1a71b3b3f8867e9bf6358dcda6d704dfd052a9183c8f5ad9a9ae7855

Download Submit
\Users\Admin\AppData\Roaming\XenoManager\6fb46f2f43c2cca4250c3acf5254b827.exe

Filesize
211KB

MD5
6fb46f2f43c2cca4250c3acf5254b827

SHA1
8967e19260d8638a0afb7171d917ad7b70df0900

SHA256
7cc5e330c3c53f76341b2901bb1f48a32a0d0b4a897d1bc33925270696f40bce

SHA512
24565194f406feb006e53905523ab6193f244ee627f9c5b5c98459018cef9213cb9566d269e98f30bb1c93fa34e339c8deca96ff76be14ad37b6398e96bc1502

Download Submit
memory/2412-0-0x00000000749AE000-0x00000000749AF000-memory.dmp

Filesize
4KB

Download
memory/2412-1-0x0000000000DE0000-0x0000000000E1A000-memory.dmp

Filesize
232KB

Download
memory/2532-9-0x0000000001330000-0x000000000136A000-memory.dmp

Filesize
232KB

Download
memory/2532-10-0x00000000749A0000-0x000000007508E000-memory.dmp

Filesize
6.9MB

Download
memory/2532-13-0x00000000749A0000-0x000000007508E000-memory.dmp

Filesize
6.9MB

Download
memory/2532-14-0x00000000749A0000-0x000000007508E000-memory.dmp

Filesize
6.9MB

Download
memory/2532-15-0x00000000749A0000-0x000000007508E000-memory.dmp

Filesize
6.9MB

Download