Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-01-2025 03:16
General
-
Target
7cc5e330c3c53f76341b2901bb1f48a32a0d0b4a897d1bc33925270696f40bce.exe
-
Size
211KB
-
MD5
6fb46f2f43c2cca4250c3acf5254b827
-
SHA1
8967e19260d8638a0afb7171d917ad7b70df0900
-
SHA256
7cc5e330c3c53f76341b2901bb1f48a32a0d0b4a897d1bc33925270696f40bce
-
SHA512
24565194f406feb006e53905523ab6193f244ee627f9c5b5c98459018cef9213cb9566d269e98f30bb1c93fa34e339c8deca96ff76be14ad37b6398e96bc1502
-
SSDEEP
3072:Ew+jqFlFfG91UbT7CgZGWJk5ArMtnoLTL8k8xhX:NWmG91UbSg8WJkxWL8N
Malware Config
Extracted
xenorat
64.52.80.67
Xeno_rat_nd8912d
-
delay
5000
-
install_path
appdata
-
port
4444
-
startup_name
SnapHack
Signatures
-
Detect XenoRat Payload 2 IoCs
-
XenorRat
XenorRat is a remote access trojan written in C#.
-
Xenorat family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7cc5e330c3c53f76341b2901bb1f48a32a0d0b4a897d1bc33925270696f40bce.exe"C:\Users\Admin\AppData\Local\Temp\7cc5e330c3c53f76341b2901bb1f48a32a0d0b4a897d1bc33925270696f40bce.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XenoManager\7cc5e330c3c53f76341b2901bb1f48a32a0d0b4a897d1bc33925270696f40bce.exe"C:\Users\Admin\AppData\Roaming\XenoManager\7cc5e330c3c53f76341b2901bb1f48a32a0d0b4a897d1bc33925270696f40bce.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "SnapHack" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC469.tmp" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
Filesize
1KB
MD5f83cf453372977de078738988406f951
SHA1e48bd75bfe97f1b215c60d53908aea35d2acd900
SHA256fbcf269c63c0bb88f2d4dd312aaa99668fd692f2182b1508e72ec3e022e2c5c0
SHA512add2724a1657eac088951a201d213715affbe3a1f71df2392699566c5ca5f9e9c0286af5ab62f65cca30841b99594eccd9c5776e135d59cb79a748b6495d6887
-
Filesize
211KB
MD56fb46f2f43c2cca4250c3acf5254b827
SHA18967e19260d8638a0afb7171d917ad7b70df0900
SHA2567cc5e330c3c53f76341b2901bb1f48a32a0d0b4a897d1bc33925270696f40bce
SHA51224565194f406feb006e53905523ab6193f244ee627f9c5b5c98459018cef9213cb9566d269e98f30bb1c93fa34e339c8deca96ff76be14ad37b6398e96bc1502
-
Filesize
4KB
-
Filesize
232KB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
7.7MB