Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10XenoRat 1.8.7.7z
windows7-x64
10XenoRat 1.8.7.7z
windows10-2004-x64
1XenoRat 1....at.dll
windows7-x64
1XenoRat 1....at.dll
windows10-2004-x64
1XenoRat 1....er.dll
windows7-x64
1XenoRat 1....er.dll
windows10-2004-x64
1XenoRat 1....un.dll
windows7-x64
1XenoRat 1....un.dll
windows10-2004-x64
1XenoRat 1....nc.dll
windows7-x64
1XenoRat 1....nc.dll
windows10-2004-x64
1XenoRat 1....ab.dll
windows7-x64
1XenoRat 1....ab.dll
windows10-2004-x64
1XenoRat 1....er.dll
windows7-x64
1XenoRat 1....er.dll
windows10-2004-x64
1XenoRat 1....ne.dll
windows7-x64
1XenoRat 1....ne.dll
windows10-2004-x64
1XenoRat 1....ne.dll
windows7-x64
1XenoRat 1....ne.dll
windows10-2004-x64
1XenoRat 1....er.dll
windows7-x64
1XenoRat 1....er.dll
windows10-2004-x64
1XenoRat 1....er.dll
windows7-x64
1XenoRat 1....er.dll
windows10-2004-x64
1XenoRat 1....xy.dll
windows7-x64
1XenoRat 1....xy.dll
windows10-2004-x64
1XenoRat 1....ol.dll
windows7-x64
1XenoRat 1....ol.dll
windows10-2004-x64
1XenoRat 1....ll.dll
windows7-x64
1XenoRat 1....ll.dll
windows10-2004-x64
1XenoRat 1....up.dll
windows7-x64
1XenoRat 1....up.dll
windows10-2004-x64
1XenoRat 1....er.dll
windows7-x64
1XenoRat 1....er.dll
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/01/2025, 21:24
Behavioral task
behavioral1
Sample
XenoRat 1.8.7.7z
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
XenoRat 1.8.7.7z
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
XenoRat 1.8.7/plugins/Chat.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
XenoRat 1.8.7/plugins/Chat.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
XenoRat 1.8.7/plugins/File manager.dll
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
XenoRat 1.8.7/plugins/File manager.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
XenoRat 1.8.7/plugins/Fun.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
XenoRat 1.8.7/plugins/Fun.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
XenoRat 1.8.7/plugins/Hvnc.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
XenoRat 1.8.7/plugins/Hvnc.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
XenoRat 1.8.7/plugins/InfoGrab.dll
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
XenoRat 1.8.7/plugins/InfoGrab.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
XenoRat 1.8.7/plugins/KeyLogger.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
XenoRat 1.8.7/plugins/KeyLogger.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
XenoRat 1.8.7/plugins/KeyLoggerOffline.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
XenoRat 1.8.7/plugins/KeyLoggerOffline.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
XenoRat 1.8.7/plugins/LiveMicrophone.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
XenoRat 1.8.7/plugins/LiveMicrophone.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
XenoRat 1.8.7/plugins/ProcessManager.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
XenoRat 1.8.7/plugins/ProcessManager.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
XenoRat 1.8.7/plugins/Registry Manager.dll
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
XenoRat 1.8.7/plugins/Registry Manager.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
XenoRat 1.8.7/plugins/ReverseProxy.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
XenoRat 1.8.7/plugins/ReverseProxy.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
XenoRat 1.8.7/plugins/ScreenControl.dll
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
XenoRat 1.8.7/plugins/ScreenControl.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
XenoRat 1.8.7/plugins/Shell.dll
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
XenoRat 1.8.7/plugins/Shell.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
XenoRat 1.8.7/plugins/Startup.dll
Resource
win7-20241010-en
Behavioral task
behavioral30
Sample
XenoRat 1.8.7/plugins/Startup.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
XenoRat 1.8.7/plugins/SystemPower.dll
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
XenoRat 1.8.7/plugins/SystemPower.dll
Resource
win10v2004-20241007-en
General
-
Target
XenoRat 1.8.7.7z
-
Size
4.7MB
-
MD5
09f1da481eac710c27d4053e6f4a06d3
-
SHA1
04d7832bb566e776f60998fad380d16c56553438
-
SHA256
6fc3870e9addfde6c38be21602172a0404244e05e013db1c65aca737eb47969a
-
SHA512
769bfd09bcf4e60e52b66a4bba200d3996f8ee5628aa80b9a38dc6c44073350dba10d5a194768069de1d08c618e8a03c94f155f0cfe9d9b1ef49999d3650797f
-
SSDEEP
98304:cyoG7UgKzeoYW1u+ecKDDA9NUCIIdjzuvc6QPggDhPxHlmKUlm:cyowUgKzeoLFEINOcpfWm
Malware Config
Extracted
xenorat
localhost
testing 123123
-
delay
1000
-
install_path
nothingset
-
port
1234
-
startup_name
nothingset
Signatures
-
Detect XenoRat Payload 3 IoCs
resource yara_rule behavioral1/files/0x0007000000019346-7.dat family_xenorat behavioral1/memory/2756-15-0x0000000000A10000-0x0000000000A22000-memory.dmp family_xenorat behavioral1/memory/2648-28-0x0000000000980000-0x0000000000992000-memory.dmp family_xenorat -
Xenorat family
-
Executes dropped EXE 3 IoCs
pid Process 2756 xeno rat client.exe 2648 xeno rat client.exe 2812 xeno rat server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno rat client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno rat client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xeno rat server.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 200000001a00eebbfe230000100090e24d373f126545916439c4925e467b00000000 xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 000000000200000001000000ffffffff xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 74003100000000002359a8291100557365727300600008000400efbeee3a851a2359a8292a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 xeno rat server.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" xeno rat server.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff xeno rat server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" xeno rat server.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 xeno rat server.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "2" xeno rat server.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg xeno rat server.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} xeno rat server.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 xeno rat server.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell xeno rat server.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} xeno rat server.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU xeno rat server.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = ffffffff xeno rat server.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" xeno rat server.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 xeno rat server.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" xeno rat server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" xeno rat server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots xeno rat server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" xeno rat server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" xeno rat server.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" xeno rat server.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f44471a0359723fa74489c55595fe6b30ee0000 xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff xeno rat server.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff xeno rat server.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 xeno rat server.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\NodeSlot = "1" xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff xeno rat server.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" xeno rat server.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" xeno rat server.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff xeno rat server.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 xeno rat server.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff xeno rat server.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" xeno rat server.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4c003100000000002359e92c100041646d696e00380008000400efbe2359a8292359e92c2a00000030000000000004000000000000000000000000000000410064006d0069006e00000014000000 xeno rat server.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 xeno rat server.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff xeno rat server.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags xeno rat server.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg xeno rat server.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" xeno rat server.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" xeno rat server.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_Classes\Local Settings xeno rat server.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 xeno rat server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 xeno rat server.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 xeno rat server.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" xeno rat server.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1260 7zFM.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1260 7zFM.exe 2812 xeno rat server.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 1260 7zFM.exe Token: 35 1260 7zFM.exe Token: SeSecurityPrivilege 1260 7zFM.exe Token: SeSecurityPrivilege 1260 7zFM.exe Token: SeSecurityPrivilege 1260 7zFM.exe Token: SeSecurityPrivilege 1260 7zFM.exe Token: SeDebugPrivilege 2812 xeno rat server.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 1260 7zFM.exe 1260 7zFM.exe 1260 7zFM.exe 1260 7zFM.exe 1260 7zFM.exe 1260 7zFM.exe 1260 7zFM.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2812 xeno rat server.exe 2812 xeno rat server.exe 2812 xeno rat server.exe 2812 xeno rat server.exe 2812 xeno rat server.exe 2812 xeno rat server.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1260 wrote to memory of 2756 1260 7zFM.exe 32 PID 1260 wrote to memory of 2756 1260 7zFM.exe 32 PID 1260 wrote to memory of 2756 1260 7zFM.exe 32 PID 1260 wrote to memory of 2756 1260 7zFM.exe 32 PID 1260 wrote to memory of 2648 1260 7zFM.exe 33 PID 1260 wrote to memory of 2648 1260 7zFM.exe 33 PID 1260 wrote to memory of 2648 1260 7zFM.exe 33 PID 1260 wrote to memory of 2648 1260 7zFM.exe 33 PID 1260 wrote to memory of 2812 1260 7zFM.exe 34 PID 1260 wrote to memory of 2812 1260 7zFM.exe 34 PID 1260 wrote to memory of 2812 1260 7zFM.exe 34 PID 1260 wrote to memory of 2812 1260 7zFM.exe 34
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\XenoRat 1.8.7.7z"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\7zOCE4732D6\xeno rat client.exe"C:\Users\Admin\AppData\Local\Temp\7zOCE4732D6\xeno rat client.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2756
-
-
C:\Users\Admin\AppData\Local\Temp\7zOCE422E07\xeno rat client.exe"C:\Users\Admin\AppData\Local\Temp\7zOCE422E07\xeno rat client.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2648
-
-
C:\Users\Admin\AppData\Local\Temp\7zOCE46BE17\xeno rat server.exe"C:\Users\Admin\AppData\Local\Temp\7zOCE46BE17\xeno rat server.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2812
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2884
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD53987ee127f2a2cf8a29573d4e111a8e8
SHA1fc253131e832297967f93190217f0ce403e38cb0
SHA2563d00a800474ddf382212e003222805bd74665b69cec43b554f91c3cd9edf04c4
SHA51269d5ac7a691dde1a3ed7f495e9b9180e63152ddaaa3d1b596ad9cbeb4d7b088f3fc4b138ecf87070014cdfa9047be18940b720de60642389921a10053250787b
-
Filesize
46KB
MD5d23d8120af87a615a456a12b43d4a98a
SHA173b41123d6f50aecdcf1c5e87a7d0319d753b0e7
SHA25627178a08e0d8fb6e5e31ae9bff6194a5224406666fa1f528d4719c1e4a8efd67
SHA51299026704fef97f9f9c01348310f199ad523851e105c7ea1f39312c7370cb6e50af5044fec1041298b96b6e661ac5f48d6af80687e21364806e62738d198ad319