xenorat | hxxps://github[.]com/moom825/xeno-rat

Resubmissions

16/03/2025, 09:02

250316-kzsg9szpz4 10

16/03/2025, 08:58

250316-kxfqpawzgt 10

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20250314-en
resource tags

arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
submitted
16/03/2025, 09:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/moom825/xeno-rat

Score

10^/10

xenorat discovery rat trojan

Malware Config

Extracted

Family

xenorat

127.0.0.1

Mutex

Xeno_rat_nd8912d

Attributes

delay
5000
install_path
temp
port
4444
startup_name
JavaUpdater

Signatures

Detect XenoRat Payload 3 IoCs

resource	yara_rule
behavioral1/files/0x001c00000002b5d7-571.dat	family_xenorat
behavioral1/memory/3188-643-0x0000000000CE0000-0x0000000000CF2000-memory.dmp	family_xenorat
behavioral1/memory/2036-690-0x0000000005880000-0x000000000588A000-memory.dmp	family_xenorat

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat
Xenorat family
xenorat

Executes dropped EXE 2 IoCs

pid	Process
3188	Bootstraper.exe
2036	Bootstraper.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
36	raw.githubusercontent.com
37	raw.githubusercontent.com
38	raw.githubusercontent.com

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_232187371\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_2059365676\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_2059365676\shoppingfre.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_2059365676\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_232187371\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_232187371\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_2059365676\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_2059365676\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_2059365676\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_2059365676\shopping_fre.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_232187371\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_232187371\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_860747789\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_2059365676\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_2059365676\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_2059365676\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_2059365676\shopping.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_2059365676\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_860747789\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_860747789\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_2059365676\edge_tracking_page_validator.js	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xeno rat server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstraper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstraper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133865893697159086"	msedge.exe

Modifies registry class 63 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	xeno rat server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 78003100000000006e5a89711100557365727300640009000400efbec5522d60705a57482e0000006c0500000000010000000000000000003a00000000007f18ca0055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	xeno rat server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	xeno rat server.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3920535620-1286624088-2946613906-1000\{5A864B5A-FAEB-45D8-8AB0-FEDC31CC9214}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	xeno rat server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\MRUListEx = 00000000ffffffff	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\MRUListEx = 00000000ffffffff	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\NodeSlot = "3"	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	xeno rat server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	xeno rat server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	xeno rat server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0 = 50003100000000006e5a3478100041646d696e003c0009000400efbe6e5a8971705a57482e0000003857020000000100000000000000000000000000000073aff600410064006d0069006e00000014000000	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0 = 7e003100000000006e5a187711004465736b746f7000680009000400efbe6e5a8971705a61482e000000425702000000010000000000000000003e00000000002d45fa004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	xeno rat server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\MRUListEx = ffffffff	xeno rat server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 19002f433a5c000000000000000000000000000000000000000000	xeno rat server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = 00000000ffffffff	xeno rat server.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	xeno rat server.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Release.zip:Zone.Identifier	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5408	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
420	msedge.exe
420	msedge.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe
2036	Bootstraper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1008	xeno rat server.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2036	Bootstraper.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
1008	xeno rat server.exe
1008	xeno rat server.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
5608	msedge.exe
1008	xeno rat server.exe
1008	xeno rat server.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1008	xeno rat server.exe
1008	xeno rat server.exe
1008	xeno rat server.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5608 wrote to memory of 480	5608	msedge.exe	78
PID 5608 wrote to memory of 480	5608	msedge.exe	78
PID 5608 wrote to memory of 4172	5608	msedge.exe	79
PID 5608 wrote to memory of 4172	5608	msedge.exe	79
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 1076	5608	msedge.exe	80
PID 5608 wrote to memory of 2248	5608	msedge.exe	82
PID 5608 wrote to memory of 2248	5608	msedge.exe	82
PID 5608 wrote to memory of 2248	5608	msedge.exe	82
PID 5608 wrote to memory of 2248	5608	msedge.exe	82
PID 5608 wrote to memory of 2248	5608	msedge.exe	82
PID 5608 wrote to memory of 2248	5608	msedge.exe	82
PID 5608 wrote to memory of 2248	5608	msedge.exe	82
PID 5608 wrote to memory of 2248	5608	msedge.exe	82
PID 5608 wrote to memory of 2248	5608	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/moom825/xeno-rat
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x250,0x7ffa1891f208,0x7ffa1891f214,0x7ffa1891f220
  2⤵
  PID:480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1904,i,453522152385432651,11457079802492190717,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:11
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2112,i,453522152385432651,11457079802492190717,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2464,i,453522152385432651,11457079802492190717,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:13
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3432,i,453522152385432651,11457079802492190717,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3440,i,453522152385432651,11457079802492190717,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4836,i,453522152385432651,11457079802492190717,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5464,i,453522152385432651,11457079802492190717,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5472,i,453522152385432651,11457079802492190717,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5308,i,453522152385432651,11457079802492190717,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5164,i,453522152385432651,11457079802492190717,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5164,i,453522152385432651,11457079802492190717,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5048,i,453522152385432651,11457079802492190717,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
  2⤵
  PID:3504
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6324,i,453522152385432651,11457079802492190717,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=6304,i,453522152385432651,11457079802492190717,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6364,i,453522152385432651,11457079802492190717,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
  2⤵
  - NTFS ADS
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=6856,i,453522152385432651,11457079802492190717,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3504,i,453522152385432651,11457079802492190717,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:14
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6212,i,453522152385432651,11457079802492190717,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:14
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4596,i,453522152385432651,11457079802492190717,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:14
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5532,i,453522152385432651,11457079802492190717,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6200,i,453522152385432651,11457079802492190717,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5520,i,453522152385432651,11457079802492190717,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5484,i,453522152385432651,11457079802492190717,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6236,i,453522152385432651,11457079802492190717,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:420

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4592

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3716

C:\Users\Admin\Downloads\Release\xeno rat server.exe
"C:\Users\Admin\Downloads\Release\xeno rat server.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1008
- C:\Users\Admin\Downloads\Bootstraper.exe
  "C:\Users\Admin\Downloads\Bootstraper.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3188
- - C:\Users\Admin\AppData\Local\Temp\XenoManager\Bootstraper.exe
    "C:\Users\Admin\AppData\Local\Temp\XenoManager\Bootstraper.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2036
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Create /TN "JavaUpdater" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDC42.tmp" /F
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5408

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- System Location Discovery: System Language Discovery
PID:1000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Bootstraper.exe.log

Filesize
226B

MD5
1294de804ea5400409324a82fdc7ec59

SHA1
9a39506bc6cadf99c1f2129265b610c69d1518f7

SHA256
494398ec6108c68573c366c96aae23d35e7f9bdbb440a4aab96e86fcad5871d0

SHA512
033905cc5b4d0c0ffab2138da47e3223765146fa751c9f84b199284b653a04874c32a23aae577d2e06ce6c6b34fec62331b5fc928e3baf68dc53263ecdfa10c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
509e630f2aea0919b6158790ecedff06

SHA1
ba9a6adff6f624a938f6ac99ece90fdeadcb47e7

SHA256
067308f8a68703d3069336cb4231478addc400f1b5cbb95a5948e87d9dc4f78b

SHA512
1cb2680d3b8ddef287547c26f32be407feae3346a8664288de38fe6157fb4aeceb72f780fd21522417298e1639b721b96846d381da34a5eb1f3695e8e6ef7264

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
a1113c5cc66162d716959b98e10a198b

SHA1
97798f7e0ca857bbb734ade7b793d6381df33703

SHA256
70ad2e9027fb9edfd2dceb88dc4cc6602ca962b688b0a8ee1a2125f82ad00308

SHA512
8504ca2b960672c47b21a839b859c29db90bf190eedc54bfda9094747be3c0da14e8f485954bccaa710cb49bf3662e294500eaeb2dcb3679b5665edc43e2ded1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57ce0e.TMP

Filesize
3KB

MD5
26a8e4a129e3185bed360adaa9e62525

SHA1
fe31599b3d3a22118b08afa7e46ac38bba70ecdf

SHA256
1c9a92c966b55e7b98f42a4519f81becceff5505f2877c09dfa57da504069fd6

SHA512
2aac285182842f9617f1428ef1dd7d1151f8f907606f8d16e9052ab696e8851500c45559126b013fc019563a11a9530b2626ef11feffaac40e0ff2bb4a59712d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
0c524fd3d328909ffd674a956bc0d581

SHA1
a6d8c1c35745ab44d9add963be06ba45326ab375

SHA256
7b9cc77ed73a8d94af5828d876d2a5609f1f87a14b21d4d24598b30192b306ac

SHA512
a604e54189e0fa88c158386a169bd27c7e318cd518f4b4c728bff916a5eb56bce270e4e09dd3ef772a7ac1acb95161fdd0026bbbe29384b541910c7b9a22a477

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
411KB

MD5
3e1f200c50f04902b90c71e5faaf6025

SHA1
de0e5469442108a45c2c6003d57547acef7aa555

SHA256
c33d574b1e2bfe3979e98e9f4358a3d0c3b2d141ed04d99e9edc9d384a71229a

SHA512
5d46dd98b272291b7746891ad9710b9d1652bfe69395037009b12537fb98aa81564d1f5f236dc3a9b9e788cb21dd97265ff1d457914ef27424ac9c72c4f80ccb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
412KB

MD5
a256d0f44622712e7a214e849c6eb589

SHA1
241cfa317d638f83fe48d0a5abe73ee8aa6f2fb5

SHA256
84f55132587de143becbe8c7d311ad216045fc5a35f0932467865d37518ea7a3

SHA512
4d64afedcf452b57e842184e0e8dcd83476105d436f3f8c5fd4f6e394714e248bd6caeebb02b4672ad0c5dd0f0eab0a62f4191851fcfe7f4de09f13fa0a4c9dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
411KB

MD5
ad647f919dda1a8f73f625319324d63c

SHA1
44fb62024a1eb53352ecdaa86145096fe3dffd7d

SHA256
78b761a4e5e1a3bb2b60769d805e047d2af6f6393f3d1fde70870575f60e8376

SHA512
6577b2ca24a5d7a9eff804e85aa81e45fd98656cd99111152380df66a45c805448b01b821453f3298c45d3786c3779dbe86dad3e02139ca218565f33acdd9832

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
fd0327780815afe1ae6ed5ff97350f4c

SHA1
3a150a7a56c130e7ea01b73ce41a0b3ed1bc4ba5

SHA256
cf8267365a059826a82a0d90201ccf36aabec32d2f39dfa50d9c45822c2ddbe9

SHA512
d3a8643ca40b86b93d9bfa563e4e4cf2c2a7155ef8164e17513e9448c2a9aa3517acc9e0e0f270ddcbf07065d9c97810375fd0d2bf47fd277cf3d5adc2b23a86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
1d8edab4d70e7d3bfaae4c6de36d8c5a

SHA1
caa10814697dc8f0522b05108fe006276e9bd432

SHA256
624108ca3dc41d0c0ec3bedccfe9d70825fef91745d15394d2d654ce4d39e2cb

SHA512
26d6ab8a3f7cca7d88c159d1d7fe7e565e7f67fc0805a8f9fbc52c6bbc0b07a47e791826850bcef117b2e52a4d69138a4924fa8093513060bf7c481363338307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
460B

MD5
c23f9caa8763e486ee0e303c9cbe2fa7

SHA1
ccecaa0b5204fcd60ec32b47db623078d9f4e4b5

SHA256
c439e69df0e9f4466cdf1dcd38c1fadce1d313ebd6c064c47adaf8f6e5ac5012

SHA512
a0ff4aa7eb21744e203d4de95a19a27d7477410990954c0074ad3abf21da93ded5c8a28ce5b62c0af6ffd087d61e712968dc8ed8a704bb62733616c4f0225748

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
f7fa8f6950c686c145557b04a7a99f65

SHA1
c2bd1c8f7e83d77aaec887ca9cfb24d1d6f915c2

SHA256
a9998380f65bda0aa72b0961b0e232b0dc85b48e8d931c29230c2446f59f9e9c

SHA512
c682d38198fe4c6562d49c0a905bcacfaceb875691d75ec50818de6950fad79e71f9c7158d6ae4fa981b0ec2a764a82ca3d0f347b3e54413656e213f3347de26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
890932d3abb4c41b385c40a628a04753

SHA1
9e9424ccf76818a7d655cff6a3effe41ca851d24

SHA256
3b9e8b8ff5be6cebe0d0954abc2d4f251bcb8e90e22ede4088564ae8e454d0d7

SHA512
865c8e5ea2cc6bf6d615c30a6b36f40f5e4b4b7776ea98886403009eaeb7814da53cb7331fda1138e5f2f75fb42c577cc2d9a58f88e89c368a3c74e3128c1dda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
1d8035edc19c7c44c4af1ee4a047047e

SHA1
6f4093bceb77e5b2285cc3ad821b8011066520f7

SHA256
70e6a7e7d95064d755c86f22598894d787760229e9128b8d9d6d3c8fe97c4686

SHA512
eef7da2c650e327c0cce7a7757e8a9ea746e75a91d117c001a52105ad62667671812383520f300685168da8f149befeb3fd490dcd466246cd65df1d9e2cc6649

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
7d1ab4b58af365ceb3df0752cdaf8e81

SHA1
f54acf504bf473411f48f2ed8079432327d86798

SHA256
4cfafaad8d5bdd45103b7fc121a652854618b016cd1177f5f6ca8039cd775d72

SHA512
f7524d7a192bcc0248feecf091d706cfd8e681428fc05285e8d3b9c36905893672c80497adfd6f2fca7ddbe26f4c9019f75c96c32134d68d8774bf077a1dd133

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
e71e2514b0a4b2bcd8d53022a5a1cbd7

SHA1
df257151af30780261abdb1d6539eeb0ffb37caa

SHA256
9d3d892509a03b2953a6cfee7c56ef2817242e3f6130bb0b00e66836c1fc4ab4

SHA512
aaaf43051aaa984f622d6179e02b627b417d741ec7b5c19cfe90af003bec5e55a6853c14eded88b9a3ddeb53df89528a0df72438ab3764a41af47fda883a07a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.16.1\typosquatting_list.pb

Filesize
631KB

MD5
c3ec8bf0a625c2583833a3340825f1cb

SHA1
582054710a312897117128ed59ddadc983525eb6

SHA256
7d10e035e0b2e152a1fe32a92b0b34295a979f7db2269cfba69d4aaf3401b77f

SHA512
175125259eb39225d0584fa4e3c5cbfc66bd22646cf32677f0eb7514a0abeb2c08118375210a69207be85e6e7ebdd9b6fa9a967d3c4ecd40ecd514e306873c6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpDC42.tmp

Filesize
1KB

MD5
6638ce32ddb58502d894996e3271b27c

SHA1
c6e86354db236991d0e5c7047fdc945e92039bf2

SHA256
9aba606d39c73759f2b69d88fc6668b9ed9aa68dba673d18298de359040c6531

SHA512
129bf388bcfee1d15fed41bb8f4ec8efa9cc80009a3eb3854f49d33e260319e68834930edb748fd7e7c624539b7fd5ca87161f760e388dbc228278fd84bbe85c

Download Submit
C:\Users\Admin\Downloads\Bootstraper.exe

Filesize
45KB

MD5
164ab3cb7bb5f78b44030428c99f3e66

SHA1
dada78f81dd876175ecc7ba8ce163054b50aec7a

SHA256
7420c6441a0300ad5f8d34cfdcb7ef5259c2165c6ccbc7d683635d32e530e8b3

SHA512
dfb6876f42b6fa688a56a1079636af762a3e17c5d8d94544b95c727936702b2620888992604ce334e04c794eab70e3d73e05d87eaf0d0d5fa01b913ed99414bb

Download Submit
C:\Users\Admin\Downloads\Release.zip.crdownload

Filesize
6.4MB

MD5
89661a9ff6de529497fec56a112bf75e

SHA1
2dd31a19489f4d7c562b647f69117e31b894b5c3

SHA256
e7b275d70655db9cb43fa606bbe2e4f22478ca4962bbf9f299d66eda567d63cd

SHA512
33c765bf85fbec0e58924ece948b80a7d73b7577557eaac8865e481c61ad6b71f8b5b846026103239b3bd21f438ff0d7c1430a51a4a149f16a215faad6dab68f

Download Submit
C:\Users\Admin\Downloads\Release.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_2059365676\manifest.json

Filesize
145B

MD5
0df2306638bd60162686e9c4bafbd505

SHA1
ef9e16bf867f7950d5a30172e1d34d38686b0e72

SHA256
fd7b554588c5e72506a0bfed89bc298911a5649b9f5168ad7c1804d1c75de42e

SHA512
73fca229097631104cf352061d62455b6c5520bf59777520165719d2368b0e77f3ce66f52873fec53ac60e35274bf397ba321bc62610f0b7b172a7c5c4975174

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_232187371\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_232187371\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5608_860747789\manifest.json

Filesize
118B

MD5
ffa5fcfeb00002903f6cf667e9fe6a3c

SHA1
ad765ea344c8cfd95a591da8259fe412e52d13b0

SHA256
dd0679c622258bad2e2ddaec3470297259dc68b55b8c4f4d7f2f28a378826217

SHA512
8da9b780e9bc6785efbd56b51a4decc8703c9f1d41b33469153cc0aea8190c1b6a9001128c6022756a66ee539086ad6f787da84b6b7082dc51939077365e7beb

Download Submit
memory/1008-476-0x0000000005B20000-0x0000000005BB2000-memory.dmp

Filesize
584KB

Download
memory/1008-477-0x0000000005B00000-0x0000000005B0A000-memory.dmp

Filesize
40KB

Download
memory/1008-487-0x0000000006EF0000-0x0000000006FA2000-memory.dmp

Filesize
712KB

Download
memory/1008-480-0x0000000006C70000-0x0000000006C82000-memory.dmp

Filesize
72KB

Download
memory/1008-479-0x0000000006C50000-0x0000000006C6A000-memory.dmp

Filesize
104KB

Download
memory/1008-516-0x0000000008ED0000-0x0000000008EEA000-memory.dmp

Filesize
104KB

Download
memory/1008-478-0x0000000006000000-0x0000000006014000-memory.dmp

Filesize
80KB

Download
memory/1008-481-0x000000000A420000-0x000000000A442000-memory.dmp

Filesize
136KB

Download
memory/1008-488-0x0000000009920000-0x0000000009C77000-memory.dmp

Filesize
3.3MB

Download
memory/1008-515-0x00000000091D0000-0x00000000092F4000-memory.dmp

Filesize
1.1MB

Download
memory/1008-474-0x0000000000E20000-0x0000000001022000-memory.dmp

Filesize
2.0MB

Download
memory/1008-689-0x000000000BD60000-0x000000000BD72000-memory.dmp

Filesize
72KB

Download
memory/1008-475-0x0000000006030000-0x00000000065D6000-memory.dmp

Filesize
5.6MB

Download
memory/2036-690-0x0000000005880000-0x000000000588A000-memory.dmp

Filesize
40KB

Download
memory/2036-688-0x00000000053D0000-0x0000000005436000-memory.dmp

Filesize
408KB

Download
memory/3188-643-0x0000000000CE0000-0x0000000000CF2000-memory.dmp

Filesize
72KB

Download