xenorat | 02b05f38602f3f153a01bc5585e7a7482852bfb964cc8865905b584e62eb71b6

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17/03/2025, 11:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Mt5_Servers.exe
Size

200KB
MD5

5d2230f9507200accc5a6defc551bdf3
SHA1

d502142597ff51da2124c3688ec677a81206f3ea
SHA256

02b05f38602f3f153a01bc5585e7a7482852bfb964cc8865905b584e62eb71b6
SHA512

31e9be6b7f98f2723ef8dc3e7863ccb0b9220368f013fa7735c4404d859a139753172758302b1844b9a9d8072ac0d734fa67d9d7bdb67ea41b1a20f98c9edd9e
SSDEEP

3072:Gw+jqOM91UbTYC105VQq44DCFkoQDmH7J3XnXLanJpg3Efv:zWhM91UbYCW5M7JHGnJN

Score

10^/10

xenorat defense_evasion discovery privilege_escalation rat trojan

Malware Config

Extracted

Family

xenorat

83.50.225.25

Mutex

Xeno_rat_nd8912d

Attributes

delay
5000
install_path
appdata
port
4892
startup_name
Mt5 Servers

Signatures

Detect XenoRat Payload 7 IoCs

resource	yara_rule
behavioral1/memory/2460-1-0x0000000000890000-0x00000000008C8000-memory.dmp	family_xenorat
behavioral1/files/0x0008000000016ca5-7.dat	family_xenorat
behavioral1/memory/2180-10-0x0000000000D20000-0x0000000000D58000-memory.dmp	family_xenorat
behavioral1/memory/2180-16-0x0000000000B00000-0x0000000000B12000-memory.dmp	family_xenorat
behavioral1/memory/2180-118-0x0000000000B20000-0x0000000000B2C000-memory.dmp	family_xenorat
behavioral1/memory/2180-151-0x0000000000B30000-0x0000000000B3A000-memory.dmp	family_xenorat
behavioral1/memory/2180-248-0x0000000000B90000-0x0000000000B9A000-memory.dmp	family_xenorat

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat
Xenorat family
xenorat

Executes dropped EXE 1 IoCs

pid	Process
2180	Mt5_Servers.exe

Loads dropped DLL 1 IoCs

pid	Process
2460	Mt5_Servers.exe

Abuse Elevation Control Mechanism: Bypass User Account Control 1 TTPs 1 IoCs

UAC Bypass Attempt via SilentCleanup Task.

defense_evasion privilege_escalation

Bypass User Account Control

T1548.002

pid	Process
1048	SCHTASKS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mt5_Servers.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mt5_Servers.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SCHTASKS.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\ms-settings\Shell\Open\command	Mt5_Servers.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\ms-settings\Shell\Open	Mt5_Servers.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\ms-settings\Shell\Open\command\DelegateExecute	Mt5_Servers.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\ms-settings\Shell\Open\command	Mt5_Servers.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\ms-settings	Mt5_Servers.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\ms-settings	Mt5_Servers.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\ms-settings\Shell	Mt5_Servers.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\ms-settings\Shell\Open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\XenoManager\\Mt5_Servers.exe\""	Mt5_Servers.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\ms-settings\Shell\Open	Mt5_Servers.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\ms-settings\Shell	Mt5_Servers.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2836	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3004	vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe
2180	Mt5_Servers.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3004	vlc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2180	Mt5_Servers.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
3004	vlc.exe
3004	vlc.exe
3004	vlc.exe
3004	vlc.exe
3004	vlc.exe
3004	vlc.exe
3004	vlc.exe
3004	vlc.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
3004	vlc.exe
3004	vlc.exe
3004	vlc.exe
3004	vlc.exe
3004	vlc.exe
3004	vlc.exe
3004	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3004	vlc.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2180	2460	Mt5_Servers.exe	30
PID 2460 wrote to memory of 2180	2460	Mt5_Servers.exe	30
PID 2460 wrote to memory of 2180	2460	Mt5_Servers.exe	30
PID 2460 wrote to memory of 2180	2460	Mt5_Servers.exe	30
PID 2180 wrote to memory of 2836	2180	Mt5_Servers.exe	33
PID 2180 wrote to memory of 2836	2180	Mt5_Servers.exe	33
PID 2180 wrote to memory of 2836	2180	Mt5_Servers.exe	33
PID 2180 wrote to memory of 2836	2180	Mt5_Servers.exe	33
PID 2180 wrote to memory of 1048	2180	Mt5_Servers.exe	38
PID 2180 wrote to memory of 1048	2180	Mt5_Servers.exe	38
PID 2180 wrote to memory of 1048	2180	Mt5_Servers.exe	38
PID 2180 wrote to memory of 1048	2180	Mt5_Servers.exe	38
PID 2180 wrote to memory of 1976	2180	Mt5_Servers.exe	40
PID 2180 wrote to memory of 1976	2180	Mt5_Servers.exe	40
PID 2180 wrote to memory of 1976	2180	Mt5_Servers.exe	40
PID 2180 wrote to memory of 1976	2180	Mt5_Servers.exe	40

C:\Users\Admin\AppData\Local\Temp\Mt5_Servers.exe
"C:\Users\Admin\AppData\Local\Temp\Mt5_Servers.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Users\Admin\AppData\Roaming\XenoManager\Mt5_Servers.exe
  "C:\Users\Admin\AppData\Roaming\XenoManager\Mt5_Servers.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /Create /TN "Mt5 Servers" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA592.tmp" /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2836
- - C:\Windows\SysWOW64\SCHTASKS.exe
    "SCHTASKS.exe" /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I
    3⤵
    - Abuse Elevation Control Mechanism: Bypass User Account Control
    - System Location Discovery: System Language Discovery
    PID:1048
- - C:\Windows\system32\cmd.exe
    cmd /c start "" "%windir%\system32\fodhelper.exe"
    3⤵
    PID:1976

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2760

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RevokeLimit.M2TS"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpA592.tmp

Filesize
1KB

MD5
c37d1bd58f29daae6573ed1ab1b00763

SHA1
3ade010a47d3f9fd5964c3990ebca5f568bc4001

SHA256
52b097cec40ccdb94fae545fe77de2a3e5f4fd0d1935aa069bac20fd3ca515ea

SHA512
6beb0ee089a9d044233634771de0a895bf87e2f040f663f348199cd3682885d3dc05f53182a9eca578cbc13c8ae5395cd94ffb2268b9c04d923d6f3d36e0e72b

Download Submit
C:\Users\Admin\AppData\Roaming\XenoManager\Mt5_Servers.exe

Filesize
200KB

MD5
5d2230f9507200accc5a6defc551bdf3

SHA1
d502142597ff51da2124c3688ec677a81206f3ea

SHA256
02b05f38602f3f153a01bc5585e7a7482852bfb964cc8865905b584e62eb71b6

SHA512
31e9be6b7f98f2723ef8dc3e7863ccb0b9220368f013fa7735c4404d859a139753172758302b1844b9a9d8072ac0d734fa67d9d7bdb67ea41b1a20f98c9edd9e

Download Submit
memory/2180-13-0x0000000074120000-0x000000007480E000-memory.dmp

Filesize
6.9MB

Download
memory/2180-9-0x000000007412E000-0x000000007412F000-memory.dmp

Filesize
4KB

Download
memory/2180-10-0x0000000000D20000-0x0000000000D58000-memory.dmp

Filesize
224KB

Download
memory/2180-14-0x000000007412E000-0x000000007412F000-memory.dmp

Filesize
4KB

Download
memory/2180-15-0x0000000074120000-0x000000007480E000-memory.dmp

Filesize
6.9MB

Download
memory/2180-16-0x0000000000B00000-0x0000000000B12000-memory.dmp

Filesize
72KB

Download
memory/2180-248-0x0000000000B90000-0x0000000000B9A000-memory.dmp

Filesize
40KB

Download
memory/2180-151-0x0000000000B30000-0x0000000000B3A000-memory.dmp

Filesize
40KB

Download
memory/2180-118-0x0000000000B20000-0x0000000000B2C000-memory.dmp

Filesize
48KB

Download
memory/2460-1-0x0000000000890000-0x00000000008C8000-memory.dmp

Filesize
224KB

Download
memory/2460-0-0x000000007481E000-0x000000007481F000-memory.dmp

Filesize
4KB

Download
memory/3004-48-0x000007FEF4A10000-0x000007FEF4A38000-memory.dmp

Filesize
160KB

Download
memory/3004-45-0x000007FEF4AC0000-0x000007FEF4B3C000-memory.dmp

Filesize
496KB

Download
memory/3004-28-0x000007FEF7AE0000-0x000007FEF7AF7000-memory.dmp

Filesize
92KB

Download
memory/3004-27-0x000007FEF7B00000-0x000007FEF7B11000-memory.dmp

Filesize
68KB

Download
memory/3004-26-0x000007FEFAE00000-0x000007FEFAE17000-memory.dmp

Filesize
92KB

Download
memory/3004-24-0x000007FEF60B0000-0x000007FEF6366000-memory.dmp

Filesize
2.7MB

Download
memory/3004-31-0x000007FEF66D0000-0x000007FEF66E1000-memory.dmp

Filesize
68KB

Download
memory/3004-50-0x000007FEF49C0000-0x000007FEF49D8000-memory.dmp

Filesize
96KB

Download
memory/3004-49-0x000007FEF49E0000-0x000007FEF4A04000-memory.dmp

Filesize
144KB

Download
memory/3004-30-0x000007FEF6AE0000-0x000007FEF6AFD000-memory.dmp

Filesize
116KB

Download
memory/3004-51-0x000007FEF4990000-0x000007FEF49B3000-memory.dmp

Filesize
140KB

Download
memory/3004-52-0x000007FEF4970000-0x000007FEF4981000-memory.dmp

Filesize
68KB

Download
memory/3004-53-0x000007FEF4950000-0x000007FEF4962000-memory.dmp

Filesize
72KB

Download
memory/3004-47-0x000007FEF4A40000-0x000007FEF4A97000-memory.dmp

Filesize
348KB

Download
memory/3004-46-0x000007FEF4AA0000-0x000007FEF4AB1000-memory.dmp

Filesize
68KB

Download
memory/3004-29-0x000007FEF7AC0000-0x000007FEF7AD1000-memory.dmp

Filesize
68KB

Download
memory/3004-44-0x000007FEF4B40000-0x000007FEF4BA7000-memory.dmp

Filesize
412KB

Download
memory/3004-43-0x000007FEF4BB0000-0x000007FEF4BE0000-memory.dmp

Filesize
192KB

Download
memory/3004-42-0x000007FEF4BE0000-0x000007FEF4BF8000-memory.dmp

Filesize
96KB

Download
memory/3004-41-0x000007FEF4C00000-0x000007FEF4C11000-memory.dmp

Filesize
68KB

Download
memory/3004-40-0x000007FEF4C20000-0x000007FEF4C3B000-memory.dmp

Filesize
108KB

Download
memory/3004-39-0x000007FEF4C40000-0x000007FEF4C51000-memory.dmp

Filesize
68KB

Download
memory/3004-38-0x000007FEF4C60000-0x000007FEF4C71000-memory.dmp

Filesize
68KB

Download
memory/3004-37-0x000007FEF4C80000-0x000007FEF4C91000-memory.dmp

Filesize
68KB

Download
memory/3004-36-0x000007FEF4CA0000-0x000007FEF4CB8000-memory.dmp

Filesize
96KB

Download
memory/3004-35-0x000007FEF6650000-0x000007FEF6671000-memory.dmp

Filesize
132KB

Download
memory/3004-34-0x000007FEF6680000-0x000007FEF66C1000-memory.dmp

Filesize
260KB

Download
memory/3004-32-0x000007FEF4ED0000-0x000007FEF5F80000-memory.dmp

Filesize
16.7MB

Download
memory/3004-33-0x000007FEF4CC0000-0x000007FEF4ECB000-memory.dmp

Filesize
2.0MB

Download
memory/3004-25-0x000007FEFB0B0000-0x000007FEFB0C8000-memory.dmp

Filesize
96KB

Download
memory/3004-23-0x000007FEFB1C0000-0x000007FEFB1F4000-memory.dmp

Filesize
208KB

Download
memory/3004-22-0x000000013F180000-0x000000013F278000-memory.dmp

Filesize
992KB

Download