Analysis
-
max time kernel
138s -
max time network
147s -
platform
windows10-ltsc_2021_x64 -
resource
win10ltsc2021-20250314-en -
resource tags
-
submitted
31/03/2025, 11:36
General
-
Target
582392.exe
-
Size
45KB
-
MD5
c860dbba55d2b9a69e9f8f768ae7aed7
-
SHA1
7ce0a9b4e46e0fb0c01cb1d935403f8e4e0bcd0d
-
SHA256
5f1d0c1090976094d07e191815db1eeaaa7ed51fd17d49f935d52927d0ab2dc6
-
SHA512
8a262260ba2ce648fa1a92dd2b8d9f8e4eb62af8b1c4c8ca23c1c8a83a8824cb149a1d93ad967dba8d6b10cb8a544afcc2f114bc9c14db34ca1e75d709c626ed
-
SSDEEP
768:RdhO/poiiUcjlJInUvH9Xqk5nWEZ5SbTDaJWI7CPW5M:Pw+jjgnOH9XqcnW85SbTAWIk
Score
10/10
Malware Config
Extracted
Family
xenorat
C2
127.0.0.1
Mutex
Xeno_rat_nd8912d
Attributes
-
delay
5000
-
install_path
nothingset
-
port
58239
-
startup_name
nothingset
Signatures
-
Detect XenoRat Payload 1 IoCs
-
XenorRat
XenorRat is a remote access trojan written in C#.
-
Xenorat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\582392.exe"C:\Users\Admin\AppData\Local\Temp\582392.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB