xenorat | 384afed09f41f19ce3b378a5e8955c13e8f5ba54ec0b6682a88fe45f42ddd9d1

Analysis

max time kernel
144s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
14/09/2025, 10:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rat tes.exe
Size 45KB
Sample250914-m25lqasks7
SHA256 384afed09f41f19ce3b378a5e8955c13e8f5ba54ec0b6682a88fe45f42ddd9d1
MD5 0a14897a0ccfa77d9c5c6323a25c06c4
SHA1 0f0a8bddd6235075fc47749d34a7e9f2e414b191
SHA512 4ce9c8e193663714fdc6803e990a4580396626af3732e3e4e72b332838cb41b7277ff916ccf0455d2206c4445543d8649b16205bb308ca862f83ea0e1061d405
SSDEEP 768:ZdhO/poiiUcjlJInzr6BH9Xqk5nWEZ5SbTDaNuI7CPW5Q:Xw+jjgnkH9XqcnW85SbTQuI4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery execution xenorat persistence rat trojan

Malware Config

Extracted

Family

xenorat

super-italic.gl.at.ply.gg

Mutex

Xeno_rat_nd8912d

Attributes

delay
5000
install_path
appdata
port
34729
startup_name
temp

Signatures

Detect XenoRat Payload 2 IoCs

resource	yara_rule
behavioral2/memory/4572-0-0x0000000000290000-0x00000000002A2000-memory.dmp	family_xenorat
behavioral2/files/0x001d00000002b128-6.dat	family_xenorat

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat
Xenorat family
xenorat

Executes dropped EXE 1 IoCs

pid	Process
5776	rat tes.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rat tes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rat tes.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2104	schtasks.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 5776	4572	rat tes.exe	78
PID 4572 wrote to memory of 5776	4572	rat tes.exe	78
PID 4572 wrote to memory of 5776	4572	rat tes.exe	78
PID 5776 wrote to memory of 2104	5776	rat tes.exe	79
PID 5776 wrote to memory of 2104	5776	rat tes.exe	79
PID 5776 wrote to memory of 2104	5776	rat tes.exe	79

C:\Users\Admin\AppData\Local\Temp\rat tes.exe
"C:\Users\Admin\AppData\Local\Temp\rat tes.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Users\Admin\AppData\Roaming\XenoManager\rat tes.exe
  "C:\Users\Admin\AppData\Roaming\XenoManager\rat tes.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5776
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /Create /TN "temp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9971.tmp" /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rat tes.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rat tes.exe.log
Size 226B
SHA256 494398ec6108c68573c366c96aae23d35e7f9bdbb440a4aab96e86fcad5871d0
MD5 1294de804ea5400409324a82fdc7ec59
SHA1 9a39506bc6cadf99c1f2129265b610c69d1518f7
SHA512 033905cc5b4d0c0ffab2138da47e3223765146fa751c9f84b199284b653a04874c32a23aae577d2e06ce6c6b34fec62331b5fc928e3baf68dc53263ecdfa10c1
MD5 SHA1 SHA512

Submit Download

tmp9971.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp9971.tmp
Size 1KB
SHA256 2e25727f46a4ff905adad8807b36385bba876fe2d939a73caac2caec383306a1
MD5 8c5b6a82319c381cedb4a66d5e9dac34
SHA1 ff6c337d6cd4372148b6a297e852dd0bfd8a46bf
SHA512 5458ea4aa916b730d9bda3807a3ae681523c32dfa16ef3edca91db3186768305a3a77ee9c6edef77754d6fd8a19c363c5eb0d0b5ea312a9e815e4243686d662e
MD5 SHA1 SHA512

Submit Download

rat tes.exe

Path C:\Users\Admin\AppData\Roaming\XenoManager\rat tes.exe
Size 45KB
SHA256 384afed09f41f19ce3b378a5e8955c13e8f5ba54ec0b6682a88fe45f42ddd9d1
MD5 0a14897a0ccfa77d9c5c6323a25c06c4
SHA1 0f0a8bddd6235075fc47749d34a7e9f2e414b191
SHA512 4ce9c8e193663714fdc6803e990a4580396626af3732e3e4e72b332838cb41b7277ff916ccf0455d2206c4445543d8649b16205bb308ca862f83ea0e1061d405
SSDEEP 768:ZdhO/poiiUcjlJInzr6BH9Xqk5nWEZ5SbTDaNuI7CPW5Q:Xw+jjgnkH9XqcnW85SbTQuI4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4572-0-0x0000000000290000-0x00000000002A2000-memory.dmp

Download

memory/5776-14-0x0000000004D10000-0x0000000004D20000-memory.dmp

Download

memory/5776-17-0x0000000004D10000-0x0000000004D20000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads