Analysis
- user interaction
yes - max time kernel
61s - max time network
62s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260130-en - resource tags
- submitted
30/04/2026, 22:39
General
- Target XenoRAT-v1.8.7.rar
- Size 5.3MB
- Sample260430-2la5haex9m
- SHA256 c85dec43b71f1667e3c6ffffd79410461eddd79733e90389066f38b70dbb7059
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\XenoRAT-v1.8.7.rar"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zO01972658\xeno rat server.exe"C:\Users\Admin\AppData\Local\Temp\7zO01972658\xeno rat server.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
xeno rat server.exe
memory/2320-20-0x0000029CB48D0000-0x0000029CB48D8000-memory.dmp
memory/4716-15-0x000001EA45610000-0x000001EA45812000-memory.dmp
memory/4716-16-0x000001EA5FDD0000-0x000001EA5FDE0000-memory.dmp
memory/4716-19-0x000001EA5FD40000-0x000001EA5FD52000-memory.dmp
memory/4716-18-0x000001EA5FD60000-0x000001EA5FD7A000-memory.dmp
memory/4716-17-0x000001EA5FD10000-0x000001EA5FD24000-memory.dmp
memory/4716-21-0x000001EA45BA0000-0x000001EA45BA8000-memory.dmp
memory/4716-23-0x000001EA5FDD0000-0x000001EA5FDE0000-memory.dmp
memory/4716-22-0x000001EA474C0000-0x000001EA474CC000-memory.dmp
memory/4716-24-0x000001EA63850000-0x000001EA63902000-memory.dmp
memory/4716-25-0x000001EA63930000-0x000001EA63952000-memory.dmp