Analysis
- max time kernel
150s - max time network
157s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
24/05/2026, 15:39
General
- Target e36bbed1d5a73a26cc9eb47c8b67518a2da419aca8a825ab818bbfa58443e676.exe
- Size 4.8MB
- Sample260524-s3vqsshx2q
- SHA256 e36bbed1d5a73a26cc9eb47c8b67518a2da419aca8a825ab818bbfa58443e676
Malware Config
Extracted
-
xenorat
-
172.65.239.53
-
nd8912d
-
delay
5000
-
install_path
appdata
-
port
8888
-
startup_name
nd8912d
Signatures
- Family: XenoRat
XenoRat is a remote access trojan written in C#.
- Detect XenoRat Payload 1 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Themida packer 5 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e36bbed1d5a73a26cc9eb47c8b67518a2da419aca8a825ab818bbfa58443e676.exe"C:\Users\Admin\AppData\Local\Temp\e36bbed1d5a73a26cc9eb47c8b67518a2da419aca8a825ab818bbfa58443e676.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "nd8912d" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2B32.tmp" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\e36bbed1d5a73a26cc9eb47c8b67518a2da419aca8a825ab818bbfa58443e676.exeC:\Users\Admin\AppData\Local\Temp\e36bbed1d5a73a26cc9eb47c8b67518a2da419aca8a825ab818bbfa58443e676.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
tmp2B32.tmp
memory/1444-11-0x0000000140000000-0x0000000140CB2000-memory.dmp
memory/1444-12-0x00007FFF50A90000-0x00007FFF50B4D000-memory.dmp
memory/1444-3-0x00007FFF50A90000-0x00007FFF50B4D000-memory.dmp
memory/1444-6-0x0000000140000000-0x0000000140CB2000-memory.dmp
memory/1444-7-0x0000000140000000-0x0000000140CB2000-memory.dmp
memory/1444-8-0x00007FFF50A90000-0x00007FFF50B4D000-memory.dmp
memory/1444-1-0x00007FFF50AAA000-0x00007FFF50AAB000-memory.dmp
memory/1444-0-0x0000000140000000-0x0000000140CB2000-memory.dmp
memory/1444-2-0x00007FFF50A90000-0x00007FFF50B4D000-memory.dmp
memory/1444-31-0x00000000009B0000-0x00000000009B8000-memory.dmp
memory/4320-13-0x0000000140000000-0x0000000140CB2000-memory.dmp
memory/4320-14-0x00007FFF50A90000-0x00007FFF50B4D000-memory.dmp
memory/4320-18-0x0000000140000000-0x0000000140CB2000-memory.dmp
memory/4320-19-0x0000000140000000-0x0000000140CB2000-memory.dmp
memory/4320-23-0x00007FFF50A90000-0x00007FFF50B4D000-memory.dmp
memory/4320-22-0x0000000140000000-0x0000000140CB2000-memory.dmp
memory/4320-15-0x00007FFF50A90000-0x00007FFF50B4D000-memory.dmp