Analysis
- user interaction
yes - max time kernel
149s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
05/07/2026, 14:36
General
- Target Xeno.exe
- Size 258KB
- Sample260705-rytr9sgw6p
- SHA256 9e739748aecf8018fdb73f4d5abf6ca7335e5972eb1b85525eaf86f4a2c471f7
Malware Config
Extracted
-
ratonrat
-
v4.0.0
-
fin.xzbvc.xyz:20891
-
KxMh1nIEomeKXKJ15AtDfTV
-
assist
false
-
box
false
-
box_icon
Error
-
box_msg
I'm the message box description
-
box_title
Hello World
-
defender
false
-
delay
0
-
hide_file
false
-
open_website
false
-
process_critical
false
-
raw
silly21
-
reconnect
3
-
startup
false
-
tag
Infected
-
uac
false
-
vm
false
-
website
https://t.me/example
Signatures
- Family: RatonRAT
RatonRAT is an information stealer written in C#.
- Detects RatonRAT payload 3 IoCs
- Executes dropped EXE 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 2 IoCs
- Costura .NET executable packer 1 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 7 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Xeno.exe"C:\Users\Admin\AppData\Local\Temp\Xeno.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bnd_51531a77\XDWD2.exe"C:\Users\Admin\AppData\Local\Temp\bnd_51531a77\XDWD2.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\bnd_51531a77\Xeno.exe"C:\Users\Admin\AppData\Local\Temp\bnd_51531a77\Xeno.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
XDWD2.exe
Xeno.exe
memory/2700-23-0x00007FFA8AA00000-0x00007FFA8B3A4000-memory.dmp
memory/2700-1-0x0000000000300000-0x0000000000346000-memory.dmp
memory/2700-4-0x00007FFA8AA00000-0x00007FFA8B3A4000-memory.dmp
memory/2700-0-0x00007FFA8AB8F000-0x00007FFA8AB90000-memory.dmp
memory/2700-17-0x00007FFA8AA00000-0x00007FFA8B3A4000-memory.dmp
memory/5568-26-0x00007FFA8AA00000-0x00007FFA8B3A4000-memory.dmp
memory/5568-31-0x00007FFA8AA00000-0x00007FFA8B3A4000-memory.dmp
memory/5568-24-0x00007FFA8AA00000-0x00007FFA8B3A4000-memory.dmp
memory/5568-18-0x000002507D680000-0x000002507D688000-memory.dmp
memory/5568-25-0x00007FFA8AA00000-0x00007FFA8B3A4000-memory.dmp
memory/5568-12-0x000002507D200000-0x000002507D21E000-memory.dmp
memory/5568-27-0x00007FFA8AA00000-0x00007FFA8B3A4000-memory.dmp
memory/5568-28-0x00007FFA8AA00000-0x00007FFA8B3A4000-memory.dmp
memory/5568-29-0x00007FFA8AA00000-0x00007FFA8B3A4000-memory.dmp
memory/5568-22-0x00007FFA8AA00000-0x00007FFA8B3A4000-memory.dmp
memory/5568-32-0x00007FFA8AA00000-0x00007FFA8B3A4000-memory.dmp
memory/5568-33-0x00007FFA8AA00000-0x00007FFA8B3A4000-memory.dmp
memory/5568-34-0x00007FFA8AA00000-0x00007FFA8B3A4000-memory.dmp
memory/5568-30-0x00007FFA8AA00000-0x00007FFA8B3A4000-memory.dmp
memory/5568-35-0x00007FFA8AA00000-0x00007FFA8B3A4000-memory.dmp
memory/5568-36-0x0000025018000000-0x0000025018376000-memory.dmp
memory/5568-37-0x00000250183B0000-0x00000250184A0000-memory.dmp
memory/5568-38-0x00007FFA8AA00000-0x00007FFA8B3A4000-memory.dmp
memory/5568-39-0x00007FFA8AA00000-0x00007FFA8B3A4000-memory.dmp