xenorat | c7748592235b286dda7e73a1fdfcc29ed0f251668c15d41b4e43a86a7c73d9bb

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-31_d85cc2ec70819a2b8f5ffa2bef93b797_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 640KB
Sample260831-rb643stblh
SHA256 c7748592235b286dda7e73a1fdfcc29ed0f251668c15d41b4e43a86a7c73d9bb
MD5 d85cc2ec70819a2b8f5ffa2bef93b797
SHA1 b5c44c3ab155e79a6d1b2db29db5d2a0e9ba8adf
SHA512 145a8a9dc51f509cd7420c3e75621d0722b636b51da4f37d6144e962e41c6e4917b6e63caecc2d54ff41d871d5d2a637a908389192d7b11e6f4ade2ac787dfe4
SSDEEP 12288:6miMZvN43+u85Bpw+YMRkc95rpGv7VfvIc1hPm+r9G:TnvS+55BpfRX95rpGzxrP50
TLSH
T108D4AE19D7E405F9E1B7E578CD824902EB76BC4A4771E7CF03A4A9A61F232908E3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xenorat persistence rat trojan

Malware Config

Extracted

Family

xenorat

26.6.214.74

Mutex

Xeno_rat_nd8912d

Attributes

install_path
appdata
port
11111
startup_name
among us 2

Signatures

Family: XenoRat
XenoRat is a remote access trojan written in C#.
trojan rat xenorat

Detect XenoRat Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001c529-4.dat	family_xenorat
behavioral2/memory/4072-10-0x0000000000D80000-0x0000000000DB8000-memory.dmp	family_xenorat

Executes dropped EXE 3 IoCs

pid	Process
4072	slaadfb.exe
5452	slaadfb.exe
5964	slaadfb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	slaadfb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	slaadfb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	slaadfb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1312	schtasks.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 4072	1208	2026-08-31_d85cc2ec70819a2b8f5ffa2bef93b797_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe	89
PID 4072 wrote to memory of 5452	4072	slaadfb.exe	90
PID 5452 wrote to memory of 1312	5452	slaadfb.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-31_d85cc2ec70819a2b8f5ffa2bef93b797_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-31_d85cc2ec70819a2b8f5ffa2bef93b797_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\slaadfb.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\slaadfb.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Users\Admin\AppData\Roaming\XenoManager\slaadfb.exe
    "C:\Users\Admin\AppData\Roaming\XenoManager\slaadfb.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5452
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Create /TN "among us 2" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4BC5.tmp" /F
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1312

C:\Users\Admin\AppData\Roaming\XenoManager\slaadfb.exe
C:\Users\Admin\AppData\Roaming\XenoManager\slaadfb.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

slaadfb.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\slaadfb.exe
Size 197KB
SHA256 eed953b5e01c93f63669d9327a7a51d030c32004e4b8b5d25ff5cfb0d71d7888
MD5 56114a0f578d931014fd981a76b18801
SHA1 058ccddfc6609dcd2f54cbadb149f4a42bc5b195
SHA512 90af07e4c2e30d1f76b6d0e80737e337cbd48bffe5371af0618bf0096639226cd750da4cbc537f3cda9dbce5c0bb05fa43e2798eed551bcf23bd1f976c7ad095
SSDEEP 6144:IWO91UbcL36kgMqiDXP1lkdajRYRUny7JCP+6:Ij1LqkgMqiDXPP/1NnytK
TLSH
T1CE14E19E5FDD8A27FA8F4ABC8862025397B7F2A15132E24F4CCCC8E52B537964541393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp4BC5.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp4BC5.tmp
Size 1KB
SHA256 adb201ad2d404312e1916c3a741a7cb292352a74f913209086ee91528bcff72a
MD5 164e8d43385913d28a0d15f7663d64ff
SHA1 997896b8d15925a490d2e19862f4e8c2005bdc42
SHA512 5f3128e760dbef72bed574ea2101aa67beee8144d0e359c56aece30bb5d578c66f8f57b17e968463e3f4288c58915fec689186d4073cfcae06641c06ad0dcf5e
TLSH
T111114E9698C0690655360816C3964643ED17A787476B0078F4CC462F7FBEC9F514366B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4072-9-0x00000000743C2000-0x00000000743C3000-memory.dmp

Download

memory/4072-10-0x0000000000D80000-0x0000000000DB8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads