Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 22:15
General
- Target as.exe
- Size 45KB
- Sample261027-16feaag13l
- SHA256 4067af57ce89ed107e44d649a04c0e8df4a7fa5ab65e42f178697048e2b15993
Malware Config
Extracted
-
xenorat
-
45.89.249.48
-
Xeno_rat_nd8912d
-
delay
5000
-
install_path
appdata
-
port
35962
-
startup_name
chrome-update
Signatures
- Family: XenoRat
XenoRat is a remote access trojan written in C#.
- Detect XenoRat Payload 2 IoCs
- Executes dropped EXE 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\as.exe"C:\Users\Admin\AppData\Local\Temp\as.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XenoManager\as.exe"C:\Users\Admin\AppData\Roaming\XenoManager\as.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "chrome-update" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1459.tmp" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Roaming\XenoManager\as.exeC:\Users\Admin\AppData\Roaming\XenoManager\as.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
tmp1459.tmp
as.exe
memory/2580-0-0x0000000074742000-0x0000000074743000-memory.dmp
memory/2580-1-0x0000000000420000-0x0000000000432000-memory.dmp
memory/4108-3-0x0000000074730000-0x0000000074EEC000-memory.dmp
memory/4108-4-0x0000000074730000-0x0000000074EEC000-memory.dmp
memory/4108-10-0x0000000074730000-0x0000000074EEC000-memory.dmp
memory/4108-11-0x0000000074730000-0x0000000074EEC000-memory.dmp
memory/5820-8-0x0000000074730000-0x0000000074EEC000-memory.dmp
memory/5820-9-0x0000000074730000-0x0000000074EEC000-memory.dmp