809476e3ea2921400757422b24a3c92ee1924bbe62f87c556f0e3586ff5c9d49 | Triage

Resubmissions

01/06/2024, 16:46

240601-t98fxahf44 7

01/06/2024, 16:33

240601-t2qwwsgf91 7

Analysis

max time kernel
207s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 16:33

Sharing

Report Analysis Logs

General

Target

XyIex-ExecutorV3.zip
Size

105.8MB
MD5

0280ea0e84218af65be6a057dc8782c1
SHA1

39be58e2d4485a86f309de6ad9c564aae0b0f741
SHA256

809476e3ea2921400757422b24a3c92ee1924bbe62f87c556f0e3586ff5c9d49
SHA512

2110a8e160ddeb2bec07a09acb7f4b908048e0997fddbd711953598b6ad164b9f4041aac390fea2bf26d4efed9ded0eb3ecf0772e9808718947f357c315623e6
SSDEEP

3145728:eYtMfGTQLjYeDSOoq2bDCDJupmEHIHPC9G0:eGQXMqwDCopNmqr

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2192	Xylex-ExecutorV3.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2192	1972	Xylex-ExecutorV3.exe	40
PID 1972 wrote to memory of 2192	1972	Xylex-ExecutorV3.exe	40
PID 1972 wrote to memory of 2192	1972	Xylex-ExecutorV3.exe	40

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\XyIex-ExecutorV3.zip
1⤵
PID:2868

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1280

C:\Users\Admin\Desktop\XyIex-ExecutorV3\Executor\Xylex-ExecutorV3.exe
"C:\Users\Admin\Desktop\XyIex-ExecutorV3\Executor\Xylex-ExecutorV3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Users\Admin\Desktop\XyIex-ExecutorV3\Executor\Xylex-ExecutorV3.exe
  "C:\Users\Admin\Desktop\XyIex-ExecutorV3\Executor\Xylex-ExecutorV3.exe"
  2⤵
  - Loads dropped DLL
  PID:2192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI19722\python311.dll

Filesize
5.5MB

MD5
58e01abc9c9b5c885635180ed104fe95

SHA1
1c2f7216b125539d63bd111a7aba615c69deb8ba

SHA256
de1b95d2e951fc048c84684bc7df4346138910544ee335b61fc8e65f360c3837

SHA512
cd32c77191309d99aeed47699501b357b35669123f0dd70ed97c3791a009d1855ab27162db24a4bd9e719b68ee3b0539ee6db88e71abb9a2d4d629f87bc2c081

Download Submit