Overview

overview

7

Static

static

3

Xeno 1.18 FIXED.zip

windows7-x64

7

Xeno 1.18 FIXED.zip

windows10-2004-x64

1

net8.0-win...rprint

windows7-x64

6

net8.0-win...rprint

windows10-2004-x64

6

net8.0-win...t.json

windows7-x64

6

net8.0-win...t.json

windows10-2004-x64

6

net8.0-win...s.json

windows7-x64

6

net8.0-win...s.json

windows10-2004-x64

6

net8.0-win...re.pma

windows7-x64

6

net8.0-win...re.pma

windows10-2004-x64

6

net8.0-win...54.pma

windows7-x64

6

net8.0-win...54.pma

windows10-2004-x64

6

net8.0-win...rl-set

windows7-x64

6

net8.0-win...rl-set

windows10-2004-x64

6

net8.0-win...rprint

windows7-x64

6

net8.0-win...rprint

windows10-2004-x64

6

net8.0-win...t.json

windows7-x64

6

net8.0-win...t.json

windows10-2004-x64

6

net8.0-win...gs.dat

windows7-x64

6

net8.0-win...gs.dat

windows10-2004-x64

6

net8.0-win...re.dat

windows7-x64

6

net8.0-win...re.dat

windows10-2004-x64

6

net8.0-win...data_0

windows7-x64

6

net8.0-win...data_0

windows10-2004-x64

6

net8.0-win...data_1

windows7-x64

6

net8.0-win...data_1

windows10-2004-x64

6

net8.0-win...data_2

windows7-x64

6

net8.0-win...data_2

windows10-2004-x64

6

net8.0-win...data_3

windows7-x64

6

net8.0-win...data_3

windows10-2004-x64

6

net8.0-win...001.gz

windows7-x64

6

net8.0-win...001.gz

windows10-2004-x64

6

Resubmissions

12/10/2024, 10:59 UTC

241012-m3mgja1frq 6

12/10/2024, 10:54 UTC

241012-mzm9na1fjj 8

12/10/2024, 10:51 UTC

241012-mx9pwawhjg 7

Analysis

  • max time kernel
    110s
  • max time network
    114s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/10/2024, 10:51 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    net8.0-windows/Xeno.exe.WebView2/EBWebView/BrowserMetrics-spare.pma

  • Size

    1.2MB

  • MD5

    1045bfd216ae1ae480dd0ef626f5ff39

  • SHA1

    377e869bc123602e9b568816b76be600ed03dbd0

  • SHA256

    439292e489a0a35e4a3a0fe304ea1a680337243fa53b135aa9310881e1d7e078

  • SHA512

    f9f8fcc23fc084af69d7c9abb0ef72c4684ac8ddf7fa6b2028e2f19fd67435f28534c0cf5b17453dfe352437c777d6f71cfe1d6ad3542ad9d636263400908fd2

  • SSDEEP

    3::

Score
6/10
discovery

Malware Config

Signatures

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\net8.0-windows\Xeno.exe.WebView2\EBWebView\BrowserMetrics-spare.pma
    1⤵
    • Modifies registry class
    PID:4224
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3520

Network

  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.ax-0001.ax-msedge.net
    g-bing-com.ax-0001.ax-msedge.net
    IN CNAME
    ax-0001.ax-msedge.net
    ax-0001.ax-msedge.net
    IN A
    150.171.28.10
    ax-0001.ax-msedge.net
    IN A
    150.171.27.10
  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    10.28.171.150.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    10.28.171.150.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    88.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.210.23.2.in-addr.arpa
    IN PTR
    Response
    88.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-88deploystaticakamaitechnologiescom
  • flag-us
    DNS
    76.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    76.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    88.156.103.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.156.103.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    53.210.109.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    53.210.109.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    21.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    21.236.111.52.in-addr.arpa
    IN PTR
    Response
  • 150.171.28.10:443
    g.bing.com
    tls
    2.0kB
     9.4kB
     22
    19
  • 8.8.8.8:53
    g.bing.com
    dns
    56 B
     148 B
     1
    1

    DNS Request

    g.bing.com

    DNS Response

    150.171.28.10
    150.171.27.10

  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    10.28.171.150.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    10.28.171.150.in-addr.arpa

  • 8.8.8.8:53
    88.210.23.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    88.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    76.32.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    76.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    88.156.103.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    88.156.103.20.in-addr.arpa

  • 8.8.8.8:53
    53.210.109.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    53.210.109.20.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    21.236.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    21.236.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.