Overview
overview
7Static
static
3Xeno 1.18 FIXED.zip
windows7-x64
7Xeno 1.18 FIXED.zip
windows10-2004-x64
1net8.0-win...rprint
windows7-x64
6net8.0-win...rprint
windows10-2004-x64
6net8.0-win...t.json
windows7-x64
6net8.0-win...t.json
windows10-2004-x64
6net8.0-win...s.json
windows7-x64
6net8.0-win...s.json
windows10-2004-x64
6net8.0-win...re.pma
windows7-x64
6net8.0-win...re.pma
windows10-2004-x64
6net8.0-win...54.pma
windows7-x64
6net8.0-win...54.pma
windows10-2004-x64
6net8.0-win...rl-set
windows7-x64
6net8.0-win...rl-set
windows10-2004-x64
6net8.0-win...rprint
windows7-x64
6net8.0-win...rprint
windows10-2004-x64
6net8.0-win...t.json
windows7-x64
6net8.0-win...t.json
windows10-2004-x64
6net8.0-win...gs.dat
windows7-x64
6net8.0-win...gs.dat
windows10-2004-x64
6net8.0-win...re.dat
windows7-x64
6net8.0-win...re.dat
windows10-2004-x64
6net8.0-win...data_0
windows7-x64
6net8.0-win...data_0
windows10-2004-x64
6net8.0-win...data_1
windows7-x64
6net8.0-win...data_1
windows10-2004-x64
6net8.0-win...data_2
windows7-x64
6net8.0-win...data_2
windows10-2004-x64
6net8.0-win...data_3
windows7-x64
6net8.0-win...data_3
windows10-2004-x64
6net8.0-win...001.gz
windows7-x64
6net8.0-win...001.gz
windows10-2004-x64
6Resubmissions
12-10-2024 10:59
241012-m3mgja1frq 612-10-2024 10:54
241012-mzm9na1fjj 812-10-2024 10:51
241012-mx9pwawhjg 7Analysis
-
max time kernel
121s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
12-10-2024 10:51
Static task
static1
Behavioral task
behavioral1
Sample
Xeno 1.18 FIXED.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Xeno 1.18 FIXED.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
net8.0-windows/Xeno.exe.WebView2/EBWebView/AutoLaunchProtocolsComponent/1.0.0.8/manifest.fingerprint
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
net8.0-windows/Xeno.exe.WebView2/EBWebView/AutoLaunchProtocolsComponent/1.0.0.8/manifest.fingerprint
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
net8.0-windows/Xeno.exe.WebView2/EBWebView/AutoLaunchProtocolsComponent/1.0.0.8/manifest.json
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
net8.0-windows/Xeno.exe.WebView2/EBWebView/AutoLaunchProtocolsComponent/1.0.0.8/manifest.json
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
net8.0-windows/Xeno.exe.WebView2/EBWebView/AutoLaunchProtocolsComponent/1.0.0.8/protocols.json
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
net8.0-windows/Xeno.exe.WebView2/EBWebView/AutoLaunchProtocolsComponent/1.0.0.8/protocols.json
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
net8.0-windows/Xeno.exe.WebView2/EBWebView/BrowserMetrics-spare.pma
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
net8.0-windows/Xeno.exe.WebView2/EBWebView/BrowserMetrics-spare.pma
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
net8.0-windows/Xeno.exe.WebView2/EBWebView/BrowserMetrics/BrowserMetrics-66F88D85-3254.pma
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
net8.0-windows/Xeno.exe.WebView2/EBWebView/BrowserMetrics/BrowserMetrics-66F88D85-3254.pma
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
net8.0-windows/Xeno.exe.WebView2/EBWebView/CertificateRevocation/6498.2023.8.1/crl-set
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
net8.0-windows/Xeno.exe.WebView2/EBWebView/CertificateRevocation/6498.2023.8.1/crl-set
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
net8.0-windows/Xeno.exe.WebView2/EBWebView/CertificateRevocation/6498.2023.8.1/manifest.fingerprint
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
net8.0-windows/Xeno.exe.WebView2/EBWebView/CertificateRevocation/6498.2023.8.1/manifest.fingerprint
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
net8.0-windows/Xeno.exe.WebView2/EBWebView/CertificateRevocation/6498.2023.8.1/manifest.json
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
net8.0-windows/Xeno.exe.WebView2/EBWebView/CertificateRevocation/6498.2023.8.1/manifest.json
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
net8.0-windows/Xeno.exe.WebView2/EBWebView/Crashpad/settings.dat
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
net8.0-windows/Xeno.exe.WebView2/EBWebView/Crashpad/settings.dat
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
net8.0-windows/Xeno.exe.WebView2/EBWebView/Crashpad/throttle_store.dat
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
net8.0-windows/Xeno.exe.WebView2/EBWebView/Crashpad/throttle_store.dat
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
net8.0-windows/Xeno.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_0
Resource
win7-20240729-en
Behavioral task
behavioral24
Sample
net8.0-windows/Xeno.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_0
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
net8.0-windows/Xeno.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_1
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
net8.0-windows/Xeno.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_1
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
net8.0-windows/Xeno.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_2
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
net8.0-windows/Xeno.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_2
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
net8.0-windows/Xeno.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_3
Resource
win7-20241010-en
Behavioral task
behavioral30
Sample
net8.0-windows/Xeno.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_3
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
net8.0-windows/Xeno.exe.WebView2/EBWebView/Default/Cache/Cache_Data/f_000001.gz
Resource
win7-20240729-en
Behavioral task
behavioral32
Sample
net8.0-windows/Xeno.exe.WebView2/EBWebView/Default/Cache/Cache_Data/f_000001.gz
Resource
win10v2004-20241007-en
General
-
Target
net8.0-windows/Xeno.exe.WebView2/EBWebView/BrowserMetrics/BrowserMetrics-66F88D85-3254.pma
-
Size
1.2MB
-
MD5
8bf75f235e5a0b35c967d2d8562660ae
-
SHA1
559e82a64ca53a8a4dcdca350089484096f80580
-
SHA256
06b08fb44903a1a752792064f7b4a67d9c02e206696f0fa19d9904815ef8b0b6
-
SHA512
108dbf37815e8f969733dd1fef38ee46c7c487b43e061ea02abe438801ff86a108d71d8cea4ba78ebe453e9efcaa1bf6556f70b3f7042a1727d0fe211d8e1014
-
SSDEEP
1536:iZ7zCQAIMy1pME5TRGg1DRFFZbqaRGwV0U5BzAs4g0y9/qfA849tUIod:iZ7WQFMUME5Mg1HFZbqz+vzAs4ghO
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2648 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2648 AcroRd32.exe 2648 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2884 3056 cmd.exe 31 PID 3056 wrote to memory of 2884 3056 cmd.exe 31 PID 3056 wrote to memory of 2884 3056 cmd.exe 31 PID 2884 wrote to memory of 2648 2884 rundll32.exe 32 PID 2884 wrote to memory of 2648 2884 rundll32.exe 32 PID 2884 wrote to memory of 2648 2884 rundll32.exe 32 PID 2884 wrote to memory of 2648 2884 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\net8.0-windows\Xeno.exe.WebView2\EBWebView\BrowserMetrics\BrowserMetrics-66F88D85-3254.pma1⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\net8.0-windows\Xeno.exe.WebView2\EBWebView\BrowserMetrics\BrowserMetrics-66F88D85-3254.pma2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\net8.0-windows\Xeno.exe.WebView2\EBWebView\BrowserMetrics\BrowserMetrics-66F88D85-3254.pma"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2648
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5ed89e6f424e3dbf1ac8a4cbecc720ef0
SHA169fbe618752b8c11f5f30bf23f68d3280756d2a9
SHA25670649a62de64c9e844e50a2ed4e022b360f72e8c940be75b3d272dff3edee251
SHA51212ccc501da58d21f6589ed6c91cb7292a89b57c4033ca362e85794ef8627c4c4b4149dc281f2a8dce35f4166a3dd736bd540db0787ab0bee1f631fdd1ffc2314