General
-
Target
XenoxExploit.exe
-
Size
7.5MB
-
Sample
241223-vcgscsvqbm
-
MD5
809744fdb0a46e19d8fdb5db88b95a31
-
SHA1
bc8d73f5aced88732c4d669e87026c7806bce2ca
-
SHA256
2fa3f17ecf4e81b96837aff155173a34c81f14e16d543237649eaa0885c01f27
-
SHA512
4a665b44b84cbf2b284d1670d1c54a04bbd7244fce715e4b54b350e9077a5dd974d455775bddfc2e3fbc9e930ba3755c0610e42f4f913d2642a0b324b74b7264
-
SSDEEP
196608:udQCwV+IurErvI9pWjgN3ZdahF0pbH1AY7WtQsNo/03vC1C:pVRurEUWjqeWx06rYYC
Behavioral task
behavioral1
Sample
XenoxExploit.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
XenoxExploit.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
XenoxExploit.exe
-
Size
7.5MB
-
MD5
809744fdb0a46e19d8fdb5db88b95a31
-
SHA1
bc8d73f5aced88732c4d669e87026c7806bce2ca
-
SHA256
2fa3f17ecf4e81b96837aff155173a34c81f14e16d543237649eaa0885c01f27
-
SHA512
4a665b44b84cbf2b284d1670d1c54a04bbd7244fce715e4b54b350e9077a5dd974d455775bddfc2e3fbc9e930ba3755c0610e42f4f913d2642a0b324b74b7264
-
SSDEEP
196608:udQCwV+IurErvI9pWjgN3ZdahF0pbH1AY7WtQsNo/03vC1C:pVRurEUWjqeWx06rYYC
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist
-
Hide Artifacts: Hidden Files and Directories
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3