Resubmissions
24/01/2025, 18:53
250124-xjqd7atrcr824/01/2025, 18:37
250124-w9e6gasjcv824/01/2025, 18:35
250124-w8hvzatlbm324/01/2025, 18:21
250124-wzj2ns1nbs724/01/2025, 18:11
250124-wsl8fs1kex824/01/2025, 18:05
250124-wpbmjsslgl724/01/2025, 17:27
250124-v1e9fa1kbr8Analysis
- max time kernel
129s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
24/01/2025, 18:05
General
- Target Xeno-v1.1.35-x64.zip
- Size 4.5MB
- Sample250124-wpbmjsslgl
- SHA256 69e43fe7ea3817134874b2da967ff6d590b0513e125580179c0410df9cfef39f
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 8 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Xeno-v1.1.35-x64.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\Xeno-v1.1.35-x64\Xeno.exe"C:\Users\Admin\Desktop\Xeno-v1.1.35-x64\Xeno.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
MSVCP140.dll
Microsoft.Web.WebView2.Wpf.dll
Newtonsoft.Json.dll
VCRUNTIME140.dll
Xeno.dll
Xeno.exe
XenoUI.deps.json
XenoUI.dll
XenoUI.runtimeconfig.json
libcrypto-3-x64.dll
libssl-3-x64.dll
vcruntime140_1.dll