Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/01/2025, 18:07
Behavioral task
behavioral1
Sample
Xeno Executor/XenoApi.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Xeno Executor/XenoApi.dll
Resource
win10v2004-20250129-en
Behavioral task
behavioral3
Sample
Xeno Executor/XenoInstaller.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Xeno Executor/XenoInstaller.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Xeno Executor/assets/xenoassets.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Xeno Executor/assets/xenoassets.dll
Resource
win10v2004-20250129-en
General
-
Target
Xeno Executor/XenoInstaller.exe
-
Size
29.5MB
-
MD5
f9a56e4e71ff3cf6dcd384d0afb6470e
-
SHA1
2a9bf8077e08127f6677c92e607f7f685a263d75
-
SHA256
2692142a8e973830b6866917d2eda6e0440b1ea89049943bc4a7897d980bc554
-
SHA512
efb9e82bdd37894e465b896cd4aef203a3f660572d165c3ccdd0e1aabd12a40f0a43276bec8bd7245050edc358633c85f18f1070f6472479f3458a5014188dc3
-
SSDEEP
786432:jow/lhONW88i8m1NxOcl8dPXB6BYeBLpdSYCxeDs5Vd:ZlhsWo8mxBlmPxaYeBl1s5
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2108 XenoInstaller.exe -
resource yara_rule behavioral3/files/0x00030000000209db-1155.dat upx behavioral3/memory/2108-1157-0x000007FEF5340000-0x000007FEF59A5000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2520 wrote to memory of 2108 2520 XenoInstaller.exe 30 PID 2520 wrote to memory of 2108 2520 XenoInstaller.exe 30 PID 2520 wrote to memory of 2108 2520 XenoInstaller.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Xeno Executor\XenoInstaller.exe"C:\Users\Admin\AppData\Local\Temp\Xeno Executor\XenoInstaller.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\Xeno Executor\XenoInstaller.exe"C:\Users\Admin\AppData\Local\Temp\Xeno Executor\XenoInstaller.exe"2⤵
- Loads dropped DLL
PID:2108
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD513e0653e90a091bde333f7e652ac6f8b
SHA1130f3271120487b4aac482af56f4de6673aaaeda
SHA256a89f9220c5afcb81b9a91f00b3bea9ed21ebd2cbae00785cbc2db264d90c862c
SHA512ad513df8f9a53cb3a8e5bc430a977c4079e7d7547fce43fe29288988ee458ff2ea922eb979582fe4c276e58cd6ef8d771bf6535170554b82c5d54d87caaf5366