95fbcbb21cec048d41b9062fcb2ae610c6ebe722487493b3a6e3c201af15b846

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/01/2025, 18:07

Target

Xeno Executor/XenoInstaller.exe
Size

29.5MB
MD5

f9a56e4e71ff3cf6dcd384d0afb6470e
SHA1

2a9bf8077e08127f6677c92e607f7f685a263d75
SHA256

2692142a8e973830b6866917d2eda6e0440b1ea89049943bc4a7897d980bc554
SHA512

efb9e82bdd37894e465b896cd4aef203a3f660572d165c3ccdd0e1aabd12a40f0a43276bec8bd7245050edc358633c85f18f1070f6472479f3458a5014188dc3
SSDEEP

786432:jow/lhONW88i8m1NxOcl8dPXB6BYeBLpdSYCxeDs5Vd:ZlhsWo8mxBlmPxaYeBl1s5

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2108	XenoInstaller.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral3/files/0x00030000000209db-1155.dat	upx
behavioral3/memory/2108-1157-0x000007FEF5340000-0x000007FEF59A5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2108	2520	XenoInstaller.exe	30
PID 2520 wrote to memory of 2108	2520	XenoInstaller.exe	30
PID 2520 wrote to memory of 2108	2520	XenoInstaller.exe	30

C:\Users\Admin\AppData\Local\Temp\Xeno Executor\XenoInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno Executor\XenoInstaller.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Users\Admin\AppData\Local\Temp\Xeno Executor\XenoInstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\Xeno Executor\XenoInstaller.exe"
  2⤵
  - Loads dropped DLL
  PID:2108

C:\Users\Admin\AppData\Local\Temp\_MEI25202\python313.dll

Filesize
1.8MB

MD5
13e0653e90a091bde333f7e652ac6f8b

SHA1
130f3271120487b4aac482af56f4de6673aaaeda

SHA256
a89f9220c5afcb81b9a91f00b3bea9ed21ebd2cbae00785cbc2db264d90c862c

SHA512
ad513df8f9a53cb3a8e5bc430a977c4079e7d7547fce43fe29288988ee458ff2ea922eb979582fe4c276e58cd6ef8d771bf6535170554b82c5d54d87caaf5366

Download Submit
memory/2108-1157-0x000007FEF5340000-0x000007FEF59A5000-memory.dmp

Filesize
6.4MB

Download