d825706f6385197d29747fb58aa23bebb189052452f0e2c96a6e83f4927d935b | Triage

Resubmissions

18/03/2025, 20:06

250318-yvs5wsxvax 6

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
18/03/2025, 20:06

Sharing

Report Analysis Logs

General

Target

Xeno-v1.1.6/XenoUI.exe
Size

93KB
MD5

2762fa6dd3c21a58ffd5a5a7bbfdec29
SHA1

afc64d9614723a56f980db7f0ea314cb4b8f7f02
SHA256

561478b7b91cfca4b0e59fddef42e2697655007feeceb594cb38f5071f2b7649
SHA512

648868af575edfd55e3b947df6239ee34ecd99522bf9ccef7998dfc44ba3f81351d8362240ad984d1757e4e2fb3d93eab47a16e8d7fbf82a1aaf13ab3d0771eb
SSDEEP

1536:DhGhD/eZUZ4fzT8xDc3WNJhfuM/APHV5y6SlSO8Xh:whaKWzT8xDB27Pby6SiXh

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 1052	2868	XenoUI.exe	28
PID 2868 wrote to memory of 1052	2868	XenoUI.exe	28
PID 2868 wrote to memory of 1052	2868	XenoUI.exe	28

C:\Users\Admin\AppData\Local\Temp\Xeno-v1.1.6\XenoUI.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.1.6\XenoUI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2868 -s 500
  2⤵
  PID:1052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2868-0-0x000007FEF5AF3000-0x000007FEF5AF4000-memory.dmp

Filesize
4KB

Download
memory/2868-1-0x000000013F870000-0x000000013F88A000-memory.dmp

Filesize
104KB

Download