Resubmissions

30/03/2025, 19:46

250330-yg7q5avzew 6

29/03/2025, 19:55

250329-ynl31axwgv 6

29/03/2025, 19:55

250329-ym9gxaxvf1 6

29/03/2025, 18:18

250329-wxy3taznv5 6

29/03/2025, 10:24

250329-mfdwwa1xay 7

29/03/2025, 00:19

250329-amltvawpx2 6

28/03/2025, 22:33

250328-2gj7lssxgv 6

Analysis

  • max time kernel
    717s
  • max time network
    723s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    28/03/2025, 22:33

General

  • Target

    Xeno-v1.1.65/bin/Monaco/index.html

  • Size

    164KB

  • MD5

    001dcbb8f41cdcbf9b4d1e3a0ed4b2d2

  • SHA1

    982a05814546017c40771e59e7677b53d84787e9

  • SHA256

    f1d2c52f2803c29585b81d2eff74c56242d27e9619ee6d38081d5604c5bb1951

  • SHA512

    9a4eba2a9314b6f5851997e1db0ecfae8e40da3443d8a5f9df933ccf6a4d75fc330888c8d14818326e15b3dec9ae2f5f7e73cd08c3822dd7eb0b2d753c8cd8fa

  • SSDEEP

    3072:Nk4J09UmmJv8kBpZaFD48VOAGUWYPjDZlLJbRBiPEP8yKUz2Ojmjr8zM3KP7pblM:64J09BA3pZaFD48VOAGUWYPjdlLJbRBS

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Xeno-v1.1.65\bin\Monaco\index.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2576
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2576 CREDAT:275457 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2912

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    914B

    MD5

    e4a68ac854ac5242460afd72481b2a44

    SHA1

    df3c24f9bfd666761b268073fe06d1cc8d4f82a4

    SHA256

    cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

    SHA512

    5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    71KB

    MD5

    83142242e97b8953c386f988aa694e4a

    SHA1

    833ed12fc15b356136dcdd27c61a50f59c5c7d50

    SHA256

    d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

    SHA512

    bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    252B

    MD5

    cbf2a991f69fd023a4de049ea906bcab

    SHA1

    849900fa53a449a66313c66f26aa365f427bb818

    SHA256

    88fd90bf4b3fd744ac454c109821bfa321a74f9dac3dca9b35c8d55fb7a91293

    SHA512

    6de3019198896cb444aac46f0320c606af11c739f6dd3bd02f1814bbd66f1c81410296b44724858e54dc0e89cab4a935c41fa839ac277cc303504ee50e9ed334

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    6ddf6b589688385ae1553984990777de

    SHA1

    4089a6a375924d0c5f731d54fcd7cd32637236fd

    SHA256

    5458085f02574ba672f7145ba7f6fece42d95b31da49e0d9e404d7ea3a90c3bb

    SHA512

    338571db9721114f0a3ea1d766d627a949475dc3ae1761230b8858bc44f3c282ecbc1977bfc803e057848d6cb80746fa5365786d088502a0a5bea16cc2671659

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    3bbae3b5b0c36e7045022db618b3c5b0

    SHA1

    72e9abfc7f76b6c8d9b7a2970126646169764e31

    SHA256

    e6b1982cc6079454e0e9d4feb3a9098420d879e9021d886d7a6fe24166b4f956

    SHA512

    5d08dad87b7277e1ac0d5308f20a7038723fa1af4641a4133ad1ff3b728591c6e240d2d733ee65d19670fc280746637fcabcbccebb90b91211b67f82e2b4b2b0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    e031e7a2ab74328e198d586780a1ca72

    SHA1

    c25689bb491e1132ff2d6cd5810870b8b07f9452

    SHA256

    4b5e08b510f9ed9fcea3becf79894085a015337ff0442bf3b5f0dcd8922b779a

    SHA512

    a45af10856719f66d8daba622eb1f80450839349b5daad854f3f9d9b56281678af24f7993989149f4f60298c0f44613a46d957dd16d3461714037a8da58fa923

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    651f591749489b4d0a13af761b5326b0

    SHA1

    97fcfc6dbf8f84667d4ec3d30b859741af30002f

    SHA256

    7ba39aa3772c5164b652b544e4b44586f0104cdf445097fcf8f9e9295fa481ee

    SHA512

    e8ff28848fbe8cdfe8c6f5516b3bebc7ba04484b4dc608545f9da3310b60eeb5776dba5c5ac558a975534b5e17e23ff17930deda48d890c3c46fe2f43dd29d90

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    1ad6213b655b2d66389fcff1cfd9c800

    SHA1

    558a4e18715ee06efa13a85249dadf95f5f32b5c

    SHA256

    774925f374003d44cb2e950d8748e2d830f8e8ecf62bab34f3bca4bcc17cb11c

    SHA512

    931d5260f241f5b01341366c29134640b9222f02ab96639900e25b44f944117564515c3b3c0e77ed02274669d9a408b8c091e1104e023b4d06a3f3cba3dd0745

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    3abdc28af90269054c5bcacd29ab36a2

    SHA1

    c02a6990b60fc124eb5e1bd364eb1af970c7dcfe

    SHA256

    e851c9c56d7ca8af245df676a9adc7ce519b5cf9b4289953217650de21f66ce9

    SHA512

    20ae35101c5e005944b14d3c26d6c5d830e6b2ec8bcc65592871bacbaa1ba01b340aa55d76de4c655dd52169795dbbd6e495fbf9417e1162c7e841ff34beb538

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    466c943023f51221b1817ffb749d8e85

    SHA1

    0344cdf00c43c1a94266394f7b309343ec408644

    SHA256

    4c5d4a5525da605cf432bc01d208d7d919d910a0e0ad2acef10cecddf2048647

    SHA512

    a93833c27d15f333e065f6a3059134c3daf90876e41e3842cfe15834d0022cc9fad9dd97e3d05db1e55222cdad55388f15ad17e35c76acedf19763834b01ba65

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c7533a5106991498bbf0c4487ff5b623

    SHA1

    c2c5e5c1624199fbd6e892acc403a69387fe3cbf

    SHA256

    9411e2c97508d61465d3d8b7577af5434f50d16849f589acfe28158c130875a6

    SHA512

    49b1fc1f74a8847d479fb6e436569d7209b9f29deb1f00b6f7f2fb20e6d4e86acbb34f83291446fdca9d598020d1469a7980549a7e001162551d69807b174fbb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    186b4e8e11dfa14e776c20d92f9b153d

    SHA1

    75faf36f816516e50c882e9d84d3c2e89424f785

    SHA256

    c11acc6614916c90e1204c8fade605dd46671d35a01f27f2c7d330469d6c2e6a

    SHA512

    fb8b13ddf7230cbcc5c672303f69d5e011a544648b030d2ec0a1b238e2438666e06eb399cf69f4febbec062ddce50b12f1ef333918fffb6ed66898652194a7b4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4fff3e7d3c4c981b49ea64d2ea9aa9df

    SHA1

    5fda783eb5f463f2978ee9eb0cacd481fe94a360

    SHA256

    e17eb8313e3898c989f1deed399c6126a0cef00fee43ff1522f33352d02a4cf9

    SHA512

    cef87f761f48e0599651d33feb23e4f8e49eaf712486620320aa16f27260f65f7c705873c05960c97dca730a9dcb5d32742d02c89e4d8e87c0a438b2c531e5fe

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    fc851a0b6dbf01f49efa0ae3136ea915

    SHA1

    be0a464e741f82b181029194d9535d84a0164e94

    SHA256

    4440fec5c43dbe847289faa05167c2e58bef2f4c1196c547ac9ea560b96b22f6

    SHA512

    ab4a19d0f7f55ef036e2f32cdf18eeb1a2b2d810fd24aa42039930960f1805b6926a8c0e4ea53e6c64a2dc516839c78ef9cd75d3a951844f1f963efb3cc8b354

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    34217688a69d5f17cad22647d6275d35

    SHA1

    9799aecb185bd7d0ca3fc2ac70d1579350a22741

    SHA256

    c0d187b4d1a71daa5cce3b9ee5355ee9cd57fb8059ad34bff18addc76d6535ef

    SHA512

    6590f193dfb8b17c9133d61e27c27f28ca7337646d610e370570e7a40272e4a1e27c905024d00eb3b836debda0ae44cf1d7e708c3babf044be637cbf70e01050

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ae4d70d35526be860a1be317f0e2fa7e

    SHA1

    661dd6fb44d691ec28a116fc02bf993a94aca8d9

    SHA256

    933b5d4440d141236c106ed85e2a2c9f29de8cc387ee3eeb09e6dbd6977bb583

    SHA512

    7224d86ccb7b1e339a120934946cf8fc7b49535b22a0bc8112a4ebc3396e3dd8a283994c45a4e31fafab1dd83cd0ce0ed72a97541ec3bedf0ad703b9896c5cd4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ce0ac67700809f7764c53f0400faddf9

    SHA1

    98c1a405fe43684be1e4f69110b3b67297e7add0

    SHA256

    b2807ba9c4d7eb94c75aa60786dc3254e7d3a9836b6690612d2986bdbd326a70

    SHA512

    d4cf9eb69be27edeadcc698871dded47fdd3012a0968dbd6e43380c2b9bb3575d88e2cae0bbebb9027bbcb06bba44481e510f8ce7c26d92724cddfcf2a6b6aec

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b2d093b8c59b81964903e83035006e47

    SHA1

    d9058fc13696fe9461d82d1a8a3be785d8026d18

    SHA256

    449862c7f76883f36158d9f8fccd1d28246a6ac61d70f8f4add9454b50c76315

    SHA512

    456b6a93787fc5ccad9c986f3cf18b67b206429c8d648dbab711c51d8db0a44f11ee0a437cc315f7c9c9f06064a54b52eddb94627607f1331b0ee0e66bf77888

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ec714788b3c6b0180a358f64de5a641d

    SHA1

    2ca65dcd5d2889fdff952a9ebca2b4852b87cc9b

    SHA256

    dd82281ff3336810035071de8931517a068d3db97088f4a1c3d5c9df27d00754

    SHA512

    8013c7844a328d42305475e230518b6bf318cca0d0b07a0bbdc9557224a01e878c0b1b32092d2c87870f34fe06342ffe08c6d9e0005348a1744b9f4447f5925f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    5c5c79b1b09ae1931c691ea98f38e24e

    SHA1

    6a046959e618c4c5851106120a0a54b840b49878

    SHA256

    bebddcac307b2cd4543077f6827841594b8699258c8d5bf049ea21d705949433

    SHA512

    62ccc4326eac226a53f4e8b9d18328d45fa565e15675448ff0f86140f6027754aec3a0919fbe8187f2eaead9a11d7256bfae77dd10c655153d1c5b84ea3bc161

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    8fc5408e3bb3abfa12113ae31408bc57

    SHA1

    da713fd31ed6f770a5797a4167488e5501f5b4b2

    SHA256

    66ae04b77c531a3d8fb59a88ae6cd1d17cfb6005c128dbe6bf9d439542a61b57

    SHA512

    34cd6dcd46f937e060bcc92c57aa7884e0be5009a4fbec4c70b36a77930f093afa50f77dab5c39e41bc8b7f9f47aaf5b41c17f6585bbcc4681971035e206ac66

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    984ba375e761e59fe7cd5a8aa6d4abe7

    SHA1

    565a9cfac6857b3b17cb9a3f7e45321251d48812

    SHA256

    75cac7a0880ef58d8f559ebbb62f78be6e408f3107f6a10aa2e4cd1c0549db42

    SHA512

    762b4ecf5fc34a3d89c6906b21220b2146961c2683d2e796f171a5e48d887bfd5e40341bfe11ec6d97deff6c153dd3a6826631a65baf7fbee56b948a96bff001

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    6d0875359a792801d05d9251fe85c9e0

    SHA1

    24b4a3c345c2670ac1403c9e800646d353c9a5b9

    SHA256

    5090b5a9411a64a395e797d0e6aa704cadfa68adc4229a21e95f5e55e502e16d

    SHA512

    7560dc93dcd111ba591104fca9d7f48536c8702b25ce5d500a563f1dcb1d7f7ce65f166d9412b8321a5a7ae7747cbbb16871978846a7c19d26b1211762a3fd22

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4f0af19bb70cb4de4ffbb5f2be161831

    SHA1

    6f602c88e0dc63411cf9f3cafe2e8c48d32a486b

    SHA256

    ab12bf7956fef41a196ebbfe32baf1f2f1ae3e97da5d6d98d470c8bf4bc700af

    SHA512

    fa131a4df4696722c8fd3bb5cbe8a1c648540f6850e24571aaf4f5848de86aae63748ca73e74383fdf1c70b1d024e3cbcac85e7522f70819a5eb0c0b3dc0cc2b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    fc1320990f1691bfbdb7a168473499e5

    SHA1

    ce581112bb3e69ff00bcf1df6e8eea651e236677

    SHA256

    11ec36abe72aa51f1c5355c81c4750375fc454880b225e9e2f52fc57e2b898cd

    SHA512

    fc7dedc43c53750f3438de0cc605170dfb8bb0d7a857e06e3b52b7f3a6aeb0691943b39d87dada6d16691f3104a18d91287b09c18a5c45a17ed238ea7715f9f0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    5f320d0d9df1ede99ad0b228cbbbfe7b

    SHA1

    2696c8ade1b6fe78f9acdc5164b9e20ba369b2c7

    SHA256

    c924b6bdf408c0e85b04960021ddd58dc19dcb1fe83561ee62a2fcda14e66f7c

    SHA512

    941606113fc03acca2344f5ef9659bc57ce1f1f45093940687fed50dd47c6ab50e26b61579d52b1218877c4ecbc0143e448216b499b1efb83b4149a8efd3f919

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    6ed21739b70b1eededff1f842cf9976c

    SHA1

    718b5533712009655e61996e98c2cabc1b7ece16

    SHA256

    6dbf7a76b5256bb6591aa415ea4c0701fd238aa7aafe5b4a23415f326e87b10c

    SHA512

    b22975566d5451c96e08dabd47b5b24195fec11ab2310bb20b450df1952b6b40add1fab38c385aa43ad638fff09d28691d10804e53d576c0f80d2b4f256e9332

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    52dce81d53f1afc597cb348ab4f29f14

    SHA1

    41cfda27867df5b64181e05eb7fe059496f18f1a

    SHA256

    34ae9eaf53c52d7548864beac1f9bb2d8d6420a97307c11f4774199551eaa4b7

    SHA512

    c694dc1036506bf1c1d1c8a685d6dcf1165b80b5ee0ac96350106109d667720117ef8e7d39846ddb411f574e8d0a8ce601f2c334cf506dac0b33dcd016aa5151

  • C:\Users\Admin\AppData\Local\Temp\CabA41E.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarA58C.tmp

    Filesize

    183KB

    MD5

    109cab5505f5e065b63d01361467a83b

    SHA1

    4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

    SHA256

    ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

    SHA512

    753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc