Overview

overview

10

Static

static

10

a8692e96e6...38.exe

windows10-2004-x64

10

a8692e96e6...38.exe

windows11-21h2-x64

10

Resubmissions

10/02/2026, 02:12

260210-cm59laat8f10

10/02/2026, 01:57

260210-cdg6eaas5c10

04/02/2026, 15:57

260204-td7jqsdz6d10

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    10/02/2026, 01:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a8692e96e689820e7714bf0ae529f49682ce5a002dc221fa10d4b32ce4629d38.exe
  • Size 170KB
  • Sample260210-cdg6eaas5c
  • SHA256 a8692e96e689820e7714bf0ae529f49682ce5a002dc221fa10d4b32ce4629d38
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryxillen_stealerstealer

Malware Config

Extracted

Family

  • xillen_stealer

C2

  • https://goldenring.live

Signatures

  • XillenStealer

    XillenStealer is an information stealer.

    stealerxillen_stealer
  • Xillen_stealer family
    xillen_stealer
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a8692e96e689820e7714bf0ae529f49682ce5a002dc221fa10d4b32ce4629d38.exe
    "C:\Users\Admin\AppData\Local\Temp\a8692e96e689820e7714bf0ae529f49682ce5a002dc221fa10d4b32ce4629d38.exe"
    1⤵
    • Checks BIOS information in registry
    PID:1456
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Enumerates system info in registry
    • Suspicious use of WriteProcessMemory
    PID:2472
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffccc7cc728,0x7ffccc7cc734,0x7ffccc7cc740
      2⤵
        PID:4888
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=1844,i,1565150637095532555,14898666760842860941,524288 --field-trial-handle=2092,i,6964827630329638314,3324559086038505992,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2120 /prefetch:11
        2⤵
        • System Time Discovery
        PID:3972
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,10281818288935130448,14529612962873146710,262144 --field-trial-handle=2092,i,6964827630329638314,3324559086038505992,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2088 /prefetch:2
        2⤵
          PID:2168
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=2376,i,12861447606674650271,6858499019778053100,524288 --field-trial-handle=2092,i,6964827630329638314,3324559086038505992,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2448 /prefetch:13
          2⤵
            PID:1540
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3376,i,2824881477602383085,10792684700037657021,2097152 --field-trial-handle=2092,i,6964827630329638314,3324559086038505992,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3408 /prefetch:1
            2⤵
              PID:4328
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,14313603474561597479,15540799854978159214,2097152 --field-trial-handle=2092,i,6964827630329638314,3324559086038505992,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3316 /prefetch:1
              2⤵
                PID:4756
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4232,i,3973036693269138421,5078259111451810084,2097152 --field-trial-handle=2092,i,6964827630329638314,3324559086038505992,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4240 /prefetch:9
                2⤵
                  PID:2504
              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                1⤵
                  PID:1976

                Network

                      MITRE ATT&CK Enterprise v16

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      Local State
                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                      • Size 90KB
                      • SHA256 bdddd0a88a030bd9931ec84ec9df19167816431cad612f32ce6a6e3c7c056ce6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      memory/1456-0-0x0000000000400000-0x0000000000434000-memory.dmp
                      Download