Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
19/04/2026, 01:18
General
- Target Xeno-v1.3.30.exe
- Size 88.4MB
- Sample260419-bpcvdsa14l
- SHA256 55dc3d80eefa1a276c12f81605e3ce10147aa1ef44e6d45bb864fb2bc8e1a2bb
Score
10/10
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 21 IoCs
- Checks computer location settings 2 TTPs 43 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 64 IoCs
- UPX packed file 30 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e581cda.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e581cda.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e582b70.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e582b70.exe"4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e583cc6.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e583cc6.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e585261.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e585261.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e586210.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e586210.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"6⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e586fad.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e586fad.exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"7⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e587e05.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e587e05.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"8⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e588a1a.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e588a1a.exe"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"9⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e589853.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e589853.exe"11⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"10⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e58a64d.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e58a64d.exe"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"11⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e58b3da.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e58b3da.exe"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"12⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e58c2fd.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e58c2fd.exe"14⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"13⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e58d08a.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e58d08a.exe"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"14⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e58dffb.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e58dffb.exe"16⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"15⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e58ee82.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e58ee82.exe"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"16⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e58fcd9.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e58fcd9.exe"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"17⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e590a08.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e590a08.exe"19⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"18⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5916f9.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5916f9.exe"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"19⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5923e9.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5923e9.exe"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"20⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5930ca.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5930ca.exe"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"21⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e593e86.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e593e86.exe"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"22⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"23⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e594b76.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e594b76.exe"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"23⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5957cb.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5957cb.exe"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"24⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5963c1.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5963c1.exe"26⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"25⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5970f0.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5970f0.exe"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"26⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e597cc7.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e597cc7.exe"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"27⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e598a73.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e598a73.exe"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"28⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59965a.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59965a.exe"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"29⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59a270.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59a270.exe"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"30⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59af03.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59af03.exe"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"31⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"32⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59bba5.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59bba5.exe"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"32⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59c7da.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59c7da.exe"34⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"33⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59d3e0.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59d3e0.exe"35⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"34⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"35⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59e044.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59e044.exe"36⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"35⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"36⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59ec3b.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59ec3b.exe"37⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"36⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"37⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59f89f.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e59f89f.exe"38⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"37⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"38⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5a0502.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5a0502.exe"39⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"38⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"39⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5a11a5.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5a11a5.exe"40⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"39⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"40⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5a1dab.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5a1dab.exe"41⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"40⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"41⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5a2a1e.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5a2a1e.exe"42⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"41⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"42⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5a3625.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5a3625.exe"43⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"42⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"43⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5a42d7.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker\0e5a42d7.exe"44⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"43⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.3.exe"44⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30.exe"44⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Xeno-v1.3.30.exe.log
Xeno-v1.3.3.exe
0e581cda.exe
memory/516-150-0x0000000006CB0000-0x0000000006CBC000-memory.dmp
memory/540-182-0x0000000003990000-0x0000000003A0E000-memory.dmp
memory/548-124-0x0000000002C60000-0x0000000002CDE000-memory.dmp
memory/548-123-0x000000003F950000-0x000000003FEF8000-memory.dmp
memory/844-43-0x0000000000C40000-0x00000000017CE000-memory.dmp
memory/844-45-0x0000000000C40000-0x00000000017CE000-memory.dmp
memory/1124-52-0x0000000006B90000-0x0000000006B9C000-memory.dmp
memory/1156-117-0x0000000006FE0000-0x0000000006FEC000-memory.dmp
memory/1276-80-0x00000000008E0000-0x000000000146E000-memory.dmp
memory/1276-82-0x00000000008E0000-0x000000000146E000-memory.dmp
memory/1456-101-0x0000000000B20000-0x00000000016AE000-memory.dmp
memory/1456-102-0x0000000000B20000-0x00000000016AE000-memory.dmp
memory/1540-172-0x000000003F950000-0x000000003FEF8000-memory.dmp
memory/1540-173-0x0000000002530000-0x00000000025AE000-memory.dmp
memory/1544-74-0x0000000002D10000-0x0000000002D8E000-memory.dmp
memory/1544-73-0x000000003F950000-0x000000003FEF8000-memory.dmp
memory/1684-35-0x00000000007B0000-0x000000000133E000-memory.dmp
memory/1684-32-0x00000000007B0000-0x000000000133E000-memory.dmp
memory/1692-144-0x00000000010A0000-0x000000000111E000-memory.dmp
memory/1692-143-0x000000003F950000-0x000000003FEF8000-memory.dmp
memory/1800-134-0x000000003F950000-0x000000003FEF8000-memory.dmp
memory/1800-135-0x0000000002E90000-0x0000000002F0E000-memory.dmp
memory/1828-20-0x00000000088F0000-0x00000000088FC000-memory.dmp
memory/1856-72-0x0000000006020000-0x000000000602C000-memory.dmp
memory/2100-84-0x0000000006260000-0x000000000626C000-memory.dmp
memory/2112-130-0x0000000006AA0000-0x0000000006AAC000-memory.dmp
memory/2172-91-0x0000000000180000-0x0000000000D0E000-memory.dmp
memory/2172-92-0x0000000000180000-0x0000000000D0E000-memory.dmp
memory/2188-159-0x0000000006A50000-0x0000000006A5C000-memory.dmp
memory/2264-33-0x0000000007C80000-0x0000000007C8C000-memory.dmp
memory/2356-166-0x00000000060F0000-0x00000000060FC000-memory.dmp
memory/2412-62-0x0000000003C30000-0x0000000003CAE000-memory.dmp
memory/2412-61-0x000000003F950000-0x000000003FEF8000-memory.dmp
memory/2460-106-0x000000003F950000-0x000000003FEF8000-memory.dmp
memory/2460-107-0x0000000000F40000-0x0000000000FBE000-memory.dmp
memory/2496-63-0x00000000085F0000-0x00000000085FC000-memory.dmp
memory/2556-70-0x0000000000650000-0x00000000011DE000-memory.dmp
memory/2556-68-0x0000000000650000-0x00000000011DE000-memory.dmp
memory/2588-151-0x00000000000D0000-0x0000000000C5E000-memory.dmp
memory/2672-47-0x000000003F950000-0x000000003FEF8000-memory.dmp
memory/2672-48-0x0000000002E50000-0x0000000002ECE000-memory.dmp
memory/2684-108-0x00000000085D0000-0x00000000085DC000-memory.dmp
memory/2716-94-0x0000000006580000-0x000000000658C000-memory.dmp
memory/2736-175-0x0000000006800000-0x000000000680C000-memory.dmp
memory/2772-153-0x00000000030C0000-0x000000000313E000-memory.dmp
memory/2772-152-0x000000003F950000-0x000000003FEF8000-memory.dmp
memory/2772-57-0x00000000000C0000-0x0000000000C4E000-memory.dmp
memory/2772-59-0x00000000000C0000-0x0000000000C4E000-memory.dmp
memory/2808-86-0x0000000002DA0000-0x0000000002E1E000-memory.dmp
memory/2808-85-0x000000003F950000-0x000000003FEF8000-memory.dmp
memory/3068-131-0x0000000000EB0000-0x0000000001A3E000-memory.dmp
memory/3548-171-0x0000000000430000-0x0000000000FBE000-memory.dmp
memory/3664-160-0x0000000000E40000-0x00000000019CE000-memory.dmp
memory/3680-113-0x0000000000240000-0x0000000000DCE000-memory.dmp
memory/3708-180-0x00000000003F0000-0x0000000000F7E000-memory.dmp
memory/3764-0-0x0000000000760000-0x0000000005FCC000-memory.dmp
memory/3764-16-0x0000000008090000-0x000000000809C000-memory.dmp
memory/3764-1-0x0000000020C90000-0x0000000020CA0000-memory.dmp
memory/3884-95-0x000000003F950000-0x000000003FEF8000-memory.dmp
memory/3884-96-0x0000000001420000-0x000000000149E000-memory.dmp
memory/4016-25-0x000000003F950000-0x000000003FEF8000-memory.dmp
memory/4016-26-0x0000000003B80000-0x0000000003BFE000-memory.dmp
memory/4292-36-0x000000003F950000-0x000000003FEF8000-memory.dmp
memory/4292-37-0x0000000002920000-0x000000000299E000-memory.dmp
memory/4312-115-0x00000000025C0000-0x000000000263E000-memory.dmp
memory/4312-114-0x000000003F950000-0x000000003FEF8000-memory.dmp
memory/4432-137-0x0000000007D30000-0x0000000007D3C000-memory.dmp
memory/4460-164-0x00000000025C0000-0x000000000263E000-memory.dmp
memory/4460-163-0x000000003F950000-0x000000003FEF8000-memory.dmp
memory/4704-104-0x0000000023A20000-0x0000000023A9E000-memory.dmp
memory/4704-161-0x0000000000440000-0x0000000000FCE000-memory.dmp
memory/4704-50-0x0000000000440000-0x0000000000FCE000-memory.dmp
memory/4704-49-0x0000000000440000-0x0000000000FCE000-memory.dmp
memory/4704-75-0x0000000000440000-0x0000000000FCE000-memory.dmp
memory/4704-24-0x0000000000440000-0x0000000000FCE000-memory.dmp
memory/4704-132-0x0000000000440000-0x0000000000FCE000-memory.dmp
memory/4704-103-0x0000000000440000-0x0000000000FCE000-memory.dmp
memory/4716-46-0x0000000007DC0000-0x0000000007DCC000-memory.dmp
memory/4936-142-0x00000000009D0000-0x000000000155E000-memory.dmp
memory/5112-122-0x00000000000B0000-0x0000000000C3E000-memory.dmp