4f9f822b2113981989391a9b5fb79d4f33cb7d082c434e19097486a852380f10 | Triage™

Resubmissions

26/04/2026, 16:09

260426-tl8rrsew4j3

26/04/2026, 16:08

260426-tk987saw313

Analysis

max time kernel
898s
max time network
390s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/04/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XenoExecutor-xeno/Xeno/run.bat
Size 33B
Sample260426-tk987saw31
SHA256 4f9f822b2113981989391a9b5fb79d4f33cb7d082c434e19097486a852380f10
MD5 83ffaf2b10b80d7e8ff740d8088fc57f
SHA1 0d6e4d0e9e0d6e462d046c091a976100f18da5e2
SHA512 50126cca130cc9b258c8654999d7ad93707ced2e2a47d07f3147515c93c5c18f83e3bf89be4dd9a1e1bed2b4f0a766fc57e5d6d4fa980c2d3bd1ce81169e9ec7
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 5004	2200	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\XenoExecutor-xeno\Xeno\run.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python format.py patch_script.lua
  2⤵
  PID:5004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads