Analysis
- user interaction
yes - max time kernel
300s - max time network
301s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
29/04/2026, 23:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
faceitclient.exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
300 seconds
General
- Target faceitclient.exe
- Size 2.7MB
- Sample260429-29sdpac12q
- SHA256 8cd560d49df72606db9909d8abeba0ec2f477711e3febda7c72f15000e730bb0
- MD5 bf138fcaade4aee31f69fe1b3d6be3c4
- SHA1 9d1e012320bf15c110165551e326e61954a25f17
- SHA512 e466fd603f3f8c7ed4534fc544d9b1ac70080bf21351fd54efe5dedf157acefaf3b56b65d62af0054a133c1d93361937ef8c6dcbe5b01dc876cf66210ad6838a
- SSDEEP 24576:rwl7tC/5KX7UB4OFMKDLDizh7Mtbt4/kbDe+Ec0xMkl81sU3AofYdnKkTqWA:sl7tCkUVvE1WR4/kHvYdnKkTqWA
- TLSH T1C5D5E74359DB0CE9CED66BBC61D76335A734FD35CA291F2BAA04C2212D536C4AD2EB40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\UMDF\win32_hook_17BC1C42.dat faceitclient.exe File created C:\Windows\System32\drivers\it-IT\cache_mgr_7A0B2D21.db xenoloader.exe File created C:\Windows\System32\drivers\DriverData\win32_hook_6457472A.tmp faceitclient.exe File created C:\Windows\System32\drivers\es-ES\ac_core_4AED1885.sys faceitclient.exe File created C:\Windows\SysWOW64\drivers\es-ES\xeno_guard_77BC06AA.bin faceitclient.exe File created C:\Windows\System32\drivers\uk-UA\update_svc_4C3253B2.log faceitclient.exe File created C:\Windows\System32\drivers\en-US\hal_drv_08E41A27.dll faceitclient.exe File created C:\Windows\System32\drivers\en-US\xeno_guard_5F901359.tmp faceitclient.exe File created C:\Windows\SysWOW64\drivers\xeno_guard_1D2343F3.log faceitclient.exe File created C:\Windows\SysWOW64\drivers\en-US\cfg_mgr_3B085E0A.db faceitclient.exe File created C:\Windows\SysWOW64\drivers\en-US\ac_core_34334ED8.dat faceitclient.exe File created C:\Windows\System32\drivers\ja-JP\update_svc_77115207.bin faceitclient.exe File created C:\Windows\SysWOW64\drivers\es-ES\hal_drv_408D4A5E.cache xenoloader.exe File created C:\Windows\System32\drivers\it-IT\xeno_module_3E3414F4.sys xenoloader.exe File created C:\Windows\SysWOW64\drivers\UMDF\xeno_core_63283001.cache faceitclient.exe File created C:\Windows\SysWOW64\drivers\es-ES\policy_mgr_3B691AB2.db faceitclient.exe File created C:\Windows\SysWOW64\drivers\ja-JP\cache_mgr_69AF2EEB.tmp xenoloader.exe File created C:\Windows\SysWOW64\drivers\de-DE\cache_mgr_60AF3C0F.dat xenoloader.exe File created C:\Windows\System32\drivers\UMDF\xeno_guard_1F363B2B.sys xenoloader.exe File created C:\Windows\System32\drivers\it-IT\update_svc_72C47CEF.cache faceitclient.exe File created C:\Windows\SysWOW64\drivers\ja-JP\wdm_flt_17F852DA.sys xenoloader.exe File created C:\Windows\System32\drivers\ja-JP\svc_host_4B0B42CB.cache faceitclient.exe File created C:\Windows\SysWOW64\drivers\win32_hook_54AF165A.tmp xenoloader.exe File created C:\Windows\System32\drivers\uk-UA\cfg_mgr_003D6A19.dll faceitclient.exe File created C:\Windows\System32\drivers\en-US\wdm_flt_5FF1793B.bin xenoloader.exe File created C:\Windows\SysWOW64\drivers\en-US\sys_guard_15B76413.bin xenoloader.exe File created C:\Windows\System32\drivers\es-ES\cfg_mgr_76AF5550.db faceitclient.exe File created C:\Windows\SysWOW64\drivers\wdm_flt_0A7B435A.dll faceitclient.exe File created C:\Windows\SysWOW64\drivers\UMDF\policy_mgr_5232656D.dll xenoloader.exe File created C:\Windows\System32\drivers\uk-UA\integ_chk_135C39B4.cache xenoloader.exe File created C:\Windows\System32\drivers\DriverData\hal_drv_59591965.dat xenoloader.exe File created C:\Windows\SysWOW64\drivers\it-IT\drv_loader_642A3AD8.dat xenoloader.exe File created C:\Windows\System32\drivers\UMDF\hal_drv_215B12B2.log xenoloader.exe File created C:\Windows\System32\drivers\it-IT\cache_mgr_508D1FCD.bin faceitclient.exe File created C:\Windows\System32\drivers\en-US\cfg_mgr_5C5A7D54.dll xenoloader.exe File created C:\Windows\SysWOW64\drivers\es-ES\wdm_flt_520465C9.db faceitclient.exe File created C:\Windows\System32\drivers\ja-JP\integ_chk_32B077D3.dll faceitclient.exe File created C:\Windows\System32\drivers\sys_guard_36A0095F.bin xenoloader.exe File created C:\Windows\SysWOW64\drivers\xeno_core_023E3AD5.dll faceitclient.exe File created C:\Windows\System32\drivers\de-DE\rt_engine_0A7446EC.tmp xenoloader.exe File created C:\Windows\System32\drivers\DriverData\xeno_guard_073B166B.sys faceitclient.exe File created C:\Windows\SysWOW64\drivers\ja-JP\hal_drv_63081FC1.cache faceitclient.exe File created C:\Windows\SysWOW64\drivers\cfg_mgr_419E630E.log xenoloader.exe File created C:\Windows\System32\drivers\de-DE\win32_hook_094033F6.db xenoloader.exe File created C:\Windows\SysWOW64\drivers\it-IT\win32_hook_2B762692.log faceitclient.exe File created C:\Windows\System32\drivers\de-DE\cache_mgr_08494162.dat xenoloader.exe File created C:\Windows\System32\drivers\etc\xeno_drv_672666D8.cache faceitclient.exe File created C:\Windows\System32\drivers\es-ES\xeno_core_793E1081.dll faceitclient.exe File created C:\Windows\SysWOW64\drivers\fr-FR\xeno_core_20C45801.dll faceitclient.exe File created C:\Windows\SysWOW64\drivers\fr-FR\policy_mgr_54AB3025.tmp faceitclient.exe File created C:\Windows\SysWOW64\drivers\fr-FR\drv_loader_75D538CF.db xenoloader.exe File created C:\Windows\System32\drivers\xeno_guard_37F1288B.bin xenoloader.exe File created C:\Windows\System32\drivers\fr-FR\cfg_mgr_695D0C82.cache faceitclient.exe File created C:\Windows\System32\drivers\uk-UA\hal_drv_7BBA1EEE.bin xenoloader.exe File created C:\Windows\SysWOW64\drivers\ja-JP\policy_mgr_0CD64557.bin faceitclient.exe File created C:\Windows\SysWOW64\drivers\UMDF\xeno_module_2E2F0E18.db faceitclient.exe File created C:\Windows\SysWOW64\drivers\fr-FR\xeno_patch_4A444414.db faceitclient.exe File created C:\Windows\System32\drivers\it-IT\rt_engine_0E38643A.sys xenoloader.exe File created C:\Windows\SysWOW64\drivers\ja-JP\policy_mgr_2EE21B70.dll xenoloader.exe File created C:\Windows\System32\drivers\ja-JP\ac_core_169932C0.log faceitclient.exe File created C:\Windows\System32\drivers\UMDF\integ_chk_7ACB716E.bin xenoloader.exe File created C:\Windows\System32\drivers\en-US\drv_loader_599078C1.dll xenoloader.exe File created C:\Windows\System32\drivers\it-IT\win32_hook_252729DB.cache xenoloader.exe File created C:\Windows\System32\drivers\de-DE\hal_drv_45AC36D5.dat faceitclient.exe - Executes dropped EXE 2 IoCs
pid Process 4120 xenoloader.exe 3932 xenoloader.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XenoLoader = "\"C:\\ProgramData\\XenoLoader\\xenoloader.exe\" /blocker" faceitclient.exe - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 discord.com 2 discord.com - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\WCN\es-ES\xeno_drv_3A020BED.log xenoloader.exe File created C:\Windows\System32\setup\kernel_ext_20131137.dll faceitclient.exe File created C:\Windows\SysWOW64\InstallShield\xeno_guard_36EC3594.tmp xenoloader.exe File created C:\Windows\System32\slmgr\0410\svc_host_543D194B.cache xenoloader.exe File created C:\Windows\SysWOW64\DriverStore\ja-JP\xeno_patch_773B2658.log xenoloader.exe File created C:\Windows\SysWOW64\Speech\SpeechUX\drv_loader_3C963D63.sys faceitclient.exe File created C:\Windows\System32\it\svc_host_21EC695B.cache faceitclient.exe File created C:\Windows\System32\migwiz\integ_chk_79EF203F.sys faceitclient.exe File created C:\Windows\System32\MUI\ac_core_4D1135EC.db faceitclient.exe File created C:\Windows\SysWOW64\XPSViewer\es-ES\xeno_guard_4AC819E5.dll faceitclient.exe File created C:\Windows\System32\sru\net_filter_68BB0281.cache xenoloader.exe File created C:\Windows\System32\Speech_OneCore\common\xeno_patch_01C74C01.sys faceitclient.exe File created C:\Windows\System32\oobe\it-IT\kernel_ext_4D1C375B.db faceitclient.exe File created C:\Windows\System32\SleepStudy\drv_loader_1D1C7279.bin faceitclient.exe File created C:\Windows\System32\networklist\icons\xeno_core_72A745CF.log faceitclient.exe File created C:\Windows\System32\0409\cache_mgr_777116B4.tmp xenoloader.exe File created C:\Windows\System32\appraiser\hal_drv_39145036.sys faceitclient.exe File created C:\Windows\System32\spp\store\policy_mgr_4F9D4D32.db xenoloader.exe File created C:\Windows\SysWOW64\slmgr\xeno_core_36DD53FB.tmp xenoloader.exe File created C:\Windows\System32\wbem\AutoRecover\kernel_ext_1A10260E.bin xenoloader.exe File created C:\Windows\System32\IME\xeno_drv_4FA72025.db faceitclient.exe File created C:\Windows\System32\wbem\Performance\svc_host_2CFF666D.dll xenoloader.exe File created C:\Windows\System32\spp\update_svc_156602A8.tmp xenoloader.exe File created C:\Windows\System32\pt-PT\cfg_mgr_568D0369.dat faceitclient.exe File created C:\Windows\System32\Com\it-IT\sys_guard_41944FF5.dll xenoloader.exe File created C:\Windows\System32\Tasks\GoogleSystem\update_svc_21025BFE.log faceitclient.exe File created C:\Windows\System32\PerceptionSimulation\es-ES\rt_engine_01AB4FCB.tmp faceitclient.exe File created C:\Windows\System32\SystemResetPlatform\ja-JP\integ_chk_1ED97C60.tmp faceitclient.exe File created C:\Windows\SysWOW64\SMI\Manifests\policy_mgr_04627217.log faceitclient.exe File created C:\Windows\System32\spool\PRINTERS\xeno_patch_74F71418.dat faceitclient.exe File created C:\Windows\System32\MailContactsCalendarSync\rt_engine_6F3548BC.dat xenoloader.exe File created C:\Windows\SysWOW64\InputMethod\JPN\xeno_core_1F7729CF.dll faceitclient.exe File created C:\Windows\System32\MsDtc\Trace\svc_host_2A0B55AC.dll xenoloader.exe File created C:\Windows\System32\pt-BR\integ_chk_3E007F5A.bin xenoloader.exe File created C:\Windows\System32\slmgr\040C\xeno_guard_45455C78.dll faceitclient.exe File created C:\Windows\System32\config\systemprofile\hal_drv_68BD6051.dll xenoloader.exe File created C:\Windows\System32\fr-CA\win32_hook_26A24F8C.tmp faceitclient.exe File created C:\Windows\SysWOW64\MUI\0C0A\policy_mgr_62A95E19.dll xenoloader.exe File created C:\Windows\SysWOW64\IME\IMEJP\win32_hook_39203904.tmp xenoloader.exe File created C:\Windows\System32\spp\store\win32_hook_482D3C01.log xenoloader.exe File created C:\Windows\System32\Dism\it-IT\rt_engine_50E02563.dat xenoloader.exe File created C:\Windows\System32\winrm\0410\cache_mgr_5B660B03.bin faceitclient.exe File created C:\Windows\System32\PerceptionSimulation\Assets\xeno_patch_470A59C9.sys xenoloader.exe File created C:\Windows\System32\CodeIntegrity\cache_mgr_6A8D48BE.cache faceitclient.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\en-US\ac_core_729749A0.log xenoloader.exe File created C:\Windows\System32\ru-RU\win32_hook_3D041AE5.sys xenoloader.exe File created C:\Windows\System32\ShellExperiences\xeno_guard_54372010.dat xenoloader.exe File created C:\Windows\System32\DriverStore\es-ES\net_filter_521734C4.bin xenoloader.exe File created C:\Windows\System32\slmgr\0C0A\svc_host_1FF52A4E.cache faceitclient.exe File created C:\Windows\SysWOW64\wbem\Logs\update_svc_4A8D5841.dat xenoloader.exe File created C:\Windows\System32\DriverStore\ja-JP\update_svc_68CF4C1F.db xenoloader.exe File created C:\Windows\System32\wbem\uk-UA\net_filter_28840DE2.cache faceitclient.exe File created C:\Windows\System32\en-GB\wdm_flt_24D54273.bin faceitclient.exe File created C:\Windows\SysWOW64\migration\ja-JP\cfg_mgr_31960C5D.dat xenoloader.exe File created C:\Windows\System32\ca-ES\cfg_mgr_38FA3543.db faceitclient.exe File created C:\Windows\SysWOW64\wbem\AutoRecover\rt_engine_1063448E.db xenoloader.exe File created C:\Windows\SysWOW64\nb-NO\xeno_module_30837E9B.bin faceitclient.exe File created C:\Windows\System32\sppui\xeno_core_741167CC.bin faceitclient.exe File created C:\Windows\System32\Sysprep\ja-JP\wdm_flt_6C133BE9.db faceitclient.exe File created C:\Windows\SysWOW64\WCN\fr-FR\drv_loader_23E7150A.sys xenoloader.exe File created C:\Windows\System32\NDF\svc_host_78687837.bin faceitclient.exe File created C:\Windows\SysWOW64\MailContactsCalendarSync\svc_host_14337FC0.dat faceitclient.exe File created C:\Windows\SysWOW64\en-US\policy_mgr_73416DAB.dll faceitclient.exe File created C:\Windows\System32\Dism\fr-FR\kernel_ext_280F5566.dll xenoloader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Temp\xeno_guard_2D7F1C2D.sys faceitclient.exe File created C:\Program Files\Internet Explorer\en-US\hal_drv_580A4AD4.dll xenoloader.exe File created C:\Program Files\rt_engine_480672C2.db faceitclient.exe File created C:\Program Files (x86)\Internet Explorer\es-ES\svc_host_3CCE5FD6.sys xenoloader.exe File created C:\Program Files\VideoLAN\VLC\lua\net_filter_6D324AD5.sys faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\et-EE\svc_host_230A2F35.dat xenoloader.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Assets\update_svc_5F1E63DF.bin xenoloader.exe File created C:\Program Files (x86)\Windows Photo Viewer\es-ES\net_filter_384403D1.dat xenoloader.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_1.0.22.0_neutral_split.scale-125_8wekyb3d8bbwe\sys_guard_1B8A4A58.dat faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\AppxMetadata\cfg_mgr_27E0443A.db faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\AppxMetadata\ac_core_64FE1FF1.dll xenoloader.exe File created C:\Program Files\dotnet\hal_drv_043D2515.bin xenoloader.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\AppxMetadata\kernel_ext_1ED512EE.sys xenoloader.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_2019.21012.10511.0_neutral_~_8wekyb3d8bbwe\xeno_module_6C240A1D.dll xenoloader.exe File created C:\Program Files (x86)\Adobe\win32_hook_7208763B.dll faceitclient.exe File created C:\Program Files\Common Files\System\de-DE\update_svc_763C69ED.db faceitclient.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_10.2.41172.0_neutral_split.scale-125_8wekyb3d8bbwe\rt_engine_71D36C84.tmp xenoloader.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_neutral_split.scale-100_8wekyb3d8bbwe\Images\kernel_ext_24567030.sys faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\ms-MY\sys_guard_4F2850E9.dat xenoloader.exe File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\vi-VN\sys_guard_19370EC3.dll xenoloader.exe File created C:\Program Files\Internet Explorer\uk-UA\xeno_guard_0E565B0E.cache faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Images\xeno_drv_65081927.dll faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.29512.0_x64__8wekyb3d8bbwe\sys_guard_082C3A7A.db xenoloader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\xeno_core_0F7B26BB.dll faceitclient.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GamingApp_2105.900.24.0_neutral_split.scale-125_8wekyb3d8bbwe\update_svc_50274B37.sys xenoloader.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\cfg_mgr_541C0229.sys xenoloader.exe File created C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\xeno_guard_163E0A94.sys xenoloader.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_neutral_split.scale-100_8wekyb3d8bbwe\svc_host_69A624A7.log faceitclient.exe File created C:\Program Files\WindowsApps\Deleted\xeno_drv_0CFE4FF0.cache faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\pt-PT\cfg_mgr_66406FE9.log faceitclient.exe File created C:\Program Files\Windows Media Player\Icons\xeno_patch_41D54B0B.dll xenoloader.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\cache_mgr_2B343584.bin xenoloader.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\svc_host_51825780.sys xenoloader.exe File created C:\Program Files\Java\jdk-1.8\bin\cfg_mgr_78423FE5.dll faceitclient.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\xeno_core_76DD210F.bin faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_neutral_~_8wekyb3d8bbwe\cache_mgr_596A0003.tmp faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\Assets\integ_chk_1FF94574.dll xenoloader.exe File created C:\Program Files (x86)\Windows Defender\wdm_flt_472A1C85.bin faceitclient.exe File created C:\Program Files (x86)\Windows Photo Viewer\de-DE\xeno_module_22D75D9F.sys faceitclient.exe File created C:\Program Files (x86)\Internet Explorer\images\xeno_guard_48D14D93.bin xenoloader.exe File created C:\Program Files (x86)\Windows Defender\it-IT\svc_host_64F91C84.tmp faceitclient.exe File created C:\Program Files\Windows Media Player\uk-UA\net_filter_228D1DD7.sys xenoloader.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\rt_engine_05435D17.dll xenoloader.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\AppCS\rt_engine_3B684C12.dll faceitclient.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\svc_host_2A2B09D4.dat xenoloader.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\sys_guard_612D2E29.sys faceitclient.exe File created C:\Program Files (x86)\Microsoft.NET\RedistList\win32_hook_0BA94ABB.bin xenoloader.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml\drv_loader_303A4FE9.log xenoloader.exe File created C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_neutral_split.scale-100_8wekyb3d8bbwe\sys_guard_38D57A18.dll xenoloader.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.21012.10511.0_neutral_split.scale-125_8wekyb3d8bbwe\policy_mgr_55346419.log faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\x64\cfg_mgr_5B35431B.cache faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\drv_loader_348339AD.tmp xenoloader.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\xeno_module_4A11024B.log faceitclient.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\policy_mgr_3DE708D1.cache xenoloader.exe File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\ko-KR\update_svc_70E62636.cache xenoloader.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ac_core_53A93C8A.cache faceitclient.exe File created C:\Program Files (x86)\Common Files\System\it-IT\cache_mgr_72861CB4.log xenoloader.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\win32_hook_03434237.sys xenoloader.exe File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_10.0.561.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\net_filter_0ED650D3.dll faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Assets\svc_host_1C582AF5.cache faceitclient.exe File created C:\Program Files (x86)\Google\GoogleUpdater\crx_cache\update_svc_2ACD1830.log xenoloader.exe File created C:\Program Files\Windows Photo Viewer\fr-FR\xeno_core_6F466E14.log faceitclient.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_neutral_split.scale-100_8wekyb3d8bbwe\xeno_guard_1EC67744.dat faceitclient.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\rt_engine_502C1C12.bin xenoloader.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-w..-provider.resources_31bf3856ad364e35_10.0.22000.1_it-it_50c62d385c1b9dd7\kernel_ext_55FD0B6B.sys xenoloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..cemanagement-dmcsps_31bf3856ad364e35_10.0.22000.348_none_74e5312fc75569c2\integ_chk_01CA23CD.dll faceitclient.exe File created C:\Windows\WinSxS\amd64_acpitime.inf.resources_31bf3856ad364e35_10.0.22000.1_en-us_a13fb9d3071a90f3\cache_mgr_51F67D7F.cache faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ment-configmanager2_31bf3856ad364e35_10.0.22000.120_none_0e3360ef2a21a313\f\cfg_mgr_30BF6DCB.log faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdvr-adm.resources_31bf3856ad364e35_10.0.22000.1_it-it_f3c281ae1a6f3894\policy_mgr_38723FCA.cache faceitclient.exe File created C:\Windows\UUS\amd64\fr-FR\win32_hook_770A39EB.sys faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cdpusersvc.resources_31bf3856ad364e35_10.0.22000.1_de-de_6e7d773b71f7161a\drv_loader_30AE51C7.cache faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eapteapext_31bf3856ad364e35_10.0.22000.1_none_f009f1706d80e157\svc_host_48B04202.dat faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-l..ockhostingframework_31bf3856ad364e35_10.0.22000.41_none_48731223d05b604e\f\net_filter_5AB41BCD.db xenoloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tion-admx.resources_31bf3856ad364e35_10.0.22000.1_en-us_78d10342a67a79a5\update_svc_6A0269BD.dat faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-winproviders-image_31bf3856ad364e35_10.0.22000.469_none_9a226eacaf081377\r\sys_guard_682B5FCE.tmp xenoloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ovidermof.resources_31bf3856ad364e35_10.0.22000.1_ja-jp_96fb76724737db76\xeno_core_732E2066.bin faceitclient.exe File created C:\Windows\PolicyDefinitions\es-ES\xeno_drv_2EDA6A7A.log faceitclient.exe File created C:\Windows\assembly\GAC_MSIL\System.ServiceModel.Install.Resources\win32_hook_7B626831.sys faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-adm.resources_31bf3856ad364e35_10.0.22000.1_ja-jp_1a17f7649ef10c99\kernel_ext_10362E05.dat xenoloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..ce_iassdo.resources_31bf3856ad364e35_10.0.22000.1_en-us_3ed9c83b3db4f5b6\hal_drv_516C5BA7.bin faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..ider-infrastructure_31bf3856ad364e35_10.0.22000.1_none_0260de6e93f9fa30\net_filter_321A7E49.log xenoloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ilter-rtf.resources_31bf3856ad364e35_7.0.22000.1_ja-jp_195e2c199f4c6590\xeno_drv_088748FB.db xenoloader.exe File created C:\Windows\WinSxS\amd64_dual_scunknown.inf_31bf3856ad364e35_10.0.22000.1_none_8e7463651ae4387a\xeno_drv_681F6598.log faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-efsadu_31bf3856ad364e35_10.0.22000.1_none_4a74136e8e15c12a\xeno_guard_0F975BBD.log xenoloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ctoryservices-lsadb_31bf3856ad364e35_10.0.22000.434_none_9894a694633fc710\xeno_patch_33A63E10.dat xenoloader.exe File created C:\Windows\WinSxS\amd64_system.diagnostics.debug_b03f5f7f11d50a3a_4.0.15806.0_none_6ca402b6d18d86ee\xeno_drv_4C1A67BA.bin xenoloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..d-library.resources_31bf3856ad364e35_10.0.22000.1_es-es_3d13264cbd0d2373\rt_engine_0A7261AE.log faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..utilities.resources_31bf3856ad364e35_11.0.22000.1_en-us_54d6fb5a2f8f392d\cache_mgr_58645F6C.dat faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..p-ui-libs.resources_31bf3856ad364e35_10.0.22000.1_en-us_26298d686e9a7ea5\sys_guard_61263EB9.db faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.22000.100_none_c98e4ba1fbb1ffd8\f\update_svc_2E7842A2.dll xenoloader.exe File created C:\Windows\WinSxS\amd64_netfx4-presentationhostdllmui_b03f5f7f11d50a3a_4.0.15806.281_none_1b37a83785cf784a\rt_engine_29A84B51.cache faceitclient.exe File created C:\Windows\WinSxS\amd64_netfx-clr_sys_entservcs_thunk_dll_b03f5f7f11d50a3a_10.0.22000.1_none_a77ca44161fced73\cfg_mgr_0C190F16.db xenoloader.exe File created C:\Windows\WinSxS\amd64_dual_wvmbusr.inf_31bf3856ad364e35_10.0.22000.318_none_ee69fd06851c3c67\f\update_svc_00225BE8.bin xenoloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-host-network-service_31bf3856ad364e35_10.0.22000.348_none_f63c0c8ee5603583\r\xeno_patch_772F58C7.db faceitclient.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f9a5e83#\svc_host_7FA857A9.db faceitclient.exe File created C:\Windows\WinSxS\amd64_regasm_b03f5f7f11d50a3a_4.0.15806.0_none_721a928100ad3217\integ_chk_6A921879.tmp faceitclient.exe File created C:\Windows\WinSxS\amd64_hyperv-vmuidevices.resources_31bf3856ad364e35_10.0.22000.1_it-it_3a4adcbd17b482aa\net_filter_381C15CD.cache xenoloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ction-adm.resources_31bf3856ad364e35_10.0.22000.1_fr-fr_11ca8bcaa9886637\xeno_module_12A93C8C.db xenoloader.exe File created C:\Windows\WinSxS\msil_microsoft.windows.d..iagreport.resources_31bf3856ad364e35_10.0.22000.1_es-es_dd1715f542960278\rt_engine_72721D96.dat faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-takeown_31bf3856ad364e35_10.0.22000.1_none_502f03701a672d6b\cache_mgr_233224EE.bin xenoloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\ScreenClipping\cfg_mgr_4C2339CA.tmp faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..re-server.resources_31bf3856ad364e35_10.0.22000.1_de-de_391c595925292b0a\cache_mgr_7E0F0AEE.sys faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nshhttp.resources_31bf3856ad364e35_10.0.22000.1_fr-fr_5839b5472f4f461f\hal_drv_51786FCD.dat xenoloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..k-handler.resources_31bf3856ad364e35_10.0.22000.1_de-de_2c67f791972d022a\xeno_guard_6FA86F6E.bin faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.22000.348_cs-cz_ba85e9e1a4e776b7\f\integ_chk_7E156E38.tmp faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proquota.resources_31bf3856ad364e35_10.0.22000.1_fr-fr_f79fad0b728f8bd1\drv_loader_314E531A.tmp xenoloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sens-client_31bf3856ad364e35_10.0.22000.120_none_fca7dfa5424ebbed\f\xeno_guard_744E47B0.dll faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..le-server.resources_31bf3856ad364e35_10.0.22000.1_ja-jp_739f90c774da9ea6\xeno_guard_7B187903.dll faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..inrt-core.resources_31bf3856ad364e35_10.0.22000.1_it-it_43be9a9c25c1ffb8\xeno_guard_3F121EB8.dat faceitclient.exe File created C:\Windows\WinSxS\amd64_netip6.inf.resources_31bf3856ad364e35_10.0.22000.1_en-us_e167c39270be7d51\integ_chk_289F1BB3.tmp xenoloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..omponents.resources_31bf3856ad364e35_10.0.22000.1_de-de_e2b4c0100c86516e\cache_mgr_45957E43.dat faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..iguration.resources_31bf3856ad364e35_10.0.22000.1_ja-jp_e7838b2d7f96c172\kernel_ext_31ED5F7A.bin faceitclient.exe File created C:\Windows\WinSxS\amd64_transfercable.inf.resources_31bf3856ad364e35_10.0.22000.1_it-it_020a1fecf76b79b4\svc_host_15A565C7.log xenoloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-srh_31bf3856ad364e35_10.0.22000.120_none_a4d186b0dff36f6f\r\net_filter_6D612CCE.tmp xenoloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..platform2.resources_31bf3856ad364e35_11.0.22000.1_de-de_fb9fb6418c0d5bfa\net_filter_09736FF0.sys faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ction-adm.resources_31bf3856ad364e35_10.0.22000.1_it-it_d0856c302b229bf5\update_svc_52E8411A.log faceitclient.exe File created C:\Windows\ServiceState\EventLog\Data\ac_core_652B1F48.dat faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msf-core.resources_31bf3856ad364e35_10.0.22000.1_de-de_7d90ec5b5e866afa\sys_guard_4EE02561.db faceitclient.exe File created C:\Windows\WinSxS\amd64_windowsformsintegration.resources_31bf3856ad364e35_4.0.15806.0_it-it_fb229dff8cf1ef92\hal_drv_67D33A2A.db faceitclient.exe File created C:\Windows\WinSxS\msil_microsoft.powershel..nsolehost.resources_31bf3856ad364e35_10.0.22000.1_de-de_ad002d387b903e38\xeno_guard_7379422D.log faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.0.22000.282_none_52217a5fd0fa6a48\r\update_svc_6D4C5004.dat faceitclient.exe File created C:\Windows\WinSxS\amd64_netfx-system.design_b03f5f7f11d50a3a_10.0.22000.1_none_53279e3b17920a25\policy_mgr_3FD11AAD.dat xenoloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..nt-events.resources_31bf3856ad364e35_10.0.22000.1_it-it_c10eaa48e3588a08\xeno_drv_6BB9526B.bin xenoloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ager-udwm.resources_31bf3856ad364e35_10.0.22000.1_it-it_2bc96bed5f1fd7db\xeno_core_5FF24BAE.dat xenoloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.22000.1_da-dk_3669d54526e362ef\drv_loader_16C7501A.dat faceitclient.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\ValueBanner\cfg_mgr_7E292AE9.tmp faceitclient.exe File created C:\Windows\WinSxS\amd64_dual_wvid.inf_31bf3856ad364e35_10.0.22000.71_none_d469e7e31d1d7617\r\xeno_patch_3FDE714B.cache xenoloader.exe File created C:\Windows\WinSxS\msil_microsoft.backgroun..anagement.resources_31bf3856ad364e35_10.0.22000.1_de-de_d64b6cbe7c4c4929\wdm_flt_43A36DDC.log xenoloader.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3932 xenoloader.exe 3932 xenoloader.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3792 wrote to memory of 3932 3792 faceitclient.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\faceitclient.exe"C:\Users\Admin\AppData\Local\Temp\faceitclient.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\ProgramData\XenoLoader\xenoloader.exe"C:\ProgramData\XenoLoader\xenoloader.exe" /blocker2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3932
-
-
C:\ProgramData\XenoLoader\xenoloader.exeC:\ProgramData\XenoLoader\xenoloader.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4120
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\XenoLoader\xenoloader.exe
- Size 2.7MB
- SHA256 8cd560d49df72606db9909d8abeba0ec2f477711e3febda7c72f15000e730bb0
- MD5 bf138fcaade4aee31f69fe1b3d6be3c4
- SHA1 9d1e012320bf15c110165551e326e61954a25f17
- SHA512 e466fd603f3f8c7ed4534fc544d9b1ac70080bf21351fd54efe5dedf157acefaf3b56b65d62af0054a133c1d93361937ef8c6dcbe5b01dc876cf66210ad6838a
- SSDEEP 24576:rwl7tC/5KX7UB4OFMKDLDizh7Mtbt4/kbDe+Ec0xMkl81sU3AofYdnKkTqWA:sl7tCkUVvE1WR4/kHvYdnKkTqWA
- TLSH T1C5D5E74359DB0CE9CED66BBC61D76335A734FD35CA291F2BAA04C2212D536C4AD2EB40
- MD5 SHA1 SHA512 SSDEEP TLSH