05917b409d59af31bc8d3021bc06302a0c21c7d05b449603d6cc9f0301a2b66c

Analysis

geolocation tags

brbrazilsouth-america
max time kernel
898s
max time network
456s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/05/2026, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno-v1.3.40/XenoUI.runtimeconfig.json
Size 516B
Sample260505-bcv57set8z
SHA256 05917b409d59af31bc8d3021bc06302a0c21c7d05b449603d6cc9f0301a2b66c
MD5 6cc5992b5f24e3ff259ff61441f0bce9
SHA1 98e9fecdc80c90f6d250b9afca50eab4c4c0151b
SHA512 64b9612846b342fd254c439be1833b4fde0e7bcea5979879d333b54a7633a9936df65639101ddb28023a3877f9a4dd1cbde29b2dfe79538bec48cc4a8aecb377
TLSH
T150F02069CA106DA704B937BAC63AC182FB30573B00041D92B9FC080C2F77DB22212F89
MD5 SHA1 SHA512 TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4848	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.40\XenoUI.runtimeconfig.json
1⤵
- Modifies registry class
PID:4444

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4848-0-0x00000200380A0000-0x00000200381BE000-memory.dmp

Download