9764d8206a2c6bbca0e1ca0db80456dfdfd2961cb9d8a4bd198c7dcd7b743db9

Analysis

max time kernel
149s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 09:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno-v1.exe
Size 85.0MB
Sample260517-ljbegset8s
SHA256 9764d8206a2c6bbca0e1ca0db80456dfdfd2961cb9d8a4bd198c7dcd7b743db9
MD5 9117748c626f819e0626255e19c73968
SHA1 89b5f528f408da5a1ea395ae38f82e2d261aee28
SHA512 d31def8df1894a1c1c3842762c8377501fa2743d81d827e16cf1bc7a2c1fc65de00135e163171a512219d1291d8ab3f3ae9eac8bd6828e79ae664b6bab579f04
SSDEEP 1572864:LIMq0s3CdsOjD4LsJlkAIM41Cjy3J+k5smh29Ad/RmS8T0JnyaqA:bq02DOno1vCjywKsmh6iJ3nyaq
TLSH
T1B218333EC0155C48288B1C5BFA4DA45978AFD30AD0CDD4B4E8E729BD86E8917276F4E3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2180	xeno.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
2	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Xeno-v1.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2180	xeno.exe
Token: SeIncBasePriorityPrivilege	2180	xeno.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 2180	3424	Xeno-v1.exe	80

C:\Users\Admin\AppData\Local\Temp\Xeno-v1.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Users\Admin\AppData\Local\Temp\xeno.exe
  "C:\Users\Admin\AppData\Local\Temp\xeno.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xeno.exe

Path C:\Users\Admin\AppData\Local\Temp\xeno.exe
Size 804KB
SHA256 708c47c76c4cd86dd4caeedc7fb8c8eb6fc49ca47ae5630c72cf8edd1c677343
MD5 8ab37c188ccadd16a30a820bfd723079
SHA1 9b2f7a19ead5a56cef5e065986adaf5d2cc5424e
SHA512 375c1c5ea842136d26cdfc570493cf777ad08bf527e37109a3cc824cc5fefee204caec616ff378fa53ae71cc88c8fc5b5c10826ec1e8ab7b2f5ac32442940a0e
SSDEEP 6144:p8MVGvHeWdBg9bjp/e9NhLpCGxVRCCYnR0TzacG4h0my/ucGDk+kX8s6yzF6Of5v:X0vH/L8bteL1N/VacGoc3f5SZNf19j
TLSH
T199053A147F988A48D4911A7E415D0908CBAAEDF126327303371AFF664D359DECE2D3EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2180-11-0x0000029AB9390000-0x0000029AB9460000-memory.dmp

Download