c144fd0c9ee115aa91990dea1f8cbfc295d5ac0c13f4b9fbfe8d6f95f35368ed

Sharing

Copy URL Twitter E-mail

General

Target
Xenos.zip
Size 20.1MB
Sample260709-wkpcvafs2k
SHA256 c144fd0c9ee115aa91990dea1f8cbfc295d5ac0c13f4b9fbfe8d6f95f35368ed
MD5 453bc316f6c663fc72aa0f7ad24f6e3e
SHA1 43ca9b782de3d606762a9c79650d39ded459e259
SHA512 949796849aeebd014473e03dbdea96777222768910fbb858dcd1e4dbb3be1c58160e2a6c6b56c5badd20d98f91a6d0d9056596e5dfc42a33cace604a952dcc4e
SSDEEP 393216:sq0nR5YBj7PDkbcRWHoDSAfsy+RBXZxsuuEMTKNDlq5ebW1eLT:snRKfobckHGlfsvR9ZxMFeNDlq5Szf
TLSH
T1AD27334E447C1476E691F9BED013AC761F59A35FEAA26C4EB2896A2C73007C8F14BCC5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Xenos/Xenos.exe
- Size 26.1MB
- SHA256 c02599445176620d4d00bd1b706fffa150bef864d30a4629df5fd74a79cc8e53
- MD5 ff0fb3de804e8b8a9bcfd5adf8f959fd
- SHA1 1dfcde2a11d6a02c0ec91ec9accdccb2639c202c
- SHA512 7f7228d14fe31b195ba17824fc9fa6e8d43678ddbab545541f84cd97f1e09bc63f1a1b5707f6fdd80c94a81280117c3dbc894436106e6780db1185fcb34032be
- SSDEEP 49152:o6Qjg9wUD8MBM5sbMaEkluX71lGpvXL2W30fdVuZEapJiNG+DMw6LiKnivb5kYnA:N
- TLSH
  T145578C7FC13B0827AE9B67C58C591ACADC4CE7512710646976AD188EC728EBFC0E1637
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1
- Target
  Xenos/engine/core.dll
- Size 439KB
- SHA256 eac9a8d33e5fbd28e93fe9a58c36403ceda5348a648f14692663890402867c45
- MD5 a54b3593144f51a9f239195bad716aa3
- SHA1 919557ec1058e2420a43dc17cda884bf0bf32c29
- SHA512 fd67a83e60b0df4c13a114017b5e0d8756aeaf066f67813a8d59647d3a540a9b302890222b388c54eb38b8168d729e4f45ab383a3015443d8079ff73e64b401f
- SSDEEP 12288:JBVH8DBjhHHCJdPzSYLyrWmuthKYEqjkzLpZnwy9:JBVWFnoLyWjthKYEqIUy9
- TLSH
  T169A4239E0E4EF08C825065406E273BD855BB01AB3BCCE7590879FE4A5D48E59C19DEF1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  Xenos/engine/runtime.dll
- Size 178KB
- SHA256 d90be834f52a684acd23f238bea0b8445ee364d5abbbad9da3817b3db1e8a9d5
- MD5 7dad42105118b5a1427ba1a2b0437b83
- SHA1 27626d93799a11586ec6850fcc6d5f897c20893d
- SHA512 0653d0c2a27c1899ae17ebb95da65bc6374d007155a46afde2460fbc9139417e61cd89e7a380abdbb0f90e99d446e51e2bf544dc2d3ffbb22ba8e973d370a2d1
- SSDEEP 3072:6N11empQqQHWmrhpd/lR6uSWUwEf4cJaE5OR8rMPcXak9Tt+KbAsBMWp3Arxci37:6N1HQHWm9rlRYhwE48aGOR84PcXlnhpA
- TLSH
  T19504120B01B9D393C3E632C5BBB26376F6CF366B24FB244593C04591D47256229B56F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  Xenos/extensions/ext1.dll
- Size 305KB
- SHA256 0bdbfc2778e4217b42ca0acea6ba3f0b4e33b74a57dd4b04a055444fdfee8b53
- MD5 57a0a800fc63f8896fa317eab466f5ae
- SHA1 250efbe73d1b5b666f3163dff906250c10a0e85a
- SHA512 e3fa3d9999af593e19464ffb05b17fe35a09790e6acb8ed220f534d34e02832532d4a27eda6f4dc1aca2732e171e68d594181047df3bd9c0e3e3d1a2e4366135
- SSDEEP 6144:3wCFH0WOEKJY6uvjhQLulouoIeVfsh4xC5TNMZ1ZNVItS:uW9KG6utAAHcS485I1nVIA
- TLSH
  T1A36423F8505B40FA424E449813CF01740E66D66A363C89AE37FF37D46B4B4E067AAF99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  Xenos/extensions/ext2.dll
- Size 283KB
- SHA256 f3b49a53fbcff192209757c84b33913934739383bd67b0bf8ff5b66225b4471a
- MD5 4b2943fc73565a8b6cf73e3b850970f3
- SHA1 62e5ee62a1a2b1d9c0c102b8d8e4fad8db6f09be
- SHA512 0aef8bcf62b210cd7e966f78c02a73d1d89ee53fe2c306e6f2cce8033cd4e8bc456db61bdd25c1f4bf4db291d7eaabc8c59d2b50a9106fed11b4e9e465203693
- SSDEEP 6144:uFHeig9kXZqb6FjIE+Kb1K+73grhmbxWrzlPSNGoE28qqZPS3Q0ByBOd:uF+ig+XZqGFjIQb1K+grExWrBuEd1ZPU
- TLSH
  T14854237D32EFD000E9F8CF03D80A8553465DD926E819E2EA7A40429DABE1971FE37523
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  Xenos/extensions/ext3.dll
- Size 753KB
- SHA256 fff7e82cdb3f1d9acaae444f6cf8b076a17658bde5e727cabd9e22523000523f
- MD5 a32123862438c66325d11f3889c971be
- SHA1 444144d0390e1b88904216f553b66c748b840885
- SHA512 a4f8a5be5ce7afddea809a8778d7d1de2383daae37bf2b558c34751775ea292c1852b3f4dbd627713b281dc13b752e5aa69a83e46a3e87129f2aa7051723cf75
- SSDEEP 12288:3N4C4QyVAxcICi3xwshgv7uR03ORsGCYz+54L2R2T0yJDBI/Ht0bqIAv01E:94CIVaRzmHvj3OuwS2FyV0bq4E
- TLSH
  T105F4230DD01E1AEE6EF1D065AF290D47F199DB002B17C9DF2A552E78C4463FA1BB02DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  Xenos/handlers/handler.dll
- Size 1019KB
- SHA256 15c959376523dc9733e20aea01effb50fecc7aa5e59a0ac5cf6cb969dae13312
- MD5 3ee5870b3a1eb7938f5ef20622e971d1
- SHA1 c7eb5353b01fe70e1f2225ca821f78fab2c93574
- SHA512 9fbbe85b9ff01740b5c6e3ace985c6d452f6b612eff2bce71bafcaf6ac4ecbb66de4d2b9cc72e380b901012311bad6f0094101fd808bdfe550322b73e95226a8
- SSDEEP 24576:3IOB93UuDI1P1heAq2HLaczTK4GpefYZQkkwSaw:YOn3UqIxRjJybZQqSaw
- TLSH
  T12825334ED864C946711C1FB4ABFE10C7A77B5AFFE68272258E5FE092391D0A0582D8F1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  Xenos/handlers/loader.dll
- Size 976KB
- SHA256 1922725f96f456911794d36d4ccb5890af0f4835d3a0ff15738224da176eff8b
- MD5 9cbebf3ddb341895f689bd7a9c522ab5
- SHA1 2e8f73a2a104184b63ded70ade1a70ad419b6e5a
- SHA512 3853ecd3d3011318a8b62760d1bf4f79f3ccd188ce1b18dc0eefbe184472af72c355c097119e1be8edc48b486088285fabbb89a867d2bdaa42d7ae198a6e6efc
- SSDEEP 24576:7+wZZl11NX0hXeKvurAWiUdroNwzWJOzFj/5EXHMLzq/uHlIP:7+u10hXi/ft/5UL/uHlIP
- TLSH
  T10A2533AA9FC0B60D880AE5A00F0F67F4A4441C5645DB2A7D33535F7B28387DB27F65A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  Xenos/resolvers/resolve.dll
- Size 143KB
- SHA256 3ca2077da08f52482fbc6e2f2eb17ed8f4b2733e3f5c6aa3eb36d328b370f299
- MD5 066afdeeeef62a9be4d462162ea5aaaa
- SHA1 29b35f823420eea86b72751d2ee8dda846399289
- SHA512 6485ab56f287a9ecd0e7fc370eacd74ad42dc2a750d8a09f8357e98b966551c229f643d7a0b6499413025e28a8ac60f068832a5a1c95a1267d246f62e8c254d2
- SSDEEP 3072:5Zj2Wz02Pkwby20qZ8UD3BaouUOpVBO78ztPxPNEpNwi:5ZyWNaE85ouLc8ztcyi
- TLSH
  T13DE312A8FA84709CF3379D2AEF0C33CAF4AA4E4B91A242F77B050B385341A6D0506597
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Adds Run key to start application

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9