XenoExecutor[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
XenoExecutor.exe
Size 28.1MB
Sample260719-cel6ract6s
SHA256 71d5fabdd8b478089e543ab6a6e92fa1bcf822ca095ee9ace7789e665c495dec
MD5 93cc155253429c5d55a4d35c41f11a33
SHA1 001e146ce340e22096824e3428aaafd95fce6528
SHA512 0e51c014e0dc3e50d31c1e3752aff256837c289eb19ec2bae23047b68ceab7c46a35aec07ce19d45b4703bc5846405f3449088530227549e4494c20dbb5eb4a3
SSDEEP 49152:ToAnT5THZp2mLlODnSiGLGqna/x5qIj5yPgFjs913k/BRHGfoN0IrR/ZDlGIBLOH:TdK1qna/x5qIji3WjHHNPO100c+R6M
TLSH
T1C1577C07AFDC07FCD567C7FC89AB9B32C6F1B86A8622C24B0554C7151E729B14E6A321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
XenoExecutor.exe

File Explorer

XenoExecutor.exe

.exe 28.1MB

XenoExecutor.exe

IMPHASH f469ac0906218570f79c54d1b58dc057
SHA256 71d5fabdd8b478089e543ab6a6e92fa1bcf822ca095ee9ace7789e665c495dec
MD5 93cc155253429c5d55a4d35c41f11a33
SHA1 001e146ce340e22096824e3428aaafd95fce6528
SHA512 0e51c014e0dc3e50d31c1e3752aff256837c289eb19ec2bae23047b68ceab7c46a35aec07ce19d45b4703bc5846405f3449088530227549e4494c20dbb5eb4a3
SSDEEP 49152:ToAnT5THZp2mLlODnSiGLGqna/x5qIj5yPgFjs913k/BRHGfoN0IrR/ZDlGIBLOH:TdK1qna/x5qIji3WjHHNPO100c+R6M
TLSH
T1C1577C07AFDC07FCD567C7FC89AB9B32C6F1B86A8622C24B0554C7151E729B14E6A321
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

389656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegCreateKeyExW RegSetValueExW EventWrite EventRegister EventEnabled OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW

bcrypt

BCryptGenRandom

kernel32

TlsFree TlsSetValue MultiByteToWideChar GetStdHandle TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToSystemTime GetSystemTime GetTickCount64 GetCurrentProcessorNumber GetCurrentProcess GetCurrentThread WaitForSingleObject Sleep CreateThreadpoolWork CloseThreadpoolWork SubmitThreadpoolWork InitializeCriticalSection InitializeConditionVariable DeleteCriticalSection LocalFree EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable WaitForMultipleObjectsEx GetLastError GetCPInfo WideCharToMultiByte LocalAlloc GetConsoleOutputCP SetLastError GetProcAddress RaiseFailFastException ExpandEnvironmentStringsW FreeLibrary GetModuleFileNameW LoadLibraryExW CreateThread ResumeThread DuplicateHandle GetThreadPriority SetThreadPriority GetDynamicTimeZoneInformation GetTimeZoneInformation WriteFile CloseHandle SetEvent ResetEvent CreateEventExW FormatMessageW FindClose GetEnvironmentVariableW CreateDirectoryW FindFirstFileW FindNextFileW CreateFileW GetFileSize ReadFile GetFileAttributesW CreateProcessW GetModuleHandleA LoadLibraryA FlushProcessWriteBuffers QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId WaitForSingleObjectEx VirtualQuery RtlCaptureContext RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW TerminateProcess SwitchToThread SuspendThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask InitializeCriticalSectionEx GetSystemTimeAsFileTime DebugBreak SleepEx GlobalMemoryStatusEx GetSystemInfo GetTickCount GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock GetWriteWatch ResetWriteWatch VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry InitializeSListHead GetCurrentProcessId SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive

ole32

CoTaskMemFree CoGetApartmentType CoCreateGuid CoInitializeEx CoUninitialize CoWaitForMultipleHandles

api-ms-win-crt-math-l1-1-0

modf pow ceil __setusermatherr

api-ms-win-crt-heap-l1-1-0

free calloc _callnewh _set_new_mode malloc

api-ms-win-crt-string-l1-1-0

wcsncmp strcpy_s strcmp _wcsicmp

vcruntime140

_purecall memcpy memmove memset

api-ms-win-crt-runtime-l1-1-0

_crt_atexit terminate __p___wargv _seh_filter_exe _set_app_type _register_onexit_function _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e exit _exit _initialize_onexit_table __p___argc abort _cexit _c_exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

413KB

Virtual Size

412KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

137KB

Virtual Size

190KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

98KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

580B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

XenoExecutor.exe

advapi32

bcrypt

kernel32

ole32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic