def1c2f12307d598e42506a55f1a06ed5e652af0d260aac9572469429f10d04d

Analysis

max time kernel
6s
max time network
7s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xenos.exe
Size 1.1MB
Sample260723-cbf6bscn91
SHA256 def1c2f12307d598e42506a55f1a06ed5e652af0d260aac9572469429f10d04d
MD5 4731b90db56fc5dd654d59deca1009e6
SHA1 7c486d696813b1e0102f2feb300e6c6a7610287c
SHA512 5d089c44cf073c438d68d3c48172647b8bf1b36886ab93fed3f2f41d2b5454ac14092653d4d70c5ef8076c1f88e1aab9c5bc732097f12e3ade32ab6ea258d6a0
SSDEEP 24576:F6vLpf9LJiOm0xg2VkVtw099I98mzGokH/Ngwpsu+VfSVgPCS3tMrMyj3F9hIF12:afJWVD99U8okH/NSVRSVE3tMx3FE1S0W
TLSH
T13445AE0272C580B2D17202705E7D9B368AFDBD250B2187DF67846B2D9F74EE22D36726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Xenos.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\shell\Edit\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Xenos.exe --load %1"	Xenos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\DefaultIcon	Xenos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Xenos.exe,-135"	Xenos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\shell	Xenos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\shell\Edit\command	Xenos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\shell\Edit	Xenos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\shell\Run	Xenos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\shell\Run\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Xenos.exe --run %1"	Xenos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xpr	Xenos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xpr\Content Type = "Application/xml"	Xenos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile	Xenos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\shell\ = "Run"	Xenos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xpr\ = "XenosProfile"	Xenos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\ = "Xenos injection profile"	Xenos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\shell\Run\command	Xenos.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	952	Xenos.exe
Token: SeLoadDriverPrivilege	952	Xenos.exe

C:\Users\Admin\AppData\Local\Temp\Xenos.exe
"C:\Users\Admin\AppData\Local\Temp\Xenos.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/952-10-0x00000000000A0000-0x00000000001A0000-memory.dmp

Download