Xenos[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Xenos.exe
Size 1.1MB
Sample260723-cbf6bscn91
SHA256 def1c2f12307d598e42506a55f1a06ed5e652af0d260aac9572469429f10d04d
MD5 4731b90db56fc5dd654d59deca1009e6
SHA1 7c486d696813b1e0102f2feb300e6c6a7610287c
SHA512 5d089c44cf073c438d68d3c48172647b8bf1b36886ab93fed3f2f41d2b5454ac14092653d4d70c5ef8076c1f88e1aab9c5bc732097f12e3ade32ab6ea258d6a0
SSDEEP 24576:F6vLpf9LJiOm0xg2VkVtw099I98mzGokH/Ngwpsu+VfSVgPCS3tMrMyj3F9hIF12:afJWVD99U8okH/NSVRSVE3tMx3FE1S0W
TLSH
T13445AE0272C580B2D17202705E7D9B368AFDBD250B2187DF67846B2D9F74EE22D36726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Xenos.exe

File Explorer

Xenos.exe

.exe 1.1MB

Xenos.exe

IMPHASH 2c4f8364dc2c225221cd7dc66caea7e0
SHA256 def1c2f12307d598e42506a55f1a06ed5e652af0d260aac9572469429f10d04d
MD5 4731b90db56fc5dd654d59deca1009e6
SHA1 7c486d696813b1e0102f2feb300e6c6a7610287c
SHA512 5d089c44cf073c438d68d3c48172647b8bf1b36886ab93fed3f2f41d2b5454ac14092653d4d70c5ef8076c1f88e1aab9c5bc732097f12e3ade32ab6ea258d6a0
SSDEEP 24576:F6vLpf9LJiOm0xg2VkVtw099I98mzGokH/Ngwpsu+VfSVgPCS3tMrMyj3F9hIF12:afJWVD99U8okH/NSVRSVE3tMx3FE1S0W
TLSH
T13445AE0272C580B2D17202705E7D9B368AFDBD250B2187DF67846B2D9F74EE22D36726
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

390157

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Ton\Documents\Visual Studio 2017\Projects\Xenos\build\Win32\Release\Xenos.pdb

shlwapi

SHDeleteKeyW SHSetValueW

dbghelp

MiniDumpWriteDump

kernel32

RaiseException LoadResource FindResourceW DecodePointer GetWindowsDirectoryW DeleteCriticalSection CreateProcessW GetCurrentProcess GetModuleFileNameW WaitForSingleObject GetCurrentThreadId Sleep CreateThread GetLocalTime ExitProcess GetCurrentProcessId SetUnhandledExceptionFilter FlushFileBuffers GetFileAttributesW ResumeThread CloseHandle GetNativeSystemInfo GetModuleHandleW DeleteFileW LockResource GetLastError Wow64RevertWow64FsRedirection CreateFileW InitializeCriticalSectionEx Wow64DisableWow64FsRedirection WriteFile VirtualProtect SetEndOfFile WriteConsoleW ReadConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc GetTimeZoneInformation SetFilePointerEx EnumSystemLocalesW SizeofResource GetCommandLineW GetCurrentDirectoryW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW HeapFree GetConsoleMode GetConsoleCP EnterCriticalSection LeaveCriticalSection InitializeCriticalSection MultiByteToWideChar FormatMessageW LocalFree WideCharToMultiByte DeviceIoControl GetSystemTimeAsFileTime QueryPerformanceCounter VirtualFree VirtualAlloc TerminateProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW GetExitCodeProcess Thread32Next Thread32First CreateActCtxW GetTempPathW UnmapViewOfFile GetTempFileNameW CreateFileMappingW ReleaseActCtx MapViewOfFile DuplicateHandle ResetEvent GetTickCount LoadLibraryW GetProcAddress FreeLibrary GetCurrentThread GetSystemInfo VirtualAllocEx VirtualFreeEx ActivateActCtx GetEnvironmentVariableW GetSystemDirectoryW DeactivateActCtx GetSystemWow64DirectoryW Module32FirstW ReadFile CreateNamedPipeW TerminateThread GetExitCodeThread OpenProcess IsWow64Process SuspendThread GetThreadTimes OpenThread WriteProcessMemory VirtualProtectEx GetThreadContext ReadProcessMemory CreateRemoteThread SetThreadContext VirtualQueryEx GetStringTypeW TryEnterCriticalSection WaitForSingleObjectEx SwitchToThread SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo SetEvent IsDebuggerPresent UnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead OutputDebugStringW CreateTimerQueue SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW GetVersionExW ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwind ExitThread GetModuleHandleExW GetStdHandle GetFileType HeapAlloc

user32

GetWindowTextW GetMenu CreateWindowExW DestroyIcon LoadIconW ChangeWindowMessageFilterEx EnableMenuItem wsprintfW GetMessageW CreateDialogParamW CallWindowProcW DestroyWindow MessageBoxW SendMessageW EndDialog SetWindowTextW LoadAcceleratorsW ShowWindow IsWindow DispatchMessageW IsDialogMessageW TranslateAcceleratorW TranslateMessage SendMessageA SetWindowLongW GetDlgItem DialogBoxParamW EnableWindow

comdlg32

GetOpenFileNameW GetSaveFileNameW

shell32

CommandLineToArgvW DragQueryFileW

ole32

CoUninitialize CoCreateInstance CoInitialize

advapi32

RegCreateKeyW RegOpenKeyExW RegEnumValueW LookupPrivilegeValueW AdjustTokenPrivileges OpenThreadToken RegOpenKeyW OpenProcessToken RegSetValueExW RegCloseKey ConvertStringSecurityDescriptorToSecurityDescriptorW RegQueryValueExW

??0Assembler@asmjit@@QAE@PAURuntime@1@@Z ??0CodeGen@asmjit@@QAE@PAURuntime@1@@Z ??0HostRuntime@asmjit@@QAE@XZ ??0JitRuntime@asmjit@@QAE@XZ ??0Runtime@asmjit@@QAE@XZ ??0StaticRuntime@asmjit@@QAE@PAXI@Z ??0VMemMgr@asmjit@@QAE@PAX@Z ??0X86Assembler@asmjit@@QAE@PAURuntime@1@I@Z ??0Zone@asmjit@@QAE@I@Z ??1Assembler@asmjit@@UAE@XZ ??1CodeGen@asmjit@@UAE@XZ ??1HostRuntime@asmjit@@UAE@XZ ??1JitRuntime@asmjit@@UAE@XZ ??1Runtime@asmjit@@UAE@XZ ??1StaticRuntime@asmjit@@UAE@XZ ??1VMemMgr@asmjit@@QAE@XZ ??1X86Assembler@asmjit@@UAE@XZ ??1Zone@asmjit@@QAE@XZ ??_FVMemMgr@asmjit@@QAEXXZ ?_alloc@Zone@asmjit@@QAEPAXI@Z ?_emit@X86Assembler@asmjit@@UAEIIABUOperand@2@000@Z ?_grow@Assembler@asmjit@@QAEII@Z ?_grow@PodVectorBase@asmjit@@IAEIII@Z ?_newLabel@Assembler@asmjit@@QAEIPAULabel@2@@Z ?_newLabelLink@Assembler@asmjit@@QAEPAULabelLink@2@XZ ?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B ?_registerIndexedLabels@Assembler@asmjit@@QAEII@Z ?_relocCode@X86Assembler@asmjit@@UBEIPAX_K@Z ?_reserve@Assembler@asmjit@@QAEII@Z ?_reserve@PodVectorBase@asmjit@@IAEIII@Z ?_x86CondToCmovcc@asmjit@@3QBIB ?_x86CondToJcc@asmjit@@3QBIB ?_x86CondToSetcc@asmjit@@3QBIB ?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B ?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B ?_x86ReverseCond@asmjit@@3QBIB ?add@JitRuntime@asmjit@@UAEIPAPAXPAUAssembler@2@@Z ?add@StaticRuntime@asmjit@@UAEIPAPAXPAUAssembler@2@@Z ?align@X86Assembler@asmjit@@UAEIII@Z ?alloc@VMemMgr@asmjit@@QAEPAXII@Z ?alloc@VMemUtil@asmjit@@SAPAXIPAII@Z ?allocProcessMemory@VMemUtil@asmjit@@SAPAXPAXIPAII@Z ?allocZeroed@Zone@asmjit@@QAEPAXI@Z ?bind@Assembler@asmjit@@UAEIABULabel@2@@Z ?callCpuId@X86CpuUtil@asmjit@@SAXIIPATX86CpuId@2@@Z ?detect@X86CpuUtil@asmjit@@SAXPAUX86CpuInfo@2@@Z ?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ ?dup@Zone@asmjit@@QAEPAXPBXI@Z ?embed@Assembler@asmjit@@UAEIPBXI@Z ?embedLabel@X86Assembler@asmjit@@QAEIABULabel@2@@Z ?emit@Assembler@asmjit@@QAEII@Z ?emit@Assembler@asmjit@@QAEIIABUOperand@2@00@Z ?emit@Assembler@asmjit@@QAEIIABUOperand@2@00H@Z ?emit@Assembler@asmjit@@QAEIIABUOperand@2@00_K@Z ?emit@Assembler@asmjit@@QAEIIABUOperand@2@0@Z ?emit@Assembler@asmjit@@QAEIIABUOperand@2@0H@Z ?emit@Assembler@asmjit@@QAEIIABUOperand@2@0_K@Z ?emit@Assembler@asmjit@@QAEIIABUOperand@2@@Z ?emit@Assembler@asmjit@@QAEIIABUOperand@2@H@Z ?emit@Assembler@asmjit@@QAEIIABUOperand@2@_K@Z ?emit@Assembler@asmjit@@QAEIIH@Z ?emit@Assembler@asmjit@@QAEII_K@Z ?flush@HostRuntime@asmjit@@UAEXPAXI@Z ?getCpuInfo@HostRuntime@asmjit@@UAEPBUCpuInfo@2@XZ ?getHost@CpuInfo@asmjit@@SAPBU12@XZ ?getPageGranularity@VMemUtil@asmjit@@SAIXZ ?getPageSize@VMemUtil@asmjit@@SAIXZ ?getStackAlignment@HostRuntime@asmjit@@UAEIXZ ?make@Assembler@asmjit@@UAEPAXXZ ?noOperand@asmjit@@3UOperand@1@B ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KABUX86Reg@2@IHI@Z ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z ?release@JitRuntime@asmjit@@UAEIPAX@Z ?release@StaticRuntime@asmjit@@UAEIPAX@Z ?release@VMemMgr@asmjit@@QAEIPAX@Z ?release@VMemUtil@asmjit@@SAIPAXI@Z ?releaseProcessMemory@VMemUtil@asmjit@@SAIPAX0I@Z ?relocCode@Assembler@asmjit@@QBEIPAX_K@Z ?reset@Assembler@asmjit@@QAEX_N@Z ?reset@PodVectorBase@asmjit@@QAEX_N@Z ?reset@VMemMgr@asmjit@@QAEXXZ ?reset@Zone@asmjit@@QAEX_N@Z ?sdup@Zone@asmjit@@QAEPADPBD@Z ?setArch@X86Assembler@asmjit@@QAEII@Z ?setError@CodeGen@asmjit@@QAEIIPBD@Z ?setErrorHandler@CodeGen@asmjit@@QAEIPAUErrorHandler@2@@Z ?sformat@Zone@asmjit@@QAAPADPBDZZ ?shrink@VMemMgr@asmjit@@QAEIPAXI@Z ?x86RegData@asmjit@@3UX86RegData@1@B