Analysis
- max time kernel
150s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 16:21
Behavioral task
behavioral1
Sample
Xeno.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Xeno.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
Xeno.pyc
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
Xeno.pyc
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
General
- Target Xeno.exe
- Size 7.9MB
- Sample260801-tt1fcsdd68
- SHA256 69f7bf05245b427c380f533e4b3c8aa71f3a8be33c625f37b589f81140989325
- MD5 7c155abddcbd666ff9dc415a8331c5e4
- SHA1 07a830e38b7b56843fabdc4e40d2f3372e0bd497
- SHA512 9dd3fd13fe1343d65790d0a878d1662b7be657bc7bbf81d370c917b3742042bcec18146384a719651d8ec67e088bdbfa3d55e15392073adff08f3d4f3bbe323c
- SSDEEP 196608:jYf6NTwhLeHNUICEbvc+Hc/IDtT9OiQk0ax8+JttmHh:jSLcXCMc+8ADtAiAaxHtsh
- TLSH T13D863348938019F9F6F392398AA3D429D572741717708AEB13A147DB1E137F42EBEB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 5 IoCs
pid Process 696 Xeno.exe 696 Xeno.exe 696 Xeno.exe 696 Xeno.exe 696 Xeno.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3216 wrote to memory of 696 3216 Xeno.exe 89
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32162\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32162\_bz2.pyd
- Size 84KB
- SHA256 1bf985b54f529a3cbb3e52532791cc4d4c64009142d37b54eb3521adec203d5c
- MD5 0a18953eb45266704171cbe54c6dd261
- SHA1 15f7edd8d0ac559d912d64503fd68f1a8d4c58f7
- SHA512 e5f1bef48695b4fae556113a2ccc6ed1e1cf49fa319b94f052705e809eba2543db16fcf955ac9c01de4d81746c90abc85d717004b6b3b1071b27696c6838068b
- SSDEEP 1536:QVF5z780RCmmgKRF2OXvLJnmEmdBv8ZEs8iEEx0ZIILVfy7NsR9QfIbHbvTcE:yF5zIjmNAAOfLKdB0ZXjxx0ZIILVdTl
- TLSH T194838E47B76461F6F9AF81B496910353F730BE960710A3AFB24482953F13B91EE6831A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32162\_lzma.pyd
- Size 155KB
- SHA256 51815b6474d4216c6a2aeaffdae5d2ff4acb7a0236254f2cfe43247022f3d781
- MD5 8aab96a90295cac7b047fc706a118823
- SHA1 e9ce0ae765d65ba9c4d7d3f9cbf61622f5633ca2
- SHA512 2a10aeb5783bd1d99dea0200f577bdeb95f36dc328063fb8d3a54fb70e7ac74251f03d424f2ba4fcdd5359f92d6b9106a124403bde6dd154bebfc5c7b7fbf6f7
- SSDEEP 3072:mK1fxbqH1ZTffdFj+JnTqznfB9mNohPRHdZII01dkTB:m6Jbq7vsnTc5YOXHdwIB
- TLSH T1DCF34B86B794F0E5F3728C38D6624F57E6F5791A0320929E01CC936D2B1FB659A2E313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32162\base_library.zip
- Size 1.3MB
- SHA256 2bddc0683b50b6604e0d029de6035f3bb94b34ef7a853081ce67bb41c86cc3dc
- MD5 048450b962fb58fac64b99c9302e8d18
- SHA1 05550a1777050fefc2e2c0088b44ee5496da21b6
- SHA512 cda4387196d317680f29b53c2ce92f70fb2e08057e836a00a7b557ba6c4dd20a0cd7b12752620dda102dde26ef5c078514d8f3fc4dd67ca50ca54444fcd1f792
- SSDEEP 12288:TW7WpPtYzGN8TxOjEAYFUDqfBuIva80201jwCVRDVoioSYBt5ji2cPPdxhYSF++N:a7WpCSuTxOjolbj5cPPdxhYSbdZtz
- TLSH T1E0551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32162\python313.dll
- Size 5.8MB
- SHA256 6964e590037c41d631fd1215f05af154f7fa68105993c6f573a20689b473f1ac
- MD5 5a7cbaa796ee41e35b5e6bdf4e024e48
- SHA1 868b787184e90a277f065d7d0b830772bdd6e52f
- SHA512 69dded87aee32562f57c50c5b1a3f99c7f64089226d911751cae314bc451bbd2d3e4a9c9410a532f4fefffcc4687d7c26e609d5aea13b077aefd1070151d5f6f
- SSDEEP 98304:aE6YlbgK3Lv6PVN1Wgz52Wv3HDMiE9o1w:aE6M3j6PV/Git1w
- TLSH T1FB568C16729E51ACC97B8078CA13864BFBB27C053F60434B61E6BB5E2F73362466E705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI32162\ucrtbase.dll
- Size 1.3MB
- SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
- MD5 286b308df8012a5dfc4276fb16dd9ccc
- SHA1 8ae9df813b281c2bd7a81de1e4e9cef8934a9120
- SHA512 24166cc1477cde129a9ab5b71075a6d935eb6eebcae9b39c0a106c5394ded31af3d93f6dea147120243f7790d0a0c625a690fd76177dddab2d2685105c3eb7b2
- SSDEEP 24576:cQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPng:cQWhXCFm7Cw3w3ZXX6DYaY9lpUg
- TLSH T1BE55AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
- MD5 SHA1 SHA512 SSDEEP TLSH