addf1e5903c21c0af873a45c7fc79f4d4eb2487c970a19ea96f51418431601a2

Analysis

user interaction
yes
max time kernel
10s
max time network
14s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 13:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xenos/Xenos64.exe
Size 1.2MB
Sample260804-qljk4axyas
SHA256 addf1e5903c21c0af873a45c7fc79f4d4eb2487c970a19ea96f51418431601a2
MD5 bdeee5ec578fff586ed7b492ecd8849f
SHA1 0445186897091a49458819d447fe92e457f088c6
SHA512 dd898414b6ac27a58464c23511eb7e0cb7d411356b8f6ed26fddbbde9c628f92cc4e104f7fb1b6116631006893ffe37249e19b191d4c14cf801c2bc75fcaa497
SSDEEP 24576:A+W3P+Wi1+WGHy8/8gdHn9mGIfBTcVmYWys18ES9DsKRzoome/sBiBJeBIi:A+W3P+Wi1+WGHDfH9mZddbP1fSZzZ1g
TLSH
T165457C5A7BA841F4D0B7913A8AA69156E7F2BC461B3187EF02A4531E7F33AE04D3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

persistence

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BlackBone\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Xenos\\BlackBoneDrv10.sys"	Xenos64.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\shell\Edit\command	Xenos64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\shell\Edit	Xenos64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\shell\Run	Xenos64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xpr64	Xenos64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xpr64\ = "XenosProfile64"	Xenos64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xpr64\Content Type = "Application/xml"	Xenos64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64	Xenos64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\shell\ = "Run"	Xenos64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\shell\Run\command	Xenos64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Xenos\\Xenos64.exe,-135"	Xenos64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\DefaultIcon	Xenos64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\shell\Edit\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Xenos\\Xenos64.exe --load %1"	Xenos64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\shell\Run\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Xenos\\Xenos64.exe --run %1"	Xenos64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\ = "Xenos 64-bit injection profile"	Xenos64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\shell	Xenos64.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1276	Xenos64.exe
1276	Xenos64.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
1276	Xenos64.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1276	Xenos64.exe
Token: SeLoadDriverPrivilege	1276	Xenos64.exe

C:\Users\Admin\AppData\Local\Temp\Xenos\Xenos64.exe
"C:\Users\Admin\AppData\Local\Temp\Xenos\Xenos64.exe"
1⤵
- Sets service image path in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:1276