Xeno Temp[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Xeno Temp.exe
Size 3.3MB
Sample260806-v7vmpsbc87
SHA256 29203fe6911ada775d26b83ff809c9dcd06b4e12f82d4137f58a9f5829b86b47
MD5 0faeaef38a2e9ba7d33d44c64a32da99
SHA1 ead7aaaf199c84882a9cd4bb471403cb88bdd9da
SHA512 371165bbca13e58347e1bccb3f77d14b29e144019adfc9c1b104f8ffa8134d399f498dc30afa91051efb26467bb470b433c64c1c7ed4acf22f53ed76ae9596bb
SSDEEP 49152:e3XGf5KhIpZNEbgTMpIn8Zr2YxODvDubcaJ60sonp1KZadh0pOJ:e3XGf5KyoGO2YxODvDubcaJ60sy
TLSH
T114F57C0765D84468D33DD474C659D6A3D739BC288368D9FF639478A80E331E32AFA782
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Xeno Temp.exe

File Explorer

Xeno Temp.exe

.exe 3.3MB

Xeno Temp.exe

IMPHASH 29777512a14a36617f7ee3d2e944c4a1
SHA256 29203fe6911ada775d26b83ff809c9dcd06b4e12f82d4137f58a9f5829b86b47
MD5 0faeaef38a2e9ba7d33d44c64a32da99
SHA1 ead7aaaf199c84882a9cd4bb471403cb88bdd9da
SHA512 371165bbca13e58347e1bccb3f77d14b29e144019adfc9c1b104f8ffa8134d399f498dc30afa91051efb26467bb470b433c64c1c7ed4acf22f53ed76ae9596bb
SSDEEP 49152:e3XGf5KhIpZNEbgTMpIn8Zr2YxODvDubcaJ60sonp1KZadh0pOJ:e3XGf5KyoGO2YxODvDubcaJ60sy
TLSH
T114F57C0765D84468D33DD474C659D6A3D739BC288368D9FF639478A80E331E32AFA782
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1998112

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Xenoi\Desktop\Loader for Developer\Loader for Developer\examples\example_win32_directx11\Release\emulated.wtf.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

FindClose CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx FormatMessageA VerifyVersionInfoW PeekNamedPipe GetFileType GetStdHandle GetEnvironmentVariableA WaitForSingleObjectEx MoveFileExW SleepEx LoadLibraryW GetSystemDirectoryW LocalFree LeaveCriticalSection InitializeCriticalSection AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileAttributesExW SetFileInformationByHandle CreateFile2 AreFileApisANSI GetFileInformationByHandleEx SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable SetUnhandledExceptionFilter GetExitCodeProcess GetComputerNameA GetTickCount GetTempFileNameA CreateDirectoryA GetDiskFreeSpaceExA CreateProcessA QueryFullProcessImageNameW SetThreadExecutionState GlobalMemoryStatusEx GetCurrentProcessId ExitProcess RemoveDirectoryA RaiseException DeleteFileW DeleteFileA GetCurrentThread CreateFileA FormatMessageW SetLastError GetModuleHandleW GetModuleFileNameW GetModuleFileNameA UnmapViewOfFile MapViewOfFile CreateFileMappingW CreateThread DeleteCriticalSection InitializeCriticalSectionEx HeapSize HeapReAlloc HeapDestroy AddVectoredExceptionHandler InitializeSListHead IsDebuggerPresent OutputDebugStringW GetLastError GetTempPathA Sleep OpenProcess OpenEventW DebugActiveProcessStop GetFileAttributesW CreateFileW GetTempPathW CreatePipe SetThreadPriority WaitForMultipleObjects TerminateProcess VirtualAlloc WriteFile GetCurrentProcess VirtualProtect SetHandleInformation GetFileSizeEx ReadFile CreateProcessW GetProcessHeap HeapAlloc CloseHandle WaitForSingleObject HeapFree QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GetSystemTimeAsFileTime FindFirstFileW GetSystemInfo GlobalAlloc MultiByteToWideChar GetStartupInfoW EnterCriticalSection

user32

GetWindowTextA PeekMessageW SetWindowLongA DispatchMessageW ShowWindow GetActiveWindow RegisterClassExW GetClassNameA UnregisterClassW GetSystemMetrics CreateWindowExW BlockInput GetWindowRect DefWindowProcW GetWindowThreadProcessId GetWindowLongW LoadCursorW SetLayeredWindowAttributes TranslateMessage MoveWindow SetCursor ScreenToClient GetCapture DestroyWindow EnumWindows IsWindowUnicode ReleaseCapture SetCursorPos ReleaseDC GetCursorPos OpenClipboard CloseClipboard EmptyClipboard LoadIconW SendMessageA SetClipboardData GetForegroundWindow GetClipboardData PostQuitMessage TrackMouseEvent ClientToScreen UpdateWindow MessageBoxA GetKeyState GetDC GetClientRect SetCapture

gdi32

GetDIBits SelectObject CreateCompatibleBitmap BitBlt CreateCompatibleDC DeleteDC DeleteObject

advapi32

OpenServiceW RegEnumKeyExA RegOpenKeyExA RegSetValueExA AllocateAndInitializeSid InitializeAcl InitializeSecurityDescriptor FreeSid CryptDestroyHash AddAccessDeniedAce RegSetValueExW SetSecurityDescriptorSacl CryptHashData CryptCreateHash RegCreateKeyExW GetUserNameA GetSidLengthRequired OpenSCManagerW CloseServiceHandle QueryServiceStatus RegQueryValueExA CryptEncrypt CryptImportKey RegCloseKey CryptReleaseContext RegQueryValueExW AddAccessAllowedAce CryptGetHashParam GetLengthSid SetKernelObjectSecurity RegOpenKeyExW CryptDestroyKey SystemFunction036 ConvertSidToStringSidA CopySid SetSecurityInfo RegDeleteKeyA RegCreateKeyExA IsValidSid GetTokenInformation OpenProcessToken CryptAcquireContextW SetSecurityDescriptorDacl

shell32

ShellExecuteA ShellExecuteExA

ole32

CoUninitialize CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoCreateInstance

oleaut32

VariantClear SysFreeString SysAllocString

discord_game_sdk

DiscordCreate

msvcp140

_Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Random_device@std@@YAIXZ ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Xinvalid_argument@std@@YAXPEBD@Z _Xtime_get_ticks ??Bid@locale@std@@QEAA_KXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?good@ios_base@std@@QEBA_NXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?uncaught_exception@std@@YA_NXZ ?_Xlength_error@std@@YAXPEBD@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

iphlpapi

GetAdaptersInfo

setupapi

SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList SetupDiGetDeviceInterfaceDetailW SetupDiGetDeviceInstanceIdW SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW

winhttp

WinHttpReadData WinHttpQueryHeaders WinHttpCloseHandle WinHttpOpenRequest WinHttpOpen WinHttpReceiveResponse WinHttpSendRequest WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpConnect WinHttpAddRequestHeaders

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertFindExtension

wininet

InternetOpenA HttpOpenRequestA HttpSendRequestA InternetConnectA InternetReadFile InternetCloseHandle InternetOpenUrlA

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

urlmon

URLDownloadToFileA

ws2_32

WSAIoctl setsockopt recv htons getsockname getpeername gethostname ioctlsocket sendto connect __WSAFDIsSet recvfrom freeaddrinfo bind getaddrinfo WSACleanup WSAStartup inet_ntop listen htonl accept WSASetLastError socket ntohs inet_pton select WSAGetLastError closesocket getsockopt WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents

shlwapi

PathFindFileNameW

psapi

GetModuleInformation

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset strchr wcschr __current_exception __current_exception_context _CxxThrowException memmove strrchr __C_specific_handler strstr __std_terminate __std_exception_copy __std_exception_destroy memcmp memcpy memchr

api-ms-win-crt-stdio-l1-1-0

ftell fclose __acrt_iob_func __stdio_common_vsscanf _close _fileno _write _read __stdio_common_vsprintf __p__commode _set_fmode _wfopen _lseeki64 fputc fwrite fflush _wopen __stdio_common_vfprintf fgetc fgetpos feof fputs setvbuf ungetc fread fsetpos fseek _popen _pclose fgets _fseeki64 _get_stream_buffer_pointers

api-ms-win-crt-utility-l1-1-0

rand srand qsort

api-ms-win-crt-heap-l1-1-0

realloc calloc free _set_new_mode malloc _callnewh

api-ms-win-crt-runtime-l1-1-0

_c_exit _exit terminate _initterm_e _register_thread_local_exe_atexit_callback _errno _initterm _get_narrow_winmain_command_line _set_app_type _beginthreadex _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv system __sys_errlist __sys_nerr exit abort _invalid_parameter_noinfo _wassert _invalid_parameter_noinfo_noreturn _resetstkoflw

api-ms-win-crt-convert-l1-1-0

strtoul strtoll strtoull atoi wcstombs_s wcstombs strtol strtod

api-ms-win-crt-string-l1-1-0

_wcsdup wcslen strcspn strncmp wcspbrk strspn wcscpy_s strcmp strncpy_s wcsncmp strpbrk wcsncpy _strdup toupper tolower strncpy strlen

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64 _localtime64 strftime _difftime64

api-ms-win-crt-math-l1-1-0

sqrtf __setusermatherr ceilf cosf powf fmodf _fdopen _dsign sinf acosf

api-ms-win-crt-filesystem-l1-1-0

_unlink _lock_file _unlock_file _fstat64 _wstat64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func localeconv

api-ms-win-crt-environment-l1-1-0

getenv