xenoded[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
xenoded.exe
Size 80.0MB
Sample261110-s8a9cavxd1
SHA256 a7e9073f2d141ac9e40f6728a544776b766f51e8a4830cf54c086cb1abf87668
MD5 8361f6b69e38818bf01eb113f5c4906e
SHA1 c5870284cb9b2f7730145c40cf529fc76f4603e3
SHA512 a79bf67b228eca229575305450c4272f66cbca0c9682e510d2c31f0136b0e17d32b5b54a234c512ca1d048fa662922bb311479045325db84c136c47af3048aef
SSDEEP 196608:Pnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnng:I
TLSH
T1840801718A4B3A3BC65A1EBF8C44B79924A68E5D8DE4C0B41C39D17A7CB8DF19D34423
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
xenoded.exe

File Explorer

xenoded.exe

.exe 80.0MB

xenoded.exe

IMPHASH 04819e9149b2df904358e1b5156e5bd2
SHA256 a7e9073f2d141ac9e40f6728a544776b766f51e8a4830cf54c086cb1abf87668
MD5 8361f6b69e38818bf01eb113f5c4906e
SHA1 c5870284cb9b2f7730145c40cf529fc76f4603e3
SHA512 a79bf67b228eca229575305450c4272f66cbca0c9682e510d2c31f0136b0e17d32b5b54a234c512ca1d048fa662922bb311479045325db84c136c47af3048aef
SSDEEP 196608:Pnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnng:I
TLSH
T1840801718A4B3A3BC65A1EBF8C44B79924A68E5D8DE4C0B41C39D17A7CB8DF19D34423
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

46064

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Alex\source\repos\cryptor\x64\Release\cryptor.pdb

bcrypt

BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptDecrypt BCryptHashData BCryptDestroyKey BCryptCreateHash BCryptSetProperty BCryptFinishHash BCryptDestroyHash BCryptOpenAlgorithmProvider

user32

MessageBoxA wsprintfA

advapi32

RegOpenKeyExW RegDeleteValueW RegQueryValueExA RegOpenKeyExA RegCloseKey GetUserNameW RegSetValueExW

shell32

SHGetFolderPathW

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

kernel32

QueryPerformanceCounter CreateFileMappingA GetCurrentProcessId MapViewOfFile GetCurrentThread FreeLibrary GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW UnmapViewOfFile DeleteFileW CreateThread WaitForSingleObject CopyFileW WideCharToMultiByte CheckRemoteDebuggerPresent Sleep GetCurrentProcess GlobalMemoryStatusEx GetSystemInfo GetTickCount GetTickCount64 GetFileAttributesW GetTempPathW HeapCreate HeapDestroy HeapAlloc HeapFree GetModuleHandleA GetProcAddress CreateFileA WriteFile CloseHandle GetProcessHeap ExitProcess GetModuleFileNameW DeleteFileA GetLastError TerminateProcess ResumeThread CreateProcessW GetThreadContext SetThreadContext VirtualAlloc VirtualProtect VirtualFree VirtualAllocEx ReadProcessMemory WriteProcessMemory LoadLibraryA SwitchToFiber DeleteFiber CreateFiber ConvertThreadToFiber EnumSystemLocalesA AddVectoredExceptionHandler RemoveVectoredExceptionHandler GetVolumeInformationW GetWindowsDirectoryA GetComputerNameA GetComputerNameW GetSystemDirectoryA

vcruntime140

__current_exception __current_exception_context memset __C_specific_handler _CxxThrowException __std_exception_destroy wcsstr __std_exception_copy memmove memcpy __std_type_info_destroy_list

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strlen towlower strncmp wcslen

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc _callnewh free

api-ms-win-crt-runtime-l1-1-0

_cexit terminate _crt_at_quick_exit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _seh_filter_dll _seh_filter_exe _set_app_type _register_thread_local_exe_atexit_callback _configure_narrow_argv _initialize_narrow_environment _get_narrow_winmain_command_line _initterm _initterm_e exit _exit _c_exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

672B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xthrx

Size

517KB

Virtual Size

517KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

688B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

xenoded.exe

bcrypt

user32

advapi32

shell32

msvcp140

kernel32

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic