File name:

XenoB.exe

Full analysis: https://app.any.run/tasks/e1c4814b-d42b-4a8f-9010-e02fb3270525
Verdict: Malicious activity
Analysis date: October 31, 2024, 03:18:13
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
autoit-loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

B402BFD3FA2839D6FA39DB9289E50B1F

SHA1:

7A0B6DB87F50F9D9E36F26C251EBDDFC801867C3

SHA256:

581BD8F81B378DA3ABD062DFB478C1F86C9A7C89AD58044EE407E5C7BC61D22D

SSDEEP:

49152:qF6jz13hgxcZmI7S0NKBP5mEr7NGS+mBOkTnIVj58sSgS+d6A566eUtosy70A5Bz:qiZ3hgc9SjtR3nYCB+dvU6pchgb7aXos

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AutoIt loader has been detected (YARA)

      • Safely.pif (PID: 3028)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • XenoB.exe (PID: 3008)

    • Executing commands from a ".bat" file

      • XenoB.exe (PID: 3008)

    • Starts CMD.EXE for commands execution

      • XenoB.exe (PID: 3008)
      • cmd.exe (PID: 5172)

    • Get information on the list of running processes

      • cmd.exe (PID: 5172)

    • Application launched itself

      • cmd.exe (PID: 5172)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 5172)

    • Executable content was dropped or overwritten

      • cmd.exe (PID: 5172)

    • Drops a file with a rarely used extension (PIF)

      • cmd.exe (PID: 5172)

    • The executable file from the user directory is run by the CMD process

      • Safely.pif (PID: 3028)

    • Starts application with an unusual extension

      • cmd.exe (PID: 5172)

  • INFO

    • Create files in a temporary directory

      • XenoB.exe (PID: 3008)

    • Reads the computer name

      • XenoB.exe (PID: 3008)
      • Safely.pif (PID: 3028)

    • Checks supported languages

      • XenoB.exe (PID: 3008)
      • Safely.pif (PID: 3028)

    • Process checks computer location settings

      • XenoB.exe (PID: 3008)

    • The process uses the downloaded file

      • XenoB.exe (PID: 3008)

    • Creates a new folder

      • cmd.exe (PID: 6260)

    • Reads mouse settings

      • Safely.pif (PID: 3028)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:02:24 19:19:54+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 28160
InitializedDataSize: 464384
UninitializedDataSize: 16896
EntryPoint: 0x3883
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 0.752.5.1906
ProductVersionNumber: 0.752.5.1906
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
LegalTrademarks: SecureKey is a trademark of GuardKey Solutions
ProductName: SecureKey
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
14
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start xenob.exe no specs cmd.exe conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs THREAT safely.pif choice.exe no specs sppextcomobj.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
204findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
612\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1500findstr /V "EroticDisciplinaryBareGuestbook" Intersection C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3008"C:\Users\admin\AppData\Local\Temp\XenoB.exe" C:\Users\admin\AppData\Local\Temp\XenoB.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\xenob.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3028Safely.pif q C:\Users\admin\AppData\Local\Temp\614707\Safely.pif
cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
0
Version:
3, 3, 14, 3
Modules
Images
c:\users\admin\appdata\local\temp\614707\safely.pif
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
5100findstr /I "wrsa opssvc" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5172"C:\Windows\System32\cmd.exe" /c copy Arrives Arrives.bat & Arrives.batC:\Windows\SysWOW64\cmd.exe
XenoB.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5332choice /d y /t 5C:\Windows\SysWOW64\choice.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Offers the user a choice
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\choice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5512tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6260cmd /c md 614707C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
1 218
Read events
1 218
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
11
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
3008XenoB.exeC:\Users\admin\AppData\Local\Temp\Miscbinary
MD5:F4B00F95F28A8E2595510B58F2564FE1
SHA256:157A236AF8B775C320F826EB603FB23E3CDD9F8DBD122C5834D3573431862D73
3008XenoB.exeC:\Users\admin\AppData\Local\Temp\Frontpagebinary
MD5:0F3E08666DF906AC1BD4DE8C3D6ABC88
SHA256:2BD8CC622B121BAAF05D28FBE3DEE5AC5650BB5AC9478C11BD82721AEB574AEC
3008XenoB.exeC:\Users\admin\AppData\Local\Temp\Activitybinary
MD5:47C30E1F9A4CC4B915EAE63A64FA2A29
SHA256:6E8A93D6B6F0B30280F87D68F19F18B25A4FF8EBC00D5CB9B2C5C7BEBF8B1FB2
3008XenoB.exeC:\Users\admin\AppData\Local\Temp\Arrivestext
MD5:7112A422B8B53F88629024C07546B95F
SHA256:B296485792B7703E845DA3B19F28E440AE916265C20983F9B718FB8314C91BED
5172cmd.exeC:\Users\admin\AppData\Local\Temp\Arrives.battext
MD5:7112A422B8B53F88629024C07546B95F
SHA256:B296485792B7703E845DA3B19F28E440AE916265C20983F9B718FB8314C91BED
5172cmd.exeC:\Users\admin\AppData\Local\Temp\614707\Safely.pifexecutable
MD5:48367F4B86F3EF6223AC038CE171486B
SHA256:1AD8B5CDDC8744EDD42542DDE0065D248ACB4730B09D3928A123FDB6612CE72E
3008XenoB.exeC:\Users\admin\AppData\Local\Temp\Sincebinary
MD5:08C3C12E234A09D75D56FB9C1E098324
SHA256:FE87ADB333D08FBD215A456796B9B1CEA5E04CE3ACA59EEEB8F37C09ADEDE676
6800cmd.exeC:\Users\admin\AppData\Local\Temp\614707\qbinary
MD5:C5D56DB0482A246E38AE5AC4BCA5536E
SHA256:154A9EF1E8B92D07D5E71992C297C2AA3B8E3FCB44D88CD91C41E04C8B357354
3008XenoB.exeC:\Users\admin\AppData\Local\Temp\Intersectionbinary
MD5:C7534FA4CD9A8C38EE19B2912352B81B
SHA256:2CCBA820F621897E865E4E9E2BA94B780DBF41751BC6C6BE4F44EB6EC749F17E
3008XenoB.exeC:\Users\admin\AppData\Local\Temp\Tightbinary
MD5:863E72A13B9576ED8527FDC980E60DC1
SHA256:24621D874F4BC7487B59A5E6BF0D98DBD68777D0438D50D795F6B0C6431F83C0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
50
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6264
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
7140
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7140
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2776
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5488
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4360
SearchApp.exe
104.126.37.123:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2776
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
www.bing.com
  • 104.126.37.123
  • 104.126.37.130
  • 104.126.37.171
  • 104.126.37.178
  • 104.126.37.144
  • 104.126.37.136
  • 104.126.37.170
  • 104.126.37.137
  • 104.126.37.186
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
google.com
  • 142.250.184.238
whitelisted
UHDXbqxoqSqhH.UHDXbqxoqSqhH
  • —
unknown
login.live.com
  • 40.126.32.133
  • 40.126.32.134
  • 40.126.32.138
  • 40.126.32.68
  • 20.190.160.14
  • 40.126.32.76
  • 40.126.32.140
  • 20.190.160.22
whitelisted
th.bing.com
  • 104.126.37.170
  • 104.126.37.144
  • 104.126.37.130
  • 104.126.37.162
  • 104.126.37.153
  • 104.126.37.154
  • 104.126.37.185
  • 104.126.37.139
  • 104.126.37.171
whitelisted
go.microsoft.com
  • 184.30.17.189
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
XenoB.exe