File name:

Xeno-v1.2.0.exe

Full analysis: https://app.any.run/tasks/b0a2e5aa-7a5e-4f60-bf9e-5b72265f80ae
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: May 27, 2025, 21:05:05
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
discord
exfiltration
stealer
evasion
mercurialgrabber
ims-api
generic
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

F2922994282FC351B563DFE8C88A312D

SHA1:

AD88F45A561A322D5750DAF082B154C465A29A43

SHA256:

9DB1D35895E0AC0CA9911E19F1C3C996681AFF6727C715D76F0BA01EA5B1C159

SSDEEP:

98304:ffLIQ/+utewfnT66M2EBMoImr00gFUPx0ZZ9XoxiH7WkeKTRoXl23e8RAxpoGSZz:hOhvglfRNXUHlsTGS4UworM4AA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • MERCURIALGRABBER has been detected (YARA)

      • Xeno.exe (PID: 7420)

    • Actions looks like stealing of personal data

      • Xeno.exe (PID: 7420)

    • Steals credentials from Web Browsers

      • Xeno.exe (PID: 7420)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • Xeno-v1.2.0.exe (PID: 2432)

    • Executable content was dropped or overwritten

      • Xeno-v1.2.0.exe (PID: 2432)

    • Reads security settings of Internet Explorer

      • Xeno-v1.2.0.exe (PID: 2432)

    • Starts CMD.EXE for commands execution

      • Xeno Server.exe (PID: 7328)

    • Executing commands from a ".bat" file

      • Xeno Server.exe (PID: 7328)

    • Read disk information to detect sandboxing environments

      • Xeno.exe (PID: 7420)

    • Reads the BIOS version

      • Xeno.exe (PID: 7420)

    • There is functionality for taking screenshot (YARA)

      • Xeno-v1.2.0.exe (PID: 2432)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • Xeno.exe (PID: 7420)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • Xeno.exe (PID: 7420)

    • The process connected to a server suspected of theft

      • Xeno.exe (PID: 7420)

  • INFO

    • Checks supported languages

      • Xeno-v1.2.0.exe (PID: 2432)
      • Xeno Server.exe (PID: 7328)
      • Xeno.exe (PID: 7420)

    • Reads the computer name

      • Xeno-v1.2.0.exe (PID: 2432)
      • Xeno.exe (PID: 7420)

    • Create files in a temporary directory

      • Xeno-v1.2.0.exe (PID: 2432)
      • Xeno Server.exe (PID: 7328)

    • The sample compiled with english language support

      • Xeno-v1.2.0.exe (PID: 2432)

    • Process checks computer location settings

      • Xeno-v1.2.0.exe (PID: 2432)

    • Reads the machine GUID from the registry

      • Xeno.exe (PID: 7420)

    • Reads Environment values

      • Xeno.exe (PID: 7420)

    • Disables trace logs

      • Xeno.exe (PID: 7420)

    • Checks proxy server information

      • Xeno.exe (PID: 7420)

    • Reads the software policy settings

      • Xeno.exe (PID: 7420)

    • Attempting to use instant messaging service

      • svchost.exe (PID: 2196)

    • Reads CPU info

      • Xeno.exe (PID: 7420)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:10:03 07:51:19+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.33
CodeSize: 214528
InitializedDataSize: 84992
UninitializedDataSize: -
EntryPoint: 0x21d50
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
9
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start xeno-v1.2.0.exe xeno server.exe no specs xeno server.exe conhost.exe no specs cmd.exe no specs #MERCURIALGRABBER xeno.exe conhost.exe no specs svchost.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2432"C:\Users\admin\AppData\Local\Temp\Xeno-v1.2.0.exe" C:\Users\admin\AppData\Local\Temp\Xeno-v1.2.0.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\xeno-v1.2.0.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
7280"C:\Users\admin\AppData\Local\Temp\RarSFX0\Xeno Server.exe" C:\Users\admin\AppData\Local\Temp\RarSFX0\Xeno Server.exe—Xeno-v1.2.0.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\xeno server.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7328"C:\Users\admin\AppData\Local\Temp\RarSFX0\Xeno Server.exe" C:\Users\admin\AppData\Local\Temp\RarSFX0\Xeno Server.exe
Xeno-v1.2.0.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\xeno server.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7336\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Xeno Server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7388"C:\WINDOWS\sysnative\cmd" /c "C:\Users\admin\AppData\Local\Temp\B632.tmp\B633.tmp\B634.bat "C:\Users\admin\AppData\Local\Temp\RarSFX0\Xeno Server.exe""C:\Windows\System32\cmd.exe—Xeno Server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
7420"C:\Users\admin\AppData\Local\Temp\RarSFX0\Xeno.exe" C:\Users\admin\AppData\Local\Temp\RarSFX0\Xeno.exe
Xeno-v1.2.0.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\xeno.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
7428\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Xeno.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
8080C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
1 508
Read events
1 494
Write events
14
Delete events
0

Modification events

(PID) Process:(7420) Xeno.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Xeno_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7420) Xeno.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Xeno_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7420) Xeno.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Xeno_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(7420) Xeno.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Xeno_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(7420) Xeno.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Xeno_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(7420) Xeno.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Xeno_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(7420) Xeno.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Xeno_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(7420) Xeno.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Xeno_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7420) Xeno.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Xeno_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7420) Xeno.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Xeno_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
13
Suspicious files
150
Text files
60
Unknown types
36

Dropped files

PID
Process
Filename
Type
2432Xeno-v1.2.0.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\XenoUI.deps.jsonbinary
MD5:346B83D0CB3A883F75A8CF621C10FF9E
SHA256:898FC2398F08DAF302145732FC4B21A55C92CC936606A1749D7B6B642BE76C01
2432Xeno-v1.2.0.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\Microsoft.Web.WebView2.Core.dllexecutable
MD5:B037CA44FD19B8EEDB6D5B9DE3E48469
SHA256:11E88B2CA921E5C88F64567F11BD83CBC396C10365D40972F3359FCC7965D197
2432Xeno-v1.2.0.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\Newtonsoft.Json.dllexecutable
MD5:ADF3E3EECDE20B7C9661E9C47106A14A
SHA256:22C649F75FCE5BE7C7CCDA8880473B634EF69ECF33F5D1AB8AD892CAF47D5A07
2432Xeno-v1.2.0.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\Xeno1.exeexecutable
MD5:E129E4AC488952AD9D026A17C1057CEB
SHA256:55658C038D3CD6916BFC64AC5D779DD28B95CCF2C532B3F98DB124CEE9D3F3DA
2432Xeno-v1.2.0.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\Xeno.exe.WebView2\EBWebView\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json —
MD5:—
SHA256:—
2432Xeno-v1.2.0.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\Xeno.exeexecutable
MD5:D614538DD0CDD4E80F891C3515FB5183
SHA256:5B8B04AB5E785C18DB6B54ED3FE429657AD4A01686A66E9AFF9521CB37CD2378
2432Xeno-v1.2.0.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\Xeno Server.exeexecutable
MD5:3661570B3B0C5ACEC3E1DCA8BE472C1A
SHA256:FE90249449C89F8320A27610B68D81170D2E70FFCF177A3242235836453B30B1
2432Xeno-v1.2.0.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\Xeno.dllexecutable
MD5:CBD44DB9D7FFD26E25E5D24DFD1D0004
SHA256:71EF304E429FE7D495F247FCB93BE2FE0D2785A1D089A97EE397486D3E2ABBFB
2432Xeno-v1.2.0.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\logs\2025-05-27_11-34-32.logtext
MD5:295C71A587B513018F356B2836A73513
SHA256:C2388740EF441C7E5497F883375A4E9A9E26A1D5EFBA2310A4D470C247E965F8
2432Xeno-v1.2.0.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\XenoUI.dllexecutable
MD5:E147AD5DAB049D525F26859E1547D23B
SHA256:64D44762C9CD6AB0460D2CBD911E8B44D0305A86E95BBFFF2B4A764FD629AFA0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
23
DNS requests
15
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7420
Xeno.exe
GET
200
208.95.112.1:80
http://ip-api.com//json/
unknown
—
—
whitelisted
7908
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7908
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1512
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
5796
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7420
Xeno.exe
23.128.64.141:443
ip4.seeip.org
JOESDATACENTER
US
suspicious
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.110
whitelisted
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 95.101.149.131
whitelisted
ip4.seeip.org
  • 23.128.64.141
unknown
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.160.3
  • 40.126.32.72
  • 20.190.160.131
  • 20.190.160.130
  • 20.190.160.128
  • 20.190.160.67
  • 20.190.160.5
  • 20.190.160.22
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
discord.com
  • 162.159.128.233
  • 162.159.137.232
  • 162.159.138.232
  • 162.159.135.232
  • 162.159.136.232
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
7420
Xeno.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
2196
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
7420
Xeno.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
7420
Xeno.exe
Misc activity
ET INFO Observed Discord Service Domain (discord .com) in TLS SNI
7420
Xeno.exe
Successful Credential Theft Detected
STEALER [ANY.RUN] Attempt to exfiltrate via Discord
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
2196
svchost.exe
Misc activity
ET INFO Discord Chat Service Domain in DNS Lookup (discord .com)
7420
Xeno.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
7420
Xeno.exe
Misc activity
ET INFO Observed Discord Service Domain (discord .com) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Xeno-v1.2.0.exe