File name:

Xeno-v1.2.0.exe

Full analysis: https://app.any.run/tasks/b0a2e5aa-7a5e-4f60-bf9e-5b72265f80ae
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: May 27, 2025, 21:05:05
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
discord
exfiltration
stealer
evasion
mercurialgrabber
ims-api
generic
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

F2922994282FC351B563DFE8C88A312D

SHA1:

AD88F45A561A322D5750DAF082B154C465A29A43

SHA256:

9DB1D35895E0AC0CA9911E19F1C3C996681AFF6727C715D76F0BA01EA5B1C159

SSDEEP:

98304:ffLIQ/+utewfnT66M2EBMoImr00gFUPx0ZZ9XoxiH7WkeKTRoXl23e8RAxpoGSZz:hOhvglfRNXUHlsTGS4UworM4AA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • MERCURIALGRABBER has been detected (YARA)

      • Xeno.exe (PID: 7420)

    • Steals credentials from Web Browsers

      • Xeno.exe (PID: 7420)

    • Actions looks like stealing of personal data

      • Xeno.exe (PID: 7420)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Xeno-v1.2.0.exe (PID: 2432)

    • Process drops legitimate windows executable

      • Xeno-v1.2.0.exe (PID: 2432)

    • Executing commands from a ".bat" file

      • Xeno Server.exe (PID: 7328)

    • Starts CMD.EXE for commands execution

      • Xeno Server.exe (PID: 7328)

    • Read disk information to detect sandboxing environments

      • Xeno.exe (PID: 7420)

    • Reads security settings of Internet Explorer

      • Xeno-v1.2.0.exe (PID: 2432)

    • Reads the BIOS version

      • Xeno.exe (PID: 7420)

    • There is functionality for taking screenshot (YARA)

      • Xeno-v1.2.0.exe (PID: 2432)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • Xeno.exe (PID: 7420)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • Xeno.exe (PID: 7420)

    • The process connected to a server suspected of theft

      • Xeno.exe (PID: 7420)

  • INFO

    • Checks supported languages

      • Xeno-v1.2.0.exe (PID: 2432)
      • Xeno Server.exe (PID: 7328)
      • Xeno.exe (PID: 7420)

    • The sample compiled with english language support

      • Xeno-v1.2.0.exe (PID: 2432)

    • Create files in a temporary directory

      • Xeno-v1.2.0.exe (PID: 2432)
      • Xeno Server.exe (PID: 7328)

    • Process checks computer location settings

      • Xeno-v1.2.0.exe (PID: 2432)

    • Reads the computer name

      • Xeno-v1.2.0.exe (PID: 2432)
      • Xeno.exe (PID: 7420)

    • Reads the machine GUID from the registry

      • Xeno.exe (PID: 7420)

    • Reads Environment values

      • Xeno.exe (PID: 7420)

    • Disables trace logs

      • Xeno.exe (PID: 7420)

    • Checks proxy server information

      • Xeno.exe (PID: 7420)

    • Reads the software policy settings

      • Xeno.exe (PID: 7420)

    • Attempting to use instant messaging service

      • svchost.exe (PID: 2196)

    • Reads CPU info

      • Xeno.exe (PID: 7420)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:10:03 07:51:19+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.33
CodeSize: 214528
InitializedDataSize: 84992
UninitializedDataSize: -
EntryPoint: 0x21d50
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
9
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start xeno-v1.2.0.exe xeno server.exe no specs xeno server.exe conhost.exe no specs cmd.exe no specs #MERCURIALGRABBER xeno.exe conhost.exe no specs svchost.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2432"C:\Users\admin\AppData\Local\Temp\Xeno-v1.2.0.exe" C:\Users\admin\AppData\Local\Temp\Xeno-v1.2.0.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\xeno-v1.2.0.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
7280"C:\Users\admin\AppData\Local\Temp\RarSFX0\Xeno Server.exe" C:\Users\admin\AppData\Local\Temp\RarSFX0\Xeno Server.exe—Xeno-v1.2.0.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\xeno server.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7328"C:\Users\admin\AppData\Local\Temp\RarSFX0\Xeno Server.exe" C:\Users\admin\AppData\Local\Temp\RarSFX0\Xeno Server.exe
Xeno-v1.2.0.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\xeno server.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7336\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Xeno Server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7388"C:\WINDOWS\sysnative\cmd" /c "C:\Users\admin\AppData\Local\Temp\B632.tmp\B633.tmp\B634.bat "C:\Users\admin\AppData\Local\Temp\RarSFX0\Xeno Server.exe""C:\Windows\System32\cmd.exe—Xeno Server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
7420"C:\Users\admin\AppData\Local\Temp\RarSFX0\Xeno.exe" C:\Users\admin\AppData\Local\Temp\RarSFX0\Xeno.exe
Xeno-v1.2.0.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\xeno.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
7428\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Xeno.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
8080C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
1 508
Read events
1 494
Write events
14
Delete events
0

Modification events

(PID) Process:(7420) Xeno.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Xeno_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7420) Xeno.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Xeno_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7420) Xeno.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Xeno_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(7420) Xeno.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Xeno_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(7420) Xeno.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Xeno_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(7420) Xeno.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Xeno_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(7420) Xeno.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Xeno_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(7420) Xeno.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Xeno_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7420) Xeno.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Xeno_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7420) Xeno.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Xeno_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
13
Suspicious files
150
Text files
60
Unknown types
36

Dropped files

PID
Process
Filename
Type
2432Xeno-v1.2.0.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\Microsoft.Web.WebView2.Wpf.dllexecutable
MD5:4A292C5C2ABF1AAB91DEE8EECAFE0AB6
SHA256:B628D6133BF57B7482A49AA158E45B078DF73EE7D33137AC1336D24AC67ED1B4
2432Xeno-v1.2.0.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\Microsoft.Web.WebView2.WinForms.dllexecutable
MD5:8153423918C8CBF54B44ACEC01F1D6C2
SHA256:5696366F7458DA940CC986DC5D3D4549A2368512ACD769014ECBB07B47BD88B4
2432Xeno-v1.2.0.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\Microsoft.Web.WebView2.Core.dllexecutable
MD5:B037CA44FD19B8EEDB6D5B9DE3E48469
SHA256:11E88B2CA921E5C88F64567F11BD83CBC396C10365D40972F3359FCC7965D197
2432Xeno-v1.2.0.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\scripts\Dex.luatext
MD5:C4FFC39F489BBE800F3B38616573C2E9
SHA256:3C5799C897B2DE6E7077F3D3F533AEC772BE23B028E8A1D9DE2545764FE2CBBA
2432Xeno-v1.2.0.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\Xeno.exe.WebView2\EBWebView\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json —
MD5:—
SHA256:—
2432Xeno-v1.2.0.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\scripts\UNCCheckEnv.luabinary
MD5:B76726D10354343D9AF5C268E40B47C4
SHA256:E8D53406C916B8E827C65C8F00D8A18B1379E693FD0379E8116E749BDF860CF5
2432Xeno-v1.2.0.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\scripts\Sine Wave.luabinary
MD5:0BBB2AEBFADC119226992045DCAA30B4
SHA256:A5F5ACA3AC216AC9040D0425EB52B1465674D8CD79D928474562D9A644FF4F0B
2432Xeno-v1.2.0.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\workspace\AtreusHub_key.txttext
MD5:6F0D755161B6B72D24DFA044F6AFB363
SHA256:53271FC8E796299CA0A9D797F1EB7E3D0DD5E325F882A33FBEA43568AD01B050
2432Xeno-v1.2.0.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\XenoUI.runtimeconfig.jsonbinary
MD5:E0F6F18F9B152BC2D8C710B0214805D6
SHA256:89AD1EA5C9C20B6B266547EF27C0AE3840CAB5642D3C2AEDF06B7026245671DD
2432Xeno-v1.2.0.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\scripts\Infinite Yield.luatext
MD5:E0246B17DDF86C45719E881D09987D64
SHA256:0D4C6CA6F3D473C9FE81F3952DDD76796B5CC8DEF107219A5B6DD9DE4618744C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
23
DNS requests
15
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7420
Xeno.exe
GET
200
208.95.112.1:80
http://ip-api.com//json/
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7908
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7908
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1512
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
5796
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7420
Xeno.exe
23.128.64.141:443
ip4.seeip.org
JOESDATACENTER
US
suspicious
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.110
whitelisted
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 95.101.149.131
whitelisted
ip4.seeip.org
  • 23.128.64.141
unknown
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.160.3
  • 40.126.32.72
  • 20.190.160.131
  • 20.190.160.130
  • 20.190.160.128
  • 20.190.160.67
  • 20.190.160.5
  • 20.190.160.22
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
discord.com
  • 162.159.128.233
  • 162.159.137.232
  • 162.159.138.232
  • 162.159.135.232
  • 162.159.136.232
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
7420
Xeno.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
2196
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
7420
Xeno.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
7420
Xeno.exe
Misc activity
ET INFO Observed Discord Service Domain (discord .com) in TLS SNI
7420
Xeno.exe
Successful Credential Theft Detected
STEALER [ANY.RUN] Attempt to exfiltrate via Discord
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
2196
svchost.exe
Misc activity
ET INFO Discord Chat Service Domain in DNS Lookup (discord .com)
7420
Xeno.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
7420
Xeno.exe
Misc activity
ET INFO Observed Discord Service Domain (discord .com) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Xeno-v1.2.0.exe