Windows Analysis Report
Xeno.exe

Overview

General Information

Sample name: Xeno.exe
Analysis ID: 1591988
MD5: 1e5f4ee4303aa49c9c32e89132c7b4f9
SHA1: 47a80fa40216ef35cb66dbbf45ffda5eabc803cb
SHA256: ae0ad87b9d4cb0599d08afc3890f98d62c7cf02405ed8aab3d5238814d90febb
Tags: exeLummaStealeruser-aachum
Infos:

Detection

LummaC, PureLog Stealer
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected LummaC Stealer
Yara detected PureLog Stealer
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
LummaC encrypted strings found
Machine Learning detection for sample
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to modify clipboard data
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to record screenshots
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
One or more processes crash
PE / OLE file has an invalid certificate
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Searches for user specific document files
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)

Classification

Name Description Attribution Blogpost URLs Link
Lumma Stealer, LummaC2 Stealer Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

AV Detection
barindex
Found malware configuration
Source: 0.2.Xeno.exe.3f99550.0.raw.unpack Malware Configuration Extractor: LummaC {"C2 url": ["immolatechallen.bond", "jarry-fixxer.bond", "stripedre-lot.bond", "jarry-deatile.bond", "crookedfoshe.bond", "strivehelpeu.bond", "growthselec.bond", "pain-temper.bond", "sobrattyeu.bond"], "Build id": "yau6Na--914510980"}
Multi AV Scanner detection for submitted file
Source: Xeno.exe Virustotal: Detection: 47% Perma Link
Source: Xeno.exe ReversingLabs: Detection: 60%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 97.6% probability
Machine Learning detection for sample
Source: Xeno.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 00000000.00000002.1847669217.0000000003F99000.00000004.00000800.00020000.00000000.sdmp String decryptor: jarry-fixxer.bond
Source: 00000000.00000002.1847669217.0000000003F99000.00000004.00000800.00020000.00000000.sdmp String decryptor: pain-temper.bond
Source: 00000000.00000002.1847669217.0000000003F99000.00000004.00000800.00020000.00000000.sdmp String decryptor: jarry-deatile.bond
Source: 00000000.00000002.1847669217.0000000003F99000.00000004.00000800.00020000.00000000.sdmp String decryptor: growthselec.bond
Source: 00000000.00000002.1847669217.0000000003F99000.00000004.00000800.00020000.00000000.sdmp String decryptor: stripedre-lot.bond
Source: 00000000.00000002.1847669217.0000000003F99000.00000004.00000800.00020000.00000000.sdmp String decryptor: immolatechallen.bond
Source: 00000000.00000002.1847669217.0000000003F99000.00000004.00000800.00020000.00000000.sdmp String decryptor: crookedfoshe.bond
Source: 00000000.00000002.1847669217.0000000003F99000.00000004.00000800.00020000.00000000.sdmp String decryptor: strivehelpeu.bond
Source: 00000000.00000002.1847669217.0000000003F99000.00000004.00000800.00020000.00000000.sdmp String decryptor: sobrattyeu.bond
Source: 00000000.00000002.1847669217.0000000003F99000.00000004.00000800.00020000.00000000.sdmp String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1847669217.0000000003F99000.00000004.00000800.00020000.00000000.sdmp String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1847669217.0000000003F99000.00000004.00000800.00020000.00000000.sdmp String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1847669217.0000000003F99000.00000004.00000800.00020000.00000000.sdmp String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1847669217.0000000003F99000.00000004.00000800.00020000.00000000.sdmp String decryptor: Workgroup: -
Source: 00000000.00000002.1847669217.0000000003F99000.00000004.00000800.00020000.00000000.sdmp String decryptor: yau6Na--914510980
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00414B68 CryptUnprotectData, 1_2_00414B68
Uses 32bit PE files
Source: Xeno.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: Xeno.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: System.Windows.Forms.pdb source: WERD33A.tmp.dmp.4.dr
Source: Binary string: mscorlib.pdb source: WERD33A.tmp.dmp.4.dr
Source: Binary string: System.ni.pdbRSDS source: WERD33A.tmp.dmp.4.dr
Source: Binary string: Manjohn.pdbt-^q source: WERD33A.tmp.dmp.4.dr
Source: Binary string: System.pdbh source: WERD33A.tmp.dmp.4.dr
Source: Binary string: mscorlib.ni.pdb source: WERD33A.tmp.dmp.4.dr
Source: Binary string: mscorlib.ni.pdbRSDS source: WERD33A.tmp.dmp.4.dr
Source: Binary string: Manjohn.pdb source: Xeno.exe, WERD33A.tmp.dmp.4.dr
Source: Binary string: System.ni.pdb source: WERD33A.tmp.dmp.4.dr
Source: Binary string: System.pdb source: WERD33A.tmp.dmp.4.dr
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then movzx ecx, byte ptr [esp+eax-1174A60Fh] 1_2_00427090
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then mov esi, dword ptr [0044979Ch] 1_2_0040D190
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then mov byte ptr [esi], cl 1_2_0042D19A
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h 1_2_00440AB0
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 27BE92A4h 1_2_00440AB0
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then mov eax, edx 1_2_0040D363
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then movzx edx, byte ptr [esp+eax-02D04E4Dh] 1_2_00440B90
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then cmp dword ptr [ebp+edi*8+00h], 4B884A2Eh 1_2_00441450
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then cmp dword ptr [edi+esi*8], 53585096h 1_2_0042806B
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then mov ebp, edx 1_2_00428811
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then mov word ptr [eax], cx 1_2_00428811
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then mov word ptr [eax], cx 1_2_004208E0
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then mov ch, dl 1_2_00408080
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h 1_2_0042C080
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then mov esi, edx 1_2_00425099
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then mov word ptr [edi], cx 1_2_00425099
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then mov byte ptr [esi], cl 1_2_0042D944
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then mov byte ptr [esi], cl 1_2_0042D955
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then mov dword ptr [esp+08h], edx 1_2_00415901
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then movzx ecx, byte ptr [esp+eax-68h] 1_2_00415901
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h 1_2_00415901
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then mov byte ptr [esi], cl 1_2_0042D91A
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then movzx eax, byte ptr [esp+ecx+36h] 1_2_0040C12D
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then mov word ptr [eax], cx 1_2_004291C3
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h 1_2_00429986
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h 1_2_00429986
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then movzx eax, byte ptr [esp+ebp+06h] 1_2_0041A9E5
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h 1_2_00429986
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h 1_2_00429986
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then movzx ecx, byte ptr [esp+ebx+509ACCB5h] 1_2_00440190
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then mov ebx, dword ptr [edi+04h] 1_2_0042A9B0
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then add eax, ecx 1_2_0042EA70
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then movzx ecx, byte ptr [esp+ebx+509ACCB5h] 1_2_00440270
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then movzx edi, byte ptr [ecx+esi] 1_2_00402AE0
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h] 1_2_004072F0
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then movzx ecx, word ptr [edi+esi*4] 1_2_004072F0
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then movzx esi, byte ptr [esp+eax+198CD995h] 1_2_00418281
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then movzx esi, byte ptr [esp+eax+198CD995h] 1_2_00418376
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then movzx ecx, byte ptr [esp+eax+761380B1h] 1_2_004273C0
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then movzx esi, byte ptr [esp+eax+35h] 1_2_004273E0
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then movzx ebx, byte ptr [edx] 1_2_00437380
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then movzx edx, byte ptr [esp+ecx+34h] 1_2_0040BC4E
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then mov edx, ebx 1_2_0043AC10
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then mov edi, eax 1_2_00427CE5
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then mov word ptr [ecx], si 1_2_0041B571
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then movsx eax, byte ptr [esi+ecx] 1_2_0041DD70
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then movzx edx, byte ptr [esp+eax+2BA72EFAh] 1_2_00424513
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then movzx ecx, byte ptr [esp+eax+34h] 1_2_00429D10
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then mov byte ptr [edx], al 1_2_00419E2F
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then mov byte ptr [edx], al 1_2_00419E2F
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then movzx ecx, byte ptr [esp+edx-0Ch] 1_2_0040BD36
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then mov word ptr [ecx], si 1_2_0041B588
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then mov word ptr [ebx], cx 1_2_0041A591
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then movzx esi, byte ptr [esp+ecx-5365E318h] 1_2_00420DA0
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then movzx ecx, byte ptr [esi+eax+48643817h] 1_2_0043EDA6
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then movzx ecx, byte ptr [esp+ebx+509ACCB5h] 1_2_0043FE40
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then movzx esi, byte ptr [ecx] 1_2_0040A610
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then mov byte ptr [edx], al 1_2_00419E2F
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then cmp dword ptr [edi+esi*8], 01FCE602h 1_2_0043D630
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then movzx esi, byte ptr [esp+edx+736218E3h] 1_2_004406D0
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then movzx ecx, byte ptr [esp+ebx+509ACCB5h] 1_2_004406D0
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then mov byte ptr [edi], al 1_2_0042E6F5
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], 6F32DC84h 1_2_0043D6A0
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then movzx ecx, byte ptr [esp+ebx+509ACCB5h] 1_2_0043FF50
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then movzx ecx, byte ptr [esp+ebx+509ACCB5h] 1_2_0043FF70
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then cmp dword ptr [edx+ecx*8], 1ED645B4h 1_2_00418700
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h 1_2_00418700
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then mov byte ptr [edi], al 1_2_0042E6F3
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then mov byte ptr [edi], cl 1_2_0042DFC3
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then mov byte ptr [esi], cl 1_2_0042D7C0
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then test esi, esi 1_2_0043AFD0
Source: C:\Users\user\Desktop\Xeno.exe Code function: 4x nop then movzx edx, byte ptr [esp+eax-72CEDD06h] 1_2_004197F0

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49731 -> 104.21.96.1:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 104.21.96.1:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49733 -> 104.21.96.1:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49733 -> 104.21.96.1:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49748 -> 104.21.96.1:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49750 -> 104.21.96.1:443
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: immolatechallen.bond
Source: Malware configuration extractor URLs: jarry-fixxer.bond
Source: Malware configuration extractor URLs: stripedre-lot.bond
Source: Malware configuration extractor URLs: jarry-deatile.bond
Source: Malware configuration extractor URLs: crookedfoshe.bond
Source: Malware configuration extractor URLs: strivehelpeu.bond
Source: Malware configuration extractor URLs: growthselec.bond
Source: Malware configuration extractor URLs: pain-temper.bond
Source: Malware configuration extractor URLs: sobrattyeu.bond
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 104.21.96.1 104.21.96.1
Source: Joe Sandbox View IP Address: 104.21.96.1 104.21.96.1
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 104.21.96.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 104.21.96.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49737 -> 104.21.96.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49749 -> 104.21.96.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49747 -> 104.21.96.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49746 -> 104.21.96.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49750 -> 104.21.96.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49748 -> 104.21.96.1:443
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sobrattyeu.bond
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 51Host: sobrattyeu.bond
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0C84Y36Y3OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18119Host: sobrattyeu.bond
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=XVKS6T05H4JF1683U6User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8788Host: sobrattyeu.bond
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WLMONHV8TNUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20393Host: sobrattyeu.bond
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WWDJ5BXJR9T6I9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1391Host: sobrattyeu.bond
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=RFRJMFWTEQN7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 568321Host: sobrattyeu.bond
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 86Host: sobrattyeu.bond
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: sobrattyeu.bond
Source: unknown HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sobrattyeu.bond
Source: Xeno.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Xeno.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: Xeno.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: Xeno.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Xeno.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Xeno.exe String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Xeno.exe String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: Xeno.exe String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Xeno.exe String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Xeno.exe String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: Xeno.exe String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: Xeno.exe String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: Xeno.exe String found in binary or memory: http://ocsp.digicert.com0A
Source: Xeno.exe String found in binary or memory: http://ocsp.digicert.com0C
Source: Xeno.exe String found in binary or memory: http://ocsp.digicert.com0H
Source: Xeno.exe String found in binary or memory: http://ocsp.digicert.com0I
Source: Xeno.exe String found in binary or memory: http://ocsp.digicert.com0X
Source: Amcache.hve.4.dr String found in binary or memory: http://upx.sf.net
Source: Xeno.exe String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: Xeno.exe, 00000001.00000002.2943363662.000000000356D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sobrattyeu.bond/
Source: Xeno.exe, 00000001.00000002.2943363662.000000000356D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sobrattyeu.bond/C
Source: Xeno.exe, 00000001.00000002.2942920179.0000000000D22000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sobrattyeu.bond/TEQN7c
Source: Xeno.exe, 00000001.00000002.2942823706.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp, Xeno.exe, 00000001.00000002.2942776722.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sobrattyeu.bond/api
Source: Xeno.exe, 00000001.00000002.2942823706.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sobrattyeu.bond/api7
Source: Xeno.exe String found in binary or memory: https://www.digicert.com/CPS0
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49750 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00435030 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard, 1_2_00435030
Contains functionality to modify clipboard data
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_03271000 EntryPoint,GetClipboardSequenceNumber,Sleep,Sleep,OpenClipboard,GetClipboardData,GlobalLock,GlobalAlloc,GlobalLock,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,GlobalUnlock,CloseClipboard,GetClipboardSequenceNumber, 1_2_03271000
Contains functionality to read the clipboard data
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00435030 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard, 1_2_00435030
Contains functionality to record screenshots
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_004351D0 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,SelectObject,BitBlt,SelectObject,DeleteDC, 1_2_004351D0
Detected potential crypto function
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_0043D0F0 1_2_0043D0F0
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00427090 1_2_00427090
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_004240A0 1_2_004240A0
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00411900 1_2_00411900
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_0042D19A 1_2_0042D19A
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00433A7F 1_2_00433A7F
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_0040D363 1_2_0040D363
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00414B68 1_2_00414B68
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00440B90 1_2_00440B90
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00408570 1_2_00408570
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00439FE0 1_2_00439FE0
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00401040 1_2_00401040
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00403860 1_2_00403860
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_0042806B 1_2_0042806B
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00409000 1_2_00409000
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00405820 1_2_00405820
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_0043F82B 1_2_0043F82B
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_0041C830 1_2_0041C830
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_004408D0 1_2_004408D0
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_004208E0 1_2_004208E0
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00408080 1_2_00408080
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00406080 1_2_00406080
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00425099 1_2_00425099
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_004268B2 1_2_004268B2
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_0041E140 1_2_0041E140
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_0041794B 1_2_0041794B
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_0041B950 1_2_0041B950
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_0043B150 1_2_0043B150
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_0042D955 1_2_0042D955
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00415901 1_2_00415901
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_0041C110 1_2_0041C110
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_004291C3 1_2_004291C3
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_0041A9E5 1_2_0041A9E5
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00441190 1_2_00441190
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00440190 1_2_00440190
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00419270 1_2_00419270
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00440270 1_2_00440270
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00404210 1_2_00404210
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_004072F0 1_2_004072F0
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00404B40 1_2_00404B40
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_0042F370 1_2_0042F370
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_0043B370 1_2_0043B370
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00434BD0 1_2_00434BD0
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_004093E0 1_2_004093E0
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00416B82 1_2_00416B82
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_0041BC60 1_2_0041BC60
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00430477 1_2_00430477
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00414C04 1_2_00414C04
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_0043AC10 1_2_0043AC10
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00427CE5 1_2_00427CE5
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_004174FD 1_2_004174FD
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00430D63 1_2_00430D63
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00419570 1_2_00419570
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00411577 1_2_00411577
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00406510 1_2_00406510
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00439510 1_2_00439510
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00437D15 1_2_00437D15
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00433539 1_2_00433539
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_0041F5C0 1_2_0041F5C0
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_004145E0 1_2_004145E0
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_0041AD89 1_2_0041AD89
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_0041C5A0 1_2_0041C5A0
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00420DA0 1_2_00420DA0
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_0043FE40 1_2_0043FE40
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00402E50 1_2_00402E50
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_0040A610 1_2_0040A610
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00426E26 1_2_00426E26
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_0040AE25 1_2_0040AE25
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00410E2B 1_2_00410E2B
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00438633 1_2_00438633
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00438E3A 1_2_00438E3A
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_004406D0 1_2_004406D0
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00422EFD 1_2_00422EFD
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_0043D6A0 1_2_0043D6A0
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_0043FF50 1_2_0043FF50
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00439770 1_2_00439770
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_0043FF70 1_2_0043FF70
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00418700 1_2_00418700
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00440F00 1_2_00440F00
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_0042DFC3 1_2_0042DFC3
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_0042D7C0 1_2_0042D7C0
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00413FF0 1_2_00413FF0
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_0042C790 1_2_0042C790
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00429FB0 1_2_00429FB0
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_0040C7B5 1_2_0040C7B5
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\Xeno.exe Code function: String function: 00413BD0 appears 121 times
Source: C:\Users\user\Desktop\Xeno.exe Code function: String function: 00407E80 appears 49 times
One or more processes crash
Source: C:\Users\user\Desktop\Xeno.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5544 -s 924
PE / OLE file has an invalid certificate
Source: Xeno.exe Static PE information: invalid certificate
Sample file is different than original file name gathered from version info
Source: Xeno.exe, 00000000.00000002.1846632115.000000000125E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs Xeno.exe
Source: Xeno.exe, 00000000.00000002.1847669217.0000000003F99000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameHandler.exe0 vs Xeno.exe
Source: Xeno.exe, 00000000.00000000.1685351915.0000000000B92000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameHandler.exe0 vs Xeno.exe
Source: Xeno.exe Binary or memory string: OriginalFilenameHandler.exe0 vs Xeno.exe
Uses 32bit PE files
Source: Xeno.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: Xeno.exe Static PE information: Section: .idata ZLIB complexity 1.0003388400163666
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@4/5@1/1
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00439FE0 RtlExpandEnvironmentStrings,CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW, 1_2_00439FE0
Source: C:\Users\user\Desktop\Xeno.exe Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5544
Source: C:\Windows\SysWOW64\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\4c56b1cb-5b0c-4434-a4bd-c8256ae06dbf Jump to behavior
Source: Xeno.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Xeno.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
Source: C:\Users\user\Desktop\Xeno.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Xeno.exe Virustotal: Detection: 47%
Source: Xeno.exe ReversingLabs: Detection: 60%
Source: C:\Users\user\Desktop\Xeno.exe File read: C:\Users\user\Desktop\Xeno.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Xeno.exe "C:\Users\user\Desktop\Xeno.exe"
Source: C:\Users\user\Desktop\Xeno.exe Process created: C:\Users\user\Desktop\Xeno.exe "C:\Users\user\Desktop\Xeno.exe"
Source: C:\Users\user\Desktop\Xeno.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5544 -s 924
Source: C:\Users\user\Desktop\Xeno.exe Process created: C:\Users\user\Desktop\Xeno.exe "C:\Users\user\Desktop\Xeno.exe" Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: Xeno.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Xeno.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Xeno.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: System.Windows.Forms.pdb source: WERD33A.tmp.dmp.4.dr
Source: Binary string: mscorlib.pdb source: WERD33A.tmp.dmp.4.dr
Source: Binary string: System.ni.pdbRSDS source: WERD33A.tmp.dmp.4.dr
Source: Binary string: Manjohn.pdbt-^q source: WERD33A.tmp.dmp.4.dr
Source: Binary string: System.pdbh source: WERD33A.tmp.dmp.4.dr
Source: Binary string: mscorlib.ni.pdb source: WERD33A.tmp.dmp.4.dr
Source: Binary string: mscorlib.ni.pdbRSDS source: WERD33A.tmp.dmp.4.dr
Source: Binary string: Manjohn.pdb source: Xeno.exe, WERD33A.tmp.dmp.4.dr
Source: Binary string: System.ni.pdb source: WERD33A.tmp.dmp.4.dr
Source: Binary string: System.pdb source: WERD33A.tmp.dmp.4.dr
Binary contains a suspicious time stamp
Source: Xeno.exe Static PE information: 0xECEDE332 [Sun Dec 18 02:19:30 2095 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00443A67 push eax; ret 1_2_00443A6A
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00447A70 push edi; iretd 1_2_00447A72
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00444AA3 push eax; retf 1_2_00444AA4
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_00447B7C push ss; iretd 1_2_00447BBB
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_0043FDF0 push eax; mov dword ptr [esp], C0C3C2F5h 1_2_0043FDF2
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\Xeno.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Xeno.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\Desktop\Xeno.exe System information queried: FirmwareTableInformation Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\Xeno.exe Memory allocated: 1230000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Memory allocated: 2F90000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Memory allocated: 1590000 memory reserve | memory write watch Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\Xeno.exe Window / User API: threadDelayed 6089 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Xeno.exe TID: 4124 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe TID: 1508 Thread sleep count: 6089 > 30 Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Xeno.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\Desktop\Xeno.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\Xeno.exe Last function: Thread delayed
Source: Amcache.hve.4.dr Binary or memory string: VMware
Source: Amcache.hve.4.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Xeno.exe, 00000001.00000002.2942807355.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, Xeno.exe, 00000001.00000002.2942665593.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: Amcache.hve.4.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.4.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: C:\Users\user\Desktop\Xeno.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\Xeno.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\Xeno.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\Xeno.exe Code function: 1_2_0043E7C0 LdrInitializeThunk, 1_2_0043E7C0
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\Xeno.exe Code function: 0_2_02F97F41 mov edi, dword ptr fs:[00000030h] 0_2_02F97F41
Source: C:\Users\user\Desktop\Xeno.exe Code function: 0_2_02F980BE mov edi, dword ptr fs:[00000030h] 0_2_02F980BE
Source: C:\Users\user\Desktop\Xeno.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Contains functionality to inject code into remote processes
Source: C:\Users\user\Desktop\Xeno.exe Code function: 0_2_02F97F41 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread, 0_2_02F97F41
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Xeno.exe Memory written: C:\Users\user\Desktop\Xeno.exe base: 400000 value starts with: 4D5A Jump to behavior
LummaC encrypted strings found
Source: Xeno.exe, 00000000.00000002.1847669217.0000000003F99000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: growthselec.bond
Source: Xeno.exe, 00000000.00000002.1847669217.0000000003F99000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: immolatechallen.bond
Source: Xeno.exe, 00000000.00000002.1847669217.0000000003F99000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: crookedfoshe.bond
Source: Xeno.exe, 00000000.00000002.1847669217.0000000003F99000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: strivehelpeu.bond
Source: Xeno.exe, 00000000.00000002.1847669217.0000000003F99000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: sobrattyeu.bond
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Xeno.exe Process created: C:\Users\user\Desktop\Xeno.exe "C:\Users\user\Desktop\Xeno.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Xeno.exe Queries volume information: C:\Users\user\Desktop\Xeno.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.4.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Xeno.exe, 00000001.00000002.2942920179.0000000000D22000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %\Windows Defender\MsMpeng.exe
Source: Xeno.exe, 00000001.00000002.2942776722.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.4.dr Binary or memory string: MsMpEng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\Desktop\Xeno.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected LummaC Stealer
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: Process Memory Space: Xeno.exe PID: 3020, type: MEMORYSTR
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Yara detected PureLog Stealer
Source: Yara match File source: Xeno.exe, type: SAMPLE
Source: Yara match File source: 0.0.Xeno.exe.b90000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Xeno.exe.3f99550.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Xeno.exe.3f99550.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000000.1685351915.0000000000B92000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1847669217.0000000003F99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Found many strings related to Crypto-Wallets (likely being stolen)
Source: Xeno.exe, 00000001.00000002.2942823706.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Wallets/Electrum
Source: Xeno.exe, 00000001.00000002.2942823706.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Wallets/ElectronCash
Source: Xeno.exe, 00000001.00000002.2942823706.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: window-state.json
Source: Xeno.exe, 00000001.00000002.2942823706.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: ExodusWeb3
Source: Xeno.exe, 00000001.00000002.2942823706.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %appdata%\Ethereum
Source: Xeno.exe, 00000000.00000002.1847669217.0000000003F99000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: set_UseMachineKeyStore
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Roaming\FTPGetter Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Roaming\FTPInfo Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Roaming\FTPbox Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Roaming\FTPRush Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\ProgramData\SiteDesigner\3D-FTP Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Searches for user specific document files
Source: C:\Users\user\Desktop\Xeno.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Directory queried: C:\Users\user\Documents\NIKHQAIQAU Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\Desktop\Xeno.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior

Remote Access Functionality
barindex
Yara detected LummaC Stealer
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: Process Memory Space: Xeno.exe PID: 3020, type: MEMORYSTR
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Yara detected PureLog Stealer
Source: Yara match File source: Xeno.exe, type: SAMPLE
Source: Yara match File source: 0.0.Xeno.exe.b90000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Xeno.exe.3f99550.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Xeno.exe.3f99550.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000000.1685351915.0000000000B92000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1847669217.0000000003F99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1591988 Sample: Xeno.exe Startdate: 15/01/2025 Architecture: WINDOWS Score: 100 19 sobrattyeu.bond 2->19 23 Suricata IDS alerts for network traffic 2->23 25 Found malware configuration 2->25 27 Multi AV Scanner detection for submitted file 2->27 29 6 other signatures 2->29 7 Xeno.exe 2->7         started        signatures3 process4 signatures5 31 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 7->31 33 Found many strings related to Crypto-Wallets (likely being stolen) 7->33 35 Contains functionality to inject code into remote processes 7->35 37 2 other signatures 7->37 10 Xeno.exe 7->10         started        14 WerFault.exe 21 16 7->14         started        process6 dnsIp7 21 sobrattyeu.bond 104.21.96.1, 443, 49731, 49733 CLOUDFLARENETUS United States 10->21 39 Query firmware table information (likely to detect VMs) 10->39 41 Found many strings related to Crypto-Wallets (likely being stolen) 10->41 43 Tries to harvest and steal ftp login credentials 10->43 45 2 other signatures 10->45 17 C:\ProgramData\Microsoft\...\Report.wer, Unicode 14->17 dropped file8 signatures9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.21.96.1
 sobrattyeu.bond United States
13335 CLOUDFLARENETUS true

Contacted Domains

Name IP Active
sobrattyeu.bond 104.21.96.1 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
jarry-deatile.bond true
  • Avira URL Cloud: safe
 unknown
immolatechallen.bond true
  • Avira URL Cloud: safe
 unknown
stripedre-lot.bond true
  • Avira URL Cloud: safe
 unknown
jarry-fixxer.bond true
  • Avira URL Cloud: safe
 unknown
sobrattyeu.bond true
  • Avira URL Cloud: safe
 unknown
pain-temper.bond true
  • Avira URL Cloud: safe
 unknown
crookedfoshe.bond true
  • Avira URL Cloud: safe
 unknown
growthselec.bond true
  • Avira URL Cloud: safe
 unknown
https://sobrattyeu.bond/api true
  • Avira URL Cloud: safe
 unknown
strivehelpeu.bond true
  • Avira URL Cloud: safe
 unknown