File name:

ram-encrypthub.exe

Full analysis: https://app.any.run/tasks/ab7d7b27-ac7c-4869-9184-b4558973078f
Verdict: Malicious activity
Threats:

HijackLoader is a modular malware acting as a vehicle for distributing different types of malicious software on compromised systems. It gained prominence during the summer of 2023 and has since been used in multiple attacks against organizations from various sectors, including hospitality businesses.

Malware Trends Tracker     >>>
Analysis date: February 14, 2025, 11:26:41
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rhadamanthys
stealer
hijackloader
loader
shellcode
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

CF0514B56F6498161A3AF8737D6A5CBB

SHA1:

42146E9DD1BDC415B1D9B4E036812D2ECC41E70E

SHA256:

06628B0447C94DD270ECAF798BD052891CDA386D504A20D439EB994004FF483C

SSDEEP:

98304:rP/h/5E1SZVY4MGfjN2OaXoHITbDwCw/FerHz6HalDfs8HLqLPTpVzDrXvFaZsAQ:4REa6fZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • HIJACKLOADER has been detected (YARA)

      • AppCheckS.exe (PID: 3952)

    • RHADAMANTHYS mutex has been found

      • svchost.exe (PID: 3564)
      • explorer.exe (PID: 3816)

    • RHADAMANTHYS has been detected (YARA)

      • svchost.exe (PID: 3564)

  • SUSPICIOUS

    • Starts itself from another location

      • ram-encrypthub.exe (PID: 3364)
      • AppCheckS.exe (PID: 440)

    • Executable content was dropped or overwritten

      • ram-encrypthub.exe (PID: 3364)
      • ram-encrypthub.exe (PID: 5208)
      • AppCheckS.exe (PID: 440)

    • Process drops legitimate windows executable

      • ram-encrypthub.exe (PID: 5208)
      • AppCheckS.exe (PID: 440)

    • The process drops C-runtime libraries

      • ram-encrypthub.exe (PID: 5208)
      • AppCheckS.exe (PID: 440)

    • Starts CMD.EXE for commands execution

      • AppCheckS.exe (PID: 3952)

    • The process checks if it is being run in the virtual environment

      • svchost.exe (PID: 3564)

  • INFO

    • Create files in a temporary directory

      • ram-encrypthub.exe (PID: 3364)
      • ram-encrypthub.exe (PID: 5208)
      • AppCheckS.exe (PID: 3952)

    • Checks supported languages

      • ram-encrypthub.exe (PID: 3364)
      • ram-encrypthub.exe (PID: 5208)
      • AppCheckS.exe (PID: 440)
      • AppCheckS.exe (PID: 3952)

    • The sample compiled with english language support

      • ram-encrypthub.exe (PID: 3364)
      • ram-encrypthub.exe (PID: 5208)
      • AppCheckS.exe (PID: 440)

    • The sample compiled with portuguese language support

      • ram-encrypthub.exe (PID: 5208)

    • Reads the computer name

      • ram-encrypthub.exe (PID: 5208)
      • AppCheckS.exe (PID: 3952)
      • AppCheckS.exe (PID: 440)

    • Manual execution by a user

      • svchost.exe (PID: 3564)

    • Creates files or folders in the user directory

      • AppCheckS.exe (PID: 440)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:11:18 22:00:38+00:00
ImageFileCharacteristics: Executable, 32-bit, Removable run from swap, Net run from swap
PEType: PE32
LinkerVersion: 14.11
CodeSize: 301568
InitializedDataSize: 160768
UninitializedDataSize: -
EntryPoint: 0x2e2a6
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 3.8.6.0
ProductVersionNumber: 3.8.6.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Caddy
FileDescription: Stethoscope
FileVersion: 3.8.6.0
InternalName: setup
LegalCopyright: Copyright (c) Caddy. All rights reserved.
OriginalFileName: autumn.exe
ProductName: Stethoscope
ProductVersion: 3.8.6.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
10
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start ram-encrypthub.exe ram-encrypthub.exe appchecks.exe #HIJACKLOADER appchecks.exe no specs cmd.exe no specs conhost.exe no specs #RHADAMANTHYS explorer.exe no specs #RHADAMANTHYS svchost.exe ucpdmgr.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
440C:\Users\admin\AppData\Local\Temp\{2D702A4C-D5BD-4970-87E2-A07680990056}\.ba\AppCheckS.exeC:\Users\admin\AppData\Local\Temp\{2D702A4C-D5BD-4970-87E2-A07680990056}\.ba\AppCheckS.exe
ram-encrypthub.exe
User:
admin
Company:
CheckMAL Inc.
Integrity Level:
MEDIUM
Description:
AppCheck Anti-Ransomware Service
Exit code:
0
Version:
3.1.39.3
Modules
Images
c:\users\admin\appdata\local\temp\{2d702a4c-d5bd-4970-87e2-a07680990056}\.ba\appchecks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1344\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—UCPDMgr.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3364"C:\Users\admin\AppData\Local\Temp\ram-encrypthub.exe" C:\Users\admin\AppData\Local\Temp\ram-encrypthub.exe
explorer.exe
User:
admin
Company:
Caddy
Integrity Level:
MEDIUM
Description:
Stethoscope
Exit code:
0
Version:
3.8.6.0
Modules
Images
c:\users\admin\appdata\local\temp\ram-encrypthub.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
3564"C:\Windows\System32\svchost.exe"C:\Windows\SysWOW64\svchost.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\sechost.dll
c:\windows\syswow64\rpcrt4.dll
3816C:\WINDOWS\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\wdowkxwxvh
c:\windows\syswow64\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
3952C:\Users\admin\AppData\Roaming\MakeExploreso\AppCheckS.exeC:\Users\admin\AppData\Roaming\MakeExploreso\AppCheckS.exe
AppCheckS.exe
User:
admin
Company:
CheckMAL Inc.
Integrity Level:
MEDIUM
Description:
AppCheck Anti-Ransomware Service
Exit code:
1
Version:
3.1.39.3
Modules
Images
c:\users\admin\appdata\roaming\makeexploreso\appchecks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
4548C:\WINDOWS\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe—AppCheckS.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5028\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5208"C:\Users\admin\AppData\Local\Temp\{3EE21BA6-1C3B-46A4-9C52-7D1C665E67FB}\.cr\ram-encrypthub.exe" -burn.clean.room="C:\Users\admin\AppData\Local\Temp\ram-encrypthub.exe" -burn.filehandle.attached=584 -burn.filehandle.self=596 C:\Users\admin\AppData\Local\Temp\{3EE21BA6-1C3B-46A4-9C52-7D1C665E67FB}\.cr\ram-encrypthub.exe
ram-encrypthub.exe
User:
admin
Company:
Caddy
Integrity Level:
MEDIUM
Description:
Stethoscope
Exit code:
0
Version:
3.8.6.0
Modules
Images
c:\users\admin\appdata\local\temp\{3ee21ba6-1c3b-46a4-9c52-7d1c665e67fb}\.cr\ram-encrypthub.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6088"C:\WINDOWS\system32\UCPDMgr.exe"C:\Windows\System32\UCPDMgr.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
User Choice Protection Manager
Exit code:
0
Version:
1.0.0.414301
Modules
Images
c:\windows\system32\ucpdmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
599
Read events
598
Write events
1
Delete events
0

Modification events

(PID) Process:(3816) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\SibCode
Operation:writeName:sn3
Value:
188F67EFB3FFC5659CC3338B05E0F1E7A04E9113A0E2BA8B4D81B65E560926F5A024CF6E4B16AC8DA79246E855844B09FEE5FBE321C6253BD01F53C4BDB1E44E
Executable files
10
Suspicious files
5
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
4548cmd.exeC:\Users\admin\AppData\Local\Temp\wdowkxwxvh —
MD5:—
SHA256:—
5208ram-encrypthub.exeC:\Users\admin\AppData\Local\Temp\{2D702A4C-D5BD-4970-87E2-A07680990056}\.ba\femur.mpegbinary
MD5:9725902A98AABA0BFFAF37B84CD38DF5
SHA256:3A31907E1AF868ECEF7A1491FD415A73C5306C47282F3F762621C472CD752EFF
5208ram-encrypthub.exeC:\Users\admin\AppData\Local\Temp\{2D702A4C-D5BD-4970-87E2-A07680990056}\.ba\BootstrapperApplicationData.xmlxml
MD5:A3B870562E75ED056FB90CA879445E14
SHA256:9648F240A31BAF83F7877F4A80899E66222EF1B7A86573D536CB8985A3DE648D
5208ram-encrypthub.exeC:\Users\admin\AppData\Local\Temp\{2D702A4C-D5BD-4970-87E2-A07680990056}\.ba\invenit.dmgbinary
MD5:25F3EA697C8D3D0182D51970F2114E1F
SHA256:09F3F70B33ECCABD0BF6F909856198A28C9C56B2C474AF9229ADBEDAEA6348D2
5208ram-encrypthub.exeC:\Users\admin\AppData\Local\Temp\{2D702A4C-D5BD-4970-87E2-A07680990056}\.ba\mfc140u.dllexecutable
MD5:52F8286BE04B82608C1591DC618F9DC9
SHA256:A158913485D0FBC0C6F5A61623D6B54AADD5E50F8F084E39CB5EC472BD35EBCC
5208ram-encrypthub.exeC:\Users\admin\AppData\Local\Temp\{2D702A4C-D5BD-4970-87E2-A07680990056}\.ba\msvcp140.dllexecutable
MD5:9FF712C25312821B8AEC84C4F8782A34
SHA256:517CD3AAC2177A357CCA6032F07AD7360EE8CA212A02DD6E1301BF6CFADE2094
5208ram-encrypthub.exeC:\Users\admin\AppData\Local\Temp\{2D702A4C-D5BD-4970-87E2-A07680990056}\.ba\vcruntime140.dllexecutable
MD5:EDF9D5C18111D82CF10EC99F6AFA6B47
SHA256:D89C7B863FC1AC3A179D45D5FE1B9FD35FB6FBD45171CA68D0D68AB1C1AD04FB
3364ram-encrypthub.exeC:\Users\admin\AppData\Local\Temp\{3EE21BA6-1C3B-46A4-9C52-7D1C665E67FB}\.cr\ram-encrypthub.exeexecutable
MD5:AD8A21FCA3E5EBE3BA6A8B643B23D69E
SHA256:62D6F804FDA5ABF1D2FFABE039FF6B541CA5DBE0A4E4123DF8A2D6985FFC1DBE
5208ram-encrypthub.exeC:\Users\admin\AppData\Local\Temp\{2D702A4C-D5BD-4970-87E2-A07680990056}\.ba\AppCheckS.exeexecutable
MD5:18247442E0F9378E739F650FD51ACB4E
SHA256:A5BF40C29313EB9F0E711BEE0D63B411EF35E80BA0FBDCC5964D0539DB59290E
5208ram-encrypthub.exeC:\Users\admin\AppData\Local\Temp\{2D702A4C-D5BD-4970-87E2-A07680990056}\.ba\Homologue.dllexecutable
MD5:406654D989DD8A573C739A8A8837BA41
SHA256:EB833E493CE14A305B033D55EE6994B01DCFD4C3280632C227C0F1BA25545844
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
62
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1176
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5128
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5300
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5300
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6092
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5064
SearchApp.exe
184.86.251.9:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1176
svchost.exe
20.190.160.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1076
svchost.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
5128
backgroundTaskHost.exe
20.103.156.88:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 184.86.251.9
  • 184.86.251.4
  • 184.86.251.29
  • 184.86.251.13
  • 184.86.251.12
  • 184.86.251.30
  • 184.86.251.15
  • 184.86.251.22
  • 184.86.251.18
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
login.live.com
  • 20.190.160.67
  • 20.190.160.64
  • 40.126.32.68
  • 20.190.160.14
  • 40.126.32.72
  • 40.126.32.76
  • 20.190.160.4
  • 20.190.160.2
whitelisted
go.microsoft.com
  • 23.35.238.131
  • 2.19.106.8
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
fd.api.iris.microsoft.com
  • 20.86.201.138
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.14
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ram-encrypthub.exe