File name:

2025-06-21_e957de67f2f351138957df06d25b74f8_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop

Full analysis: https://app.any.run/tasks/e1cb25b2-55b0-422a-b48e-782df15d3367
Verdict: Malicious activity
Analysis date: June 21, 2025, 08:10:26
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
sakula
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

E957DE67F2F351138957DF06D25B74F8

SHA1:

448DB5AEDE0C1A642FA5E1C5293B6AAAF21D5EC7

SHA256:

24BDE90C4F91E9514FEA13EA6ADF620A3D4BA687F19DCB63679EF7038A6998F6

SSDEEP:

1536:cZoUZR6RnYmE2q73nTWPZJA1zekntfaMBRId6HQmRc0nNU/+AE5z:c6NYx/nYZJA5cMUepnNU/C

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • SAKULA has been detected

      • 2025-06-21_e957de67f2f351138957df06d25b74f8_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe (PID: 3888)

    • Changes the autorun value in the registry

      • 2025-06-21_e957de67f2f351138957df06d25b74f8_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe (PID: 3888)

    • Starts CMD.EXE for self-deleting

      • 2025-06-21_e957de67f2f351138957df06d25b74f8_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe (PID: 3888)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 2025-06-21_e957de67f2f351138957df06d25b74f8_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe (PID: 3888)

    • Starts itself from another location

      • 2025-06-21_e957de67f2f351138957df06d25b74f8_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe (PID: 3888)

    • Reads security settings of Internet Explorer

      • 2025-06-21_e957de67f2f351138957df06d25b74f8_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe (PID: 3888)

    • Reads the date of Windows installation

      • 2025-06-21_e957de67f2f351138957df06d25b74f8_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe (PID: 3888)

    • Starts CMD.EXE for commands execution

      • 2025-06-21_e957de67f2f351138957df06d25b74f8_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe (PID: 3888)

  • INFO

    • Create files in a temporary directory

      • 2025-06-21_e957de67f2f351138957df06d25b74f8_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe (PID: 3888)

    • Launching a file from a Registry key

      • 2025-06-21_e957de67f2f351138957df06d25b74f8_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe (PID: 3888)

    • Reads the computer name

      • 2025-06-21_e957de67f2f351138957df06d25b74f8_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe (PID: 3888)

    • Process checks computer location settings

      • 2025-06-21_e957de67f2f351138957df06d25b74f8_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe (PID: 3888)

    • Checks supported languages

      • 2025-06-21_e957de67f2f351138957df06d25b74f8_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe (PID: 3888)

    • Manual execution by a user

      • AdobeUpdate.exe (PID: 4684)

    • Checks proxy server information

      • slui.exe (PID: 6408)

    • Reads the software policy settings

      • slui.exe (PID: 6408)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:04:02 06:46:11+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 57344
InitializedDataSize: 32768
UninitializedDataSize: -
EntryPoint: 0x4d59
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
7
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #SAKULA 2025-06-21_e957de67f2f351138957df06d25b74f8_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe adobeupdate.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs adobeupdate.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
32"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\admin\Desktop\2025-06-21_e957de67f2f351138957df06d25b74f8_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe"C:\Windows\SysWOW64\cmd.exe—2025-06-21_e957de67f2f351138957df06d25b74f8_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1068\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1604ping 127.0.0.1 C:\Windows\SysWOW64\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2760C:\Users\admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeC:\Users\admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe—2025-06-21_e957de67f2f351138957df06d25b74f8_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\micromedia\adobeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
3888"C:\Users\admin\Desktop\2025-06-21_e957de67f2f351138957df06d25b74f8_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe" C:\Users\admin\Desktop\2025-06-21_e957de67f2f351138957df06d25b74f8_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\2025-06-21_e957de67f2f351138957df06d25b74f8_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4684C:\Users\admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeC:\Users\admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\micromedia\adobeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6408C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
4 797
Read events
4 788
Write events
9
Delete events
0

Modification events

(PID) Process:(3888) 2025-06-21_e957de67f2f351138957df06d25b74f8_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:AdobeUpdate
Value:
C:\Users\admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe
(PID) Process:(3888) 2025-06-21_e957de67f2f351138957df06d25b74f8_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3888) 2025-06-21_e957de67f2f351138957df06d25b74f8_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3888) 2025-06-21_e957de67f2f351138957df06d25b74f8_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3888) 2025-06-21_e957de67f2f351138957df06d25b74f8_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
38882025-06-21_e957de67f2f351138957df06d25b74f8_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exeC:\Users\admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeexecutable
MD5:D805254C3A29819A02BF8A40C291AC3A
SHA256:4E5CBAD0AC646A934F8406813DCF8BE8D9169801A1A3D8335B75079AB6106134
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
22
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
184.24.77.23:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
184.24.77.23:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6700
RUXIMICS.exe
GET
200
184.24.77.23:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
6700
RUXIMICS.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6700
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
184.24.77.23:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
184.24.77.23:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6700
RUXIMICS.exe
184.24.77.23:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5944
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
google.com
  • 216.58.206.46
whitelisted
crl.microsoft.com
  • 184.24.77.23
  • 184.24.77.34
  • 184.24.77.30
  • 184.24.77.42
  • 184.24.77.6
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
self.events.data.microsoft.com
  • 51.132.193.104
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-06-21_e957de67f2f351138957df06d25b74f8_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop