File name:

961d1b515932a809fd3d404bf8fbc49f.exe

Full analysis: https://app.any.run/tasks/c2d4b85d-63e2-42a8-a79a-37beb8bd3cca
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: April 29, 2025, 06:08:52
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
lumma
stealer
themida
auto
botnet
amadey
loader
telegram
rat
asyncrat
remote
rdp
purehvnc
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

961D1B515932A809FD3D404BF8FBC49F

SHA1:

B9D9C85BDEB5661E8EDBA03DE8719529AA621C99

SHA256:

2C4A045C8032F43E18B33A9E94A126BE77D75E632171763059CF32EC985BDBCE

SSDEEP:

98304:CpwV6DxPj7lD1GxLBFf9m5LUQHRbuzWlfreIYnTRQdl+2mn1kDC3DeqWJYuOjMY4:

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)
      • MSBuild.exe (PID: 7780)
    • Actions looks like stealing of personal data

      • 961d1b515932a809fd3d404bf8fbc49f.exe (PID: 3300)
      • MSBuild.exe (PID: 7496)
      • MSBuild.exe (PID: 7780)
    • LUMMA mutex has been found

      • 961d1b515932a809fd3d404bf8fbc49f.exe (PID: 3300)
      • MSBuild.exe (PID: 7780)
    • Connects to the CnC server

      • svchost.exe (PID: 2196)
      • saved.exe (PID: 7368)
    • LUMMA has been detected (YARA)

      • 961d1b515932a809fd3d404bf8fbc49f.exe (PID: 3300)
    • AMADEY has been found (auto)

      • 961d1b515932a809fd3d404bf8fbc49f.exe (PID: 3300)
      • ZU87CWRK0CHMMY2N8G.exe (PID: 7308)
    • AMADEY has been detected (SURICATA)

      • saved.exe (PID: 7368)
    • AMADEY has been detected (YARA)

      • saved.exe (PID: 7368)
    • PUREHVNC has been detected (YARA)

      • MSBuild.exe (PID: 7496)
    • ASYNCRAT has been detected (SURICATA)

      • MSBuild.exe (PID: 7496)
  • SUSPICIOUS

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2196)
      • saved.exe (PID: 7368)
      • MSBuild.exe (PID: 7496)
      • MSBuild.exe (PID: 7780)
    • Reads the BIOS version

      • 961d1b515932a809fd3d404bf8fbc49f.exe (PID: 3300)
    • Searches for installed software

      • 961d1b515932a809fd3d404bf8fbc49f.exe (PID: 3300)
      • MSBuild.exe (PID: 7780)
    • Process requests binary or script from the Internet

      • 961d1b515932a809fd3d404bf8fbc49f.exe (PID: 3300)
      • saved.exe (PID: 7368)
    • Executable content was dropped or overwritten

      • 961d1b515932a809fd3d404bf8fbc49f.exe (PID: 3300)
      • ZU87CWRK0CHMMY2N8G.exe (PID: 7308)
      • saved.exe (PID: 7368)
    • Connects to the server without a host name

      • 961d1b515932a809fd3d404bf8fbc49f.exe (PID: 3300)
      • saved.exe (PID: 7368)
    • Potential Corporate Privacy Violation

      • 961d1b515932a809fd3d404bf8fbc49f.exe (PID: 3300)
      • saved.exe (PID: 7368)
    • Reads security settings of Internet Explorer

      • ZU87CWRK0CHMMY2N8G.exe (PID: 7308)
      • saved.exe (PID: 7368)
    • Starts itself from another location

      • ZU87CWRK0CHMMY2N8G.exe (PID: 7308)
    • Process drops legitimate windows executable

      • saved.exe (PID: 7368)
    • Starts a Microsoft application from unusual location

      • K2bpz1U.exe (PID: 7508)
      • e039b72143.exe (PID: 7736)
      • K2bpz1U.exe (PID: 7460)
    • There is functionality for taking screenshot (YARA)

      • saved.exe (PID: 7368)
    • There is functionality for enable RDP (YARA)

      • saved.exe (PID: 7368)
    • Multiple wallet extension IDs have been found

      • MSBuild.exe (PID: 7496)
    • The process executes via Task Scheduler

      • saved.exe (PID: 7880)
      • saved.exe (PID: 8108)
    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • MSBuild.exe (PID: 7780)
    • Connects to unusual port

      • MSBuild.exe (PID: 7496)
  • INFO

    • Checks supported languages

      • 961d1b515932a809fd3d404bf8fbc49f.exe (PID: 3300)
      • ZU87CWRK0CHMMY2N8G.exe (PID: 7308)
      • saved.exe (PID: 7368)
      • K2bpz1U.exe (PID: 7460)
      • K2bpz1U.exe (PID: 7508)
      • MSBuild.exe (PID: 7496)
      • MSBuild.exe (PID: 7592)
      • MSBuild.exe (PID: 7780)
      • saved.exe (PID: 7880)
      • e039b72143.exe (PID: 7736)
    • Reads the computer name

      • 961d1b515932a809fd3d404bf8fbc49f.exe (PID: 3300)
      • ZU87CWRK0CHMMY2N8G.exe (PID: 7308)
      • saved.exe (PID: 7368)
      • MSBuild.exe (PID: 7496)
      • MSBuild.exe (PID: 7592)
      • MSBuild.exe (PID: 7780)
    • Reads the software policy settings

      • 961d1b515932a809fd3d404bf8fbc49f.exe (PID: 3300)
      • MSBuild.exe (PID: 7496)
      • slui.exe (PID: 6424)
      • MSBuild.exe (PID: 7780)
    • Themida protector has been detected

      • 961d1b515932a809fd3d404bf8fbc49f.exe (PID: 3300)
    • Create files in a temporary directory

      • 961d1b515932a809fd3d404bf8fbc49f.exe (PID: 3300)
      • ZU87CWRK0CHMMY2N8G.exe (PID: 7308)
      • saved.exe (PID: 7368)
    • Process checks computer location settings

      • ZU87CWRK0CHMMY2N8G.exe (PID: 7308)
      • saved.exe (PID: 7368)
    • Checks proxy server information

      • saved.exe (PID: 7368)
    • Creates files or folders in the user directory

      • saved.exe (PID: 7368)
    • The sample compiled with english language support

      • saved.exe (PID: 7368)
    • Reads the machine GUID from the registry

      • MSBuild.exe (PID: 7496)
      • MSBuild.exe (PID: 7592)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Lumma

(PID) Process(3300) 961d1b515932a809fd3d404bf8fbc49f.exe
C2 (9)parakehjet.run/kewk
buzzarddf.live/ktnt
zenithcorde.top/auid
bearjk.live/benj
techguidet.digital/apdo
techsyncq.run/riid
btcgeared.live/lbak
clarmodq.top/qoxo
fishgh.digital/tequ

Amadey

(PID) Process(7368) saved.exe
C2185.39.17.163
URLhttp://185.39.17.163/Su8kud7i/index.php
Version5.34
Options
Drop directoryc13dbdc4fa
Drop namesaved.exe
Strings (125)S-%lu-
og:
clip.dll
ProgramData\
shell32.dll
<c>
vs:
Programs
&&
VideoID
ESET
av:
\App
0000043f
Doctor Web
:::
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
------
rundll32.exe
00000422
185.39.17.163
0123456789
st=s
00000419
Content-Type: application/x-www-form-urlencoded
/Plugins/
msi
ar:
GetNativeSystemInfo
Norton
-%lu
Sophos
zip
SOFTWARE\Microsoft\Windows NT\CurrentVersion
" Content-Type: application/octet-stream
|
+++
" && ren
pc:
#
d1
cmd /C RMDIR /s/q
Bitdefender
Comodo
<d>
Kaspersky Lab
DefaultSettings.YResolution
Main
c13dbdc4fa
-executionpolicy remotesigned -File "
&& Exit"
ProductName
&unit=
2022
Panda Security
=
Rem
cmd
\0000
id:
sd:
--
/quiet
rundll32
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
%-lu
random
GET
"taskkill /f /im "
Content-Disposition: form-data; name="data"; filename="
00000423
5.34
2016
?scr=1
ComputerName
Keyboard Layout\Preload
Powershell.exe
POST
http://
AVAST Software
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
ps1
DefaultSettings.XResolution
Startup
CurrentBuild
e3
cred.dll|clip.dll|
------
WinDefender
wb
https://
Avira
2025
" && timeout 1 && del
cred.dll
un:
SYSTEM\ControlSet001\Services\BasicDisplay\Video
rb
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
360TotalSecurity
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
saved.exe
e1
lv:
/Su8kud7i/index.php
shutdown -s -t 0
/k
e2
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
exe
%USERPROFILE%
-unicode-
r=
.jpg
dll
Content-Type: multipart/form-data; boundary=----
2019
bi:
\
"
kernel32.dll
os:
abcdefghijklmnopqrstuvwxyz0123456789-_
dm:
AVG
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:04:26 14:47:23+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 312320
InitializedDataSize: 38400
UninitializedDataSize: -
EntryPoint: 0x4a6000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
15
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #LUMMA 961d1b515932a809fd3d404bf8fbc49f.exe sppextcomobj.exe no specs slui.exe #LUMMA svchost.exe #AMADEY zu87cwrk0chmmy2n8g.exe #AMADEY saved.exe k2bpz1u.exe no specs #ASYNCRAT msbuild.exe k2bpz1u.exe no specs msbuild.exe no specs e039b72143.exe no specs #LUMMA msbuild.exe saved.exe no specs slui.exe no specs saved.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3300"C:\Users\admin\AppData\Local\Temp\961d1b515932a809fd3d404bf8fbc49f.exe" C:\Users\admin\AppData\Local\Temp\961d1b515932a809fd3d404bf8fbc49f.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\961d1b515932a809fd3d404bf8fbc49f.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Lumma
(PID) Process(3300) 961d1b515932a809fd3d404bf8fbc49f.exe
C2 (9)parakehjet.run/kewk
buzzarddf.live/ktnt
zenithcorde.top/auid
bearjk.live/benj
techguidet.digital/apdo
techsyncq.run/riid
btcgeared.live/lbak
clarmodq.top/qoxo
fishgh.digital/tequ
4488C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exesvchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6424"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7308"C:\Users\admin\AppData\Local\Temp\ZU87CWRK0CHMMY2N8G.exe"C:\Users\admin\AppData\Local\Temp\ZU87CWRK0CHMMY2N8G.exe
961d1b515932a809fd3d404bf8fbc49f.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\zu87cwrk0chmmy2n8g.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7368"C:\Users\admin\AppData\Local\Temp\c13dbdc4fa\saved.exe" C:\Users\admin\AppData\Local\Temp\c13dbdc4fa\saved.exe
ZU87CWRK0CHMMY2N8G.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\c13dbdc4fa\saved.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Amadey
(PID) Process(7368) saved.exe
C2185.39.17.163
URLhttp://185.39.17.163/Su8kud7i/index.php
Version5.34
Options
Drop directoryc13dbdc4fa
Drop namesaved.exe
Strings (125)S-%lu-
og:
clip.dll
ProgramData\
shell32.dll
<c>
vs:
Programs
&&
VideoID
ESET
av:
\App
0000043f
Doctor Web
:::
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
------
rundll32.exe
00000422
185.39.17.163
0123456789
st=s
00000419
Content-Type: application/x-www-form-urlencoded
/Plugins/
msi
ar:
GetNativeSystemInfo
Norton
-%lu
Sophos
zip
SOFTWARE\Microsoft\Windows NT\CurrentVersion
" Content-Type: application/octet-stream
|
+++
" && ren
pc:
#
d1
cmd /C RMDIR /s/q
Bitdefender
Comodo
<d>
Kaspersky Lab
DefaultSettings.YResolution
Main
c13dbdc4fa
-executionpolicy remotesigned -File "
&& Exit"
ProductName
&unit=
2022
Panda Security
=
Rem
cmd
\0000
id:
sd:
--
/quiet
rundll32
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
%-lu
random
GET
"taskkill /f /im "
Content-Disposition: form-data; name="data"; filename="
00000423
5.34
2016
?scr=1
ComputerName
Keyboard Layout\Preload
Powershell.exe
POST
http://
AVAST Software
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
ps1
DefaultSettings.XResolution
Startup
CurrentBuild
e3
cred.dll|clip.dll|
------
WinDefender
wb
https://
Avira
2025
" && timeout 1 && del
cred.dll
un:
SYSTEM\ControlSet001\Services\BasicDisplay\Video
rb
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
360TotalSecurity
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
saved.exe
e1
lv:
/Su8kud7i/index.php
shutdown -s -t 0
/k
e2
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
exe
%USERPROFILE%
-unicode-
r=
.jpg
dll
Content-Type: multipart/form-data; boundary=----
2019
bi:
\
"
kernel32.dll
os:
abcdefghijklmnopqrstuvwxyz0123456789-_
dm:
AVG
7460"C:\Users\admin\AppData\Local\Temp\10053470101\K2bpz1U.exe" C:\Users\admin\AppData\Local\Temp\10053470101\K2bpz1U.exesaved.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Windows Media Player Setup Utility
Exit code:
0
Version:
12.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\10053470101\k2bpz1u.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
7496"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
K2bpz1U.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7508"C:\Users\admin\AppData\Local\Temp\10053480101\K2bpz1U.exe" C:\Users\admin\AppData\Local\Temp\10053480101\K2bpz1U.exesaved.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Windows Media Player Setup Utility
Exit code:
0
Version:
12.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\10053480101\k2bpz1u.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
7592"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeK2bpz1U.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
6 039
Read events
6 036
Write events
3
Delete events
0

Modification events

(PID) Process:(7368) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7368) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7368) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
7
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
7368saved.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\K2bpz1U[1].exeexecutable
MD5:6D2E17C63B05577D3A52963DBA66F799
SHA256:B5B33BF302D93473DF41ACBE1D2AA901F6C37ACD4DD75A47FE37B0DB774632AE
7308ZU87CWRK0CHMMY2N8G.exeC:\Users\admin\AppData\Local\Temp\c13dbdc4fa\saved.exeexecutable
MD5:F6C20A18AFEAC04964A6CCAD6BE59731
SHA256:CE75F9DEDE6D4E93549D35B816898113B6BEFAB9EF0AADF8949D4887C2C34BEA
7308ZU87CWRK0CHMMY2N8G.exeC:\Windows\Tasks\saved.jobbinary
MD5:D618396FF8BE7E29B33FAC515CF028B9
SHA256:62E7E9D7E502F58B01B50A1B09704813569107F2CB823ED7447B028EDB42BB09
3300961d1b515932a809fd3d404bf8fbc49f.exeC:\Users\admin\AppData\Local\Temp\ZU87CWRK0CHMMY2N8G.exeexecutable
MD5:F6C20A18AFEAC04964A6CCAD6BE59731
SHA256:CE75F9DEDE6D4E93549D35B816898113B6BEFAB9EF0AADF8949D4887C2C34BEA
7368saved.exeC:\Users\admin\AppData\Local\Temp\10053470101\K2bpz1U.exeexecutable
MD5:6D2E17C63B05577D3A52963DBA66F799
SHA256:B5B33BF302D93473DF41ACBE1D2AA901F6C37ACD4DD75A47FE37B0DB774632AE
7368saved.exeC:\Users\admin\AppData\Local\Temp\10053480101\K2bpz1U.exeexecutable
MD5:6D2E17C63B05577D3A52963DBA66F799
SHA256:B5B33BF302D93473DF41ACBE1D2AA901F6C37ACD4DD75A47FE37B0DB774632AE
7368saved.exeC:\Users\admin\AppData\Local\Temp\10053490101\e039b72143.exeexecutable
MD5:3866CEA2B577ECA8451679A6175D270B
SHA256:27428A2B8E8FB847EC370B70E3B527CB75BE2524776207B1F7C9A9B994075457
7368saved.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\random[1].exeexecutable
MD5:3866CEA2B577ECA8451679A6175D270B
SHA256:27428A2B8E8FB847EC370B70E3B527CB75BE2524776207B1F7C9A9B994075457
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
39
DNS requests
20
Threats
27

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
3300
961d1b515932a809fd3d404bf8fbc49f.exe
GET
200
185.39.17.162:80
http://185.39.17.162/mine/random.exe
unknown
malicious
7368
saved.exe
POST
200
185.39.17.163:80
http://185.39.17.163/Su8kud7i/index.php
unknown
malicious
7368
saved.exe
POST
200
185.39.17.163:80
http://185.39.17.163/Su8kud7i/index.php
unknown
malicious
7368
saved.exe
GET
200
185.39.17.162:80
http://185.39.17.162/files/8188707104/K2bpz1U.exe
unknown
malicious
7368
saved.exe
POST
200
185.39.17.163:80
http://185.39.17.163/Su8kud7i/index.php
unknown
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
whitelisted
3300
961d1b515932a809fd3d404bf8fbc49f.exe
104.21.51.232:443
zenithcorde.top
CLOUDFLARENET
unknown
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.66:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
google.com
  • 172.217.16.206
whitelisted
crl.microsoft.com
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
clarmodq.top
malicious
zenithcorde.top
  • 104.21.51.232
  • 172.67.190.162
unknown
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.66
  • 20.190.160.65
  • 20.190.160.14
  • 20.190.160.132
  • 20.190.160.131
  • 20.190.160.67
  • 40.126.32.72
  • 20.190.160.20
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Suspected Domain Associated with Malware Distribution (clarmodq .top)
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clarmodq .top)
3300
961d1b515932a809fd3d404bf8fbc49f.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
3300
961d1b515932a809fd3d404bf8fbc49f.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
3300
961d1b515932a809fd3d404bf8fbc49f.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
3300
961d1b515932a809fd3d404bf8fbc49f.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
3300
961d1b515932a809fd3d404bf8fbc49f.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 31
3300
961d1b515932a809fd3d404bf8fbc49f.exe
Misc activity
ET INFO Packed Executable Download
7368
saved.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 31
No debug info