File name:

setup.exe

Full analysis: https://app.any.run/tasks/2525cb85-8a41-431d-ab95-a48047603cac
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: April 01, 2023, 01:29:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
loader
smoke
trojan
ransomware
stop
stealer
vidar
amadey
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

7EDFFCE5F01D5CCF4F72327802464FB4

SHA1:

42430DA4275E074D6C48B83B8F50480E20A85294

SHA256:

2C6674AEF75A5084066D49CCD81B0C309CCC1940DB9BD1FE866AD92264F431F4

SSDEEP:

3072:O87y1e0RVxuD+n4467soTdy7GcKK7+RKBRw0YtT5grsePM3VJ9m+X:t7zs5FCcKKaOU8rseEv9rX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 9F4.exe (PID: 1616)
      • 9F4.exe (PID: 680)
      • 9F4.exe (PID: 2252)
      • 9F4.exe (PID: 2096)
      • 1ED5.exe (PID: 2744)
      • 1ED5.exe (PID: 2872)
      • 1ED5.exe (PID: 2464)
      • build2.exe (PID: 2724)
      • 1ED5.exe (PID: 2852)
      • build2.exe (PID: 2288)
      • build3.exe (PID: 2444)
      • mstsca.exe (PID: 2296)
      • 38D6.exe (PID: 3020)
      • build2.exe (PID: 2860)
      • build2.exe (PID: 2216)
      • build3.exe (PID: 2540)
      • nbveek.exe (PID: 2612)
      • ss31.exe (PID: 2184)
      • XandETC.exe (PID: 2868)
      • XandETC.exe (PID: 2868)
      • 4867.exe (PID: 2580)
      • Player3.exe (PID: 2892)

    • SMOKE was detected

      • explorer.exe (PID: 1928)

    • Runs injected code in another process

      • setup.exe (PID: 1036)

    • Application was injected by another process

      • explorer.exe (PID: 1928)

    • Connects to the CnC server

      • explorer.exe (PID: 1928)
      • build2.exe (PID: 2288)
      • ss31.exe (PID: 2184)
      • build2.exe (PID: 2216)
      • nbveek.exe (PID: 2612)

    • Stop is detected

      • 9F4.exe (PID: 2252)
      • 1ED5.exe (PID: 2852)

    • Uses Task Scheduler to run other applications

      • build3.exe (PID: 2444)
      • mstsca.exe (PID: 2296)
      • nbveek.exe (PID: 2612)

    • Steals credentials from Web Browsers

      • build2.exe (PID: 2288)
      • build2.exe (PID: 2216)

    • VIDAR was detected

      • build2.exe (PID: 2288)
      • build2.exe (PID: 2216)

    • Changes the autorun value in the registry

      • nbveek.exe (PID: 2612)

    • Actions looks like stealing of personal data

      • ss31.exe (PID: 2184)
      • build2.exe (PID: 2288)
      • build2.exe (PID: 2216)

    • Starts CMD.EXE for self-deleting

      • build2.exe (PID: 2288)
      • build2.exe (PID: 2216)

    • AMADEY was detected

      • nbveek.exe (PID: 2612)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • explorer.exe (PID: 1928)
      • 9F4.exe (PID: 1616)
      • 9F4.exe (PID: 2252)
      • build3.exe (PID: 2444)
      • build2.exe (PID: 2288)
      • 1ED5.exe (PID: 2852)
      • 4867.exe (PID: 2580)
      • Player3.exe (PID: 2892)

    • Reads the Internet Settings

      • explorer.exe (PID: 1928)
      • 9F4.exe (PID: 1616)
      • 9F4.exe (PID: 2252)
      • 1ED5.exe (PID: 2872)
      • 1ED5.exe (PID: 2852)
      • build2.exe (PID: 2288)
      • 4867.exe (PID: 2580)
      • Player3.exe (PID: 2892)
      • ss31.exe (PID: 2184)
      • nbveek.exe (PID: 2612)
      • build2.exe (PID: 2216)

    • Application launched itself

      • 9F4.exe (PID: 680)
      • 9F4.exe (PID: 1616)
      • 9F4.exe (PID: 2096)
      • 1ED5.exe (PID: 2744)
      • 1ED5.exe (PID: 2872)
      • 1ED5.exe (PID: 2464)
      • build2.exe (PID: 2724)
      • build2.exe (PID: 2860)
      • cmd.exe (PID: 2708)

    • Reads security settings of Internet Explorer

      • 9F4.exe (PID: 1616)
      • 9F4.exe (PID: 2252)
      • 1ED5.exe (PID: 2872)
      • 1ED5.exe (PID: 2852)
      • build2.exe (PID: 2288)
      • build2.exe (PID: 2216)

    • Checks Windows Trust Settings

      • 9F4.exe (PID: 1616)
      • 9F4.exe (PID: 2252)
      • 1ED5.exe (PID: 2872)
      • 1ED5.exe (PID: 2852)
      • build2.exe (PID: 2288)
      • build2.exe (PID: 2216)

    • Reads settings of System Certificates

      • 9F4.exe (PID: 1616)
      • 9F4.exe (PID: 2252)
      • 1ED5.exe (PID: 2872)
      • 1ED5.exe (PID: 2852)
      • build2.exe (PID: 2288)
      • build2.exe (PID: 2216)
      • ss31.exe (PID: 2184)

    • Process requests binary or script from the Internet

      • explorer.exe (PID: 1928)
      • 9F4.exe (PID: 2252)
      • 1ED5.exe (PID: 2852)
      • nbveek.exe (PID: 2612)

    • Uses ICACLS.EXE to modify access control lists

      • 9F4.exe (PID: 1616)
      • cmd.exe (PID: 2708)

    • Adds/modifies Windows certificates

      • 9F4.exe (PID: 2096)

    • The process executes via Task Scheduler

      • mstsca.exe (PID: 2296)
      • jbhtujv (PID: 2324)

    • Connects to the server without a host name

      • build2.exe (PID: 2288)
      • explorer.exe (PID: 1928)
      • nbveek.exe (PID: 2612)
      • build2.exe (PID: 2216)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • build2.exe (PID: 2288)
      • build2.exe (PID: 2216)

    • Reads browser cookies

      • build2.exe (PID: 2288)

    • Searches for installed software

      • build2.exe (PID: 2288)
      • build2.exe (PID: 2216)

    • Starts itself from another location

      • Player3.exe (PID: 2892)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 2708)
      • nbveek.exe (PID: 2612)
      • build2.exe (PID: 2288)
      • build2.exe (PID: 2216)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 2736)
      • cmd.exe (PID: 2620)

  • INFO

    • Checks supported languages

      • setup.exe (PID: 1036)
      • 9F4.exe (PID: 680)
      • 9F4.exe (PID: 1616)
      • 9F4.exe (PID: 2252)
      • 9F4.exe (PID: 2096)
      • 1ED5.exe (PID: 2744)
      • 1ED5.exe (PID: 2872)
      • build2.exe (PID: 2724)
      • 1ED5.exe (PID: 2464)
      • 1ED5.exe (PID: 2852)
      • build2.exe (PID: 2288)
      • build3.exe (PID: 2444)
      • build2.exe (PID: 2216)
      • build2.exe (PID: 2860)
      • 38D6.exe (PID: 3020)
      • mstsca.exe (PID: 2296)
      • jbhtujv (PID: 2324)
      • 4867.exe (PID: 2580)
      • Player3.exe (PID: 2892)
      • build3.exe (PID: 2540)
      • nbveek.exe (PID: 2612)
      • ss31.exe (PID: 2184)
      • XandETC.exe (PID: 2868)

    • The process checks LSA protection

      • explorer.exe (PID: 1928)
      • 9F4.exe (PID: 1616)
      • 9F4.exe (PID: 2252)
      • icacls.exe (PID: 840)
      • 1ED5.exe (PID: 2872)
      • 1ED5.exe (PID: 2852)
      • build2.exe (PID: 2288)
      • 4867.exe (PID: 2580)
      • ss31.exe (PID: 2184)
      • nbveek.exe (PID: 2612)
      • Player3.exe (PID: 2892)
      • build2.exe (PID: 2216)

    • Creates files or folders in the user directory

      • explorer.exe (PID: 1928)
      • 9F4.exe (PID: 1616)
      • 9F4.exe (PID: 2252)
      • 1ED5.exe (PID: 2872)
      • 1ED5.exe (PID: 2852)
      • build3.exe (PID: 2444)
      • build2.exe (PID: 2288)
      • ss31.exe (PID: 2184)

    • Create files in a temporary directory

      • explorer.exe (PID: 1928)
      • 9F4.exe (PID: 1616)
      • Player3.exe (PID: 2892)
      • 4867.exe (PID: 2580)
      • nbveek.exe (PID: 2612)

    • Reads the computer name

      • 9F4.exe (PID: 1616)
      • 9F4.exe (PID: 2252)
      • 1ED5.exe (PID: 2872)
      • 1ED5.exe (PID: 2852)
      • build2.exe (PID: 2288)
      • build2.exe (PID: 2216)
      • 4867.exe (PID: 2580)
      • Player3.exe (PID: 2892)
      • ss31.exe (PID: 2184)
      • nbveek.exe (PID: 2612)

    • Checks proxy server information

      • 9F4.exe (PID: 1616)
      • 9F4.exe (PID: 2252)
      • 1ED5.exe (PID: 2872)
      • 1ED5.exe (PID: 2852)
      • build2.exe (PID: 2288)
      • ss31.exe (PID: 2184)
      • build2.exe (PID: 2216)
      • nbveek.exe (PID: 2612)

    • Reads the machine GUID from the registry

      • 9F4.exe (PID: 1616)
      • 9F4.exe (PID: 2252)
      • 1ED5.exe (PID: 2872)
      • 1ED5.exe (PID: 2852)
      • build2.exe (PID: 2288)
      • build2.exe (PID: 2216)
      • ss31.exe (PID: 2184)
      • nbveek.exe (PID: 2612)

    • Creates files in the program directory

      • build2.exe (PID: 2288)
      • build2.exe (PID: 2216)

    • Reads Environment values

      • build2.exe (PID: 2288)
      • build2.exe (PID: 2216)

    • Reads product name

      • build2.exe (PID: 2288)
      • build2.exe (PID: 2216)

    • Reads CPU info

      • build2.exe (PID: 2288)
      • build2.exe (PID: 2216)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

ProductName: Imba
LegalCopyright: Copyright (C) 2023, shmaer
InternalName: GodGuest
FilesVersion: 19.62.99
CharacterSet: Unknown (01F2)
LanguageCode: Manipuri
FileSubtype: -
ObjectFileType: Unknown
FileOS: Unknown (0x20461)
FileFlags: (none)
FileFlagsMask: 0x121a
ProductVersionNumber: 26.0.0.0
FileVersionNumber: 2.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 5
ImageVersion: -
OSVersion: 5
EntryPoint: 0x6130
UninitializedDataSize: -
InitializedDataSize: 494592
CodeSize: 172544
LinkerVersion: 9
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2022:07:04 17:25:21+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 04-Jul-2022 17:25:21
Detected languages:
  • Spanish - Mexico
Debug artifacts:
  • C:\geyogapexifam\neyoduho_nodavufu7 sinoluselib\me.pdb
FilesVersion: 19.62.99
InternalName: GodGuest
LegalCopyright: Copyright (C) 2023, shmaer
ProductName: Imba

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F0

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 04-Jul-2022 17:25:21
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0002A0F2
0x0002A200
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.54339
.data
0x0002C000
0x0006F69C
0x00003000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.21953
.rsrc
0x0009C000
0x000070C8
0x00007200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.65031
.reloc
0x000A4000
0x00002162
0x00002200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
3.91132

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.34304
460
UNKNOWN
UNKNOWN
RT_VERSION
2
4.9318
2216
UNKNOWN
Spanish - Mexico
RT_ICON
3
4.70078
1736
UNKNOWN
Spanish - Mexico
RT_ICON
4
4.24486
1384
UNKNOWN
Spanish - Mexico
RT_ICON
5
3.67313
9640
UNKNOWN
Spanish - Mexico
RT_ICON
6
3.76531
4264
UNKNOWN
Spanish - Mexico
RT_ICON
7
3.79629
2440
UNKNOWN
Spanish - Mexico
RT_ICON
8
3.90663
1128
UNKNOWN
Spanish - Mexico
RT_ICON
22
3.13936
412
UNKNOWN
UNKNOWN
RT_STRING
23
3.22078
620
UNKNOWN
UNKNOWN
RT_STRING

Imports

ADVAPI32.dll
GDI32.dll
KERNEL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
89
Monitored processes
41
Malicious processes
20
Suspicious processes
1

Behavior graph

Click at the process to see the details
inject start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start setup.exe #SMOKE explorer.exe 9f4.exe no specs 9f4.exe icacls.exe no specs 9f4.exe #STOP 9f4.exe 1ed5.exe no specs 1ed5.exe 1ed5.exe build2.exe no specs #STOP 1ed5.exe #VIDAR build2.exe build3.exe schtasks.exe no specs mstsca.exe no specs jbhtujv no specs schtasks.exe no specs build2.exe no specs 38d6.exe #VIDAR build2.exe build3.exe no specs 4867.exe player3.exe ss31.exe #AMADEY nbveek.exe xandetc.exe no specs schtasks.exe no specs cmd.exe no specs cmd.exe no specs cacls.exe no specs cacls.exe no specs xandetc.exe cmd.exe no specs cacls.exe no specs cacls.exe no specs cmd.exe no specs timeout.exe no specs cmd.exe no specs timeout.exe no specs setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
680C:\Users\admin\AppData\Local\Temp\9F4.exeC:\Users\admin\AppData\Local\Temp\9F4.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\9f4.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
840icacls "C:\Users\admin\AppData\Local\ad5dc5f1-4a31-4fcb-b5a0-068663754792" /deny *S-1-1-0:(OI)(CI)(DE,DC)C:\Windows\SysWOW64\icacls.exe—9F4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\icacls.exe
c:\windows\syswow64\ntdll.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1036"C:\Users\admin\AppData\Local\Temp\setup.exe" C:\Users\admin\AppData\Local\Temp\setup.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
1260"C:\Users\admin\AppData\Local\Temp\setup.exe" C:\Users\admin\AppData\Local\Temp\setup.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\setup.exe
1616C:\Users\admin\AppData\Local\Temp\9F4.exeC:\Users\admin\AppData\Local\Temp\9F4.exe
9F4.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\9f4.exe
c:\windows\syswow64\ntdll.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1928C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2096"C:\Users\admin\AppData\Local\Temp\9F4.exe" --Admin IsNotAutoStart IsNotTaskC:\Users\admin\AppData\Local\Temp\9F4.exe
9F4.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\9f4.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2152CACLS "nbveek.exe" /P "admin:R" /EC:\Windows\SysWOW64\cacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Control ACLs Program
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\cacls.exe
c:\windows\syswow64\ntdll.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2184"C:\Users\admin\AppData\Local\Temp\ss31.exe" C:\Users\admin\AppData\Local\Temp\ss31.exe
4867.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ss31.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2200C:\Windows\system32\cmd.exe /S /D /c" echo Y"C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\syswow64\ntdll.dll
c:\windows\syswow64\cmd.exe
c:\windows\system32\wow64.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Total events
21 222
Read events
20 866
Write events
356
Delete events
0

Modification events

(PID) Process:(1928) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB010000002C63AF80A6AE514E8E5F5AD740560F840000000002000000000010660000000100002000000014F75E68FD9F0032EAD326486AFD81C2AD59C520AFD5A9B887CB9846879B87B8000000000E80000000020000200000008DCBB1D1C897479C863F50EE0A2ABDFCD0F574B6E611956F0432D2F51AD53629300000000C69D971182631510AB82B185476A5C7DA1A7795B8E5B3D2D9D06CB3AE319A810E9A0E25CEDC5C2C5A15F19310402CE4400000007F5925DCD17884C8D2485712DF089C0A226AA7241BD86F02D6A04B70F2ACCBFFF3251679696BA5358D89C50BDDAE7C90E014A5726BBFEBDF634F9B64BA8F1619
(PID) Process:(1616) 9F4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1616) 9F4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000008B000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1616) 9F4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1616) 9F4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1616) 9F4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1616) 9F4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1616) 9F4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1616) 9F4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1616) 9F4.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\14C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
50
Suspicious files
26
Text files
8
Unknown types
30

Dropped files

PID
Process
Filename
Type
16169F4.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:—
SHA256:—
1928explorer.exeC:\Users\admin\AppData\Local\Temp\9F4.exeexecutable
MD5:—
SHA256:—
16169F4.exeC:\Users\admin\AppData\Local\ad5dc5f1-4a31-4fcb-b5a0-068663754792\9F4.exeexecutable
MD5:—
SHA256:—
16169F4.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\geo[1].jsonbinary
MD5:—
SHA256:—
22529F4.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\geo[1].jsonbinary
MD5:—
SHA256:—
1928explorer.exeC:\Users\admin\AppData\Roaming\jbhtujvexecutable
MD5:—
SHA256:—
1928explorer.exeC:\Users\admin\AppData\Local\Temp\1ED5.exeexecutable
MD5:—
SHA256:—
16169F4.exeC:\Users\admin\AppData\Local\Temp\CabF14.tmpcompressed
MD5:E71C8443AE0BC2E282C73FAEAD0A6DD3
SHA256:95B0A5ACC5BF70D3ABDFD091D0C9F9063AA4FDE65BD34DBF16786082E1992E72
16169F4.exeC:\Users\admin\AppData\Local\Temp\TarF15.tmpcat
MD5:BE2BEC6E8C5653136D3E72FE53C98AA3
SHA256:1919AAB2A820642490169BDC4E88BD1189E22F83E7498BF8EBDFB62EC7D843FD
28521ED5.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\geo[1].jsonbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
31
TCP/UDP connections
22
DNS requests
13
Threats
823

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2288
build2.exe
GET
—
78.47.168.170:80
http://78.47.168.170/steam.zip
DE
—
—
malicious
2288
build2.exe
GET
200
78.47.168.170:80
http://78.47.168.170/
DE
text
211 b
malicious
2852
1ED5.exe
GET
200
190.141.123.88:80
http://uaery.top/dl/build2.exe
PA
executable
416 Kb
malicious
1928
explorer.exe
POST
404
188.114.96.3:80
http://potunulit.org/
US
binary
41 b
malicious
1928
explorer.exe
POST
404
188.114.96.3:80
http://potunulit.org/
US
binary
750 Kb
malicious
1928
explorer.exe
GET
200
190.141.123.88:80
http://uaery.top/dl/build.exe
PA
executable
759 Kb
malicious
1928
explorer.exe
POST
404
188.114.96.3:80
http://potunulit.org/
US
binary
218 Kb
malicious
1928
explorer.exe
POST
404
188.114.96.3:80
http://potunulit.org/
US
binary
50 b
malicious
1928
explorer.exe
GET
200
45.9.74.80:80
http://45.9.74.80/power.exe
SC
executable
4.37 Mb
malicious
2252
9F4.exe
GET
200
58.235.189.192:80
http://zexeq.com/files/1/build3.exe
KR
executable
9.50 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
188.114.96.3:80
potunulit.org
CLOUDFLARENET
NL
malicious
1928
explorer.exe
190.141.123.88:80
uaery.top
Cable Onda
PA
malicious
1616
9F4.exe
162.0.217.254:443
api.2ip.ua
NAMECHEAP-NET
NL
suspicious
1616
9F4.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted
2252
9F4.exe
190.141.123.88:80
uaery.top
Cable Onda
PA
malicious
2872
1ED5.exe
162.0.217.254:443
api.2ip.ua
NAMECHEAP-NET
NL
suspicious
2252
9F4.exe
58.235.189.192:80
uaery.top
SK Broadband Co Ltd
KR
malicious
2852
1ED5.exe
162.0.217.254:443
api.2ip.ua
NAMECHEAP-NET
NL
suspicious
2852
1ED5.exe
190.141.123.88:80
uaery.top
Cable Onda
PA
malicious
2288
build2.exe
149.154.167.99:443
t.me
Telegram Messenger Inc
GB
malicious

DNS requests

Domain
IP
Reputation
potunulit.org
  • 188.114.96.3
  • 188.114.97.3
malicious
uaery.top
  • 190.141.123.88
  • 58.235.189.192
  • 175.120.254.9
  • 210.182.29.70
  • 84.224.34.240
  • 211.40.39.251
  • 95.158.162.200
  • 222.236.49.123
  • 195.158.3.162
  • 175.126.109.15
malicious
api.2ip.ua
  • 162.0.217.254
shared
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
zexeq.com
  • 58.235.189.192
  • 211.171.233.129
  • 84.224.34.240
  • 80.210.25.252
  • 175.126.109.15
  • 190.140.74.43
  • 211.53.230.67
  • 175.120.254.9
  • 187.170.146.118
  • 211.59.14.90
malicious
aainvestment.org
  • —
malicious
t.me
  • 149.154.167.99
whitelisted
bz.bbbeioaag.com
  • 45.66.158.126
malicious
www.facebook.com
  • 157.240.20.35
whitelisted
count.iiagjaggg.com
  • 154.221.31.191
malicious

Threats

PID
Process
Class
Message
1928
explorer.exe
A Network Trojan was detected
ET MALWARE Suspected Smokeloader Activity (POST)
1928
explorer.exe
A Network Trojan was detected
ET MALWARE Suspected Smokeloader Activity (POST)
1928
explorer.exe
A Network Trojan was detected
ET MALWARE Suspected Smokeloader Activity (POST)
—
—
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
1928
explorer.exe
A Network Trojan was detected
ET MALWARE Suspected Smokeloader Activity (POST)
—
—
Device Retrieving External IP Address Detected
ET POLICY External IP Address Lookup DNS Query (2ip .ua)
1616
9F4.exe
Potentially Bad Traffic
ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)
1616
9F4.exe
Unknown Traffic
ET JA3 Hash - [Abuse.ch] Possible Tofsee
1928
explorer.exe
A Network Trojan was detected
ET HUNTING SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016
1928
explorer.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
13 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
setup.exe