File name:

4363463463464363463463463.exe

Full analysis: https://app.any.run/tasks/dd287a42-9940-4d21-9395-37c18bf045f5
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: November 10, 2024, 14:59:21
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
github
evasion
lumma
stealer
opendir
loader
phorpiex
amadey
botnet
telegram
hausbomber
tas17
dcrat
xor-url
generic
miner
xworm
zharkbot
possible-phishing
stealc
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

2A94F3960C58C6E70826495F76D00B85

SHA1:

E2A1A5641295F5EBF01A37AC1C170AC0814BB71A

SHA256:

2FCAD226B17131DA4274E1B9F8F31359BDD325C9568665F08FD1F6C5D06A23CE

SSDEEP:

192:2we8sGKE6MqyG7c20L7BIW12n/ePSmzkTInu8stYcFwVc03KY:9e8sGKfMqyGg20PKn/cRaInuptYcFwVY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 7228)
      • powershell.exe (PID: 7488)
      • powershell.exe (PID: 8052)
      • powershell.exe (PID: 8652)

    • Adds path to the Windows Defender exclusion list

      • svchost.exe (PID: 4508)
      • sysklnorbcv.exe (PID: 7360)
      • cmd.exe (PID: 7984)
      • sysppvrdnvs.exe (PID: 7452)
      • cmd.exe (PID: 4812)
      • cmd.exe (PID: 8504)
      • sysvplervcs.exe (PID: 5032)

    • HAUSBOMBER has been detected (YARA)

      • 4363463463464363463463463.exe (PID: 5956)

    • XORed URL has been found (YARA)

      • 4363463463464363463463463.exe (PID: 5956)

    • Adds process to the Windows Defender exclusion list

      • svchost.exe (PID: 4508)

    • DCRAT has been detected (YARA)

      • 4363463463464363463463463.exe (PID: 5956)

    • Uses Task Scheduler to run other applications

      • svchost.exe (PID: 4508)
      • rage.exe (PID: 4872)
      • ravage.exe (PID: 4948)

    • XWORM has been detected (YARA)

      • XClient.exe (PID: 6704)

    • TAS17 has been detected

      • Mswgoudnv.exe (PID: 8352)

    • LUMMA has been detected (SURICATA)

      • ktyhpldea.exe (PID: 6176)
      • svchost.exe (PID: 2172)

    • PHORPIEX has been detected (SURICATA)

      • svchost.exe (PID: 2172)
      • sysklnorbcv.exe (PID: 7360)
      • 4363463463464363463463463.exe (PID: 5956)
      • sysppvrdnvs.exe (PID: 7452)

    • Connects to the CnC server

      • svchost.exe (PID: 2172)
      • sysklnorbcv.exe (PID: 7360)
      • defnur.exe (PID: 7684)
      • sysppvrdnvs.exe (PID: 7452)

    • AMADEY has been detected (SURICATA)

      • defnur.exe (PID: 7684)

    • Stealers network behavior

      • ktyhpldea.exe (PID: 6176)

    • Changes powershell execution policy (Bypass)

      • svchost.exe (PID: 4508)

    • Antivirus name has been found in the command line (generic signature)

      • findstr.exe (PID: 7984)
      • findstr.exe (PID: 6876)

    • Uses Task Scheduler to autorun other applications

      • cmd.exe (PID: 8644)

    • Starts NET.EXE for service management

      • stail.tmp (PID: 6524)
      • net.exe (PID: 6940)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • t1.exe (PID: 6392)
      • 4363463463464363463463463.exe (PID: 5956)
      • SLIRFA2KCXJ660GNIMB379DAOT.exe (PID: 7344)
      • 1968717183.exe (PID: 7856)
      • rorukal.exe (PID: 5564)
      • svchost.exe (PID: 4508)
      • defnur.exe (PID: 7684)
      • Mswgoudnv.exe (PID: 5948)
      • Mswgoudnv.exe (PID: 8352)
      • npp.exe (PID: 4684)
      • ktyhpldea.exe (PID: 6176)
      • 1253516836.exe (PID: 8596)
      • 1313110010.exe (PID: 9168)
      • mm.exe (PID: 8408)
      • random.exe (PID: 8480)
      • t.exe (PID: 4772)
      • winupsecvmgr.exe (PID: 5296)
      • file.exe (PID: 6268)
      • SteamDetector.exe (PID: 8984)
      • SteamDetector.exe (PID: 4708)
      • cmd.exe (PID: 3904)
      • rage.exe (PID: 4872)
      • Irons.exe (PID: 7600)
      • qsjxfirefkza.exe (PID: 7092)
      • aaa.exe (PID: 5036)
      • utility-inst.exe (PID: 4920)
      • 2020.exe (PID: 5396)
      • utility-inst.tmp (PID: 9016)
      • AllNew.exe (PID: 7720)
      • bildnewl.exe (PID: 6980)
      • msrv.exe (PID: 3824)
      • stail.tmp (PID: 6524)
      • stail.exe (PID: 2708)
      • videopresentmaker32.exe (PID: 4708)

    • Reads security settings of Internet Explorer

      • 4363463463464363463463463.exe (PID: 5956)

    • Executes application which crashes

      • XClient.exe (PID: 6704)
      • ktyhpldea.exe (PID: 6176)
      • cmd.exe (PID: 8012)
      • AppLaunch.exe (PID: 8024)
      • cmd.exe (PID: 6104)
      • cmd.exe (PID: 8008)
      • AppLaunch.exe (PID: 8072)
      • AppLaunch.exe (PID: 8828)
      • cmd.exe (PID: 8168)
      • AppLaunch.exe (PID: 2780)

    • Script adds exclusion path to Windows Defender

      • svchost.exe (PID: 4508)
      • cmd.exe (PID: 7984)
      • cmd.exe (PID: 4812)
      • cmd.exe (PID: 8504)

    • Starts itself from another location

      • SLIRFA2KCXJ660GNIMB379DAOT.exe (PID: 7344)
      • 1968717183.exe (PID: 7856)
      • t1.exe (PID: 6392)
      • t.exe (PID: 4772)
      • file.exe (PID: 6268)
      • SteamDetector.exe (PID: 4708)
      • rage.exe (PID: 4872)
      • AllNew.exe (PID: 7720)

    • Starts CMD.EXE for commands execution

      • sysklnorbcv.exe (PID: 7360)
      • sysppvrdnvs.exe (PID: 7452)
      • AppLaunch.exe (PID: 7568)
      • 188431998.exe (PID: 8396)
      • rorukal.exe (PID: 5564)
      • 1257610417.exe (PID: 7884)
      • PctOccurred.exe (PID: 4792)
      • sysvplervcs.exe (PID: 5032)
      • cmd.exe (PID: 3904)
      • 2020.exe (PID: 7344)
      • utility-inst.tmp (PID: 9016)
      • msrv.exe (PID: 3824)

    • Manipulates environment variables

      • powershell.exe (PID: 8076)
      • powershell.exe (PID: 7340)
      • powershell.exe (PID: 3964)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 7984)
      • cmd.exe (PID: 4812)
      • svchost.exe (PID: 4508)
      • 1313110010.exe (PID: 9168)
      • winupsecvmgr.exe (PID: 5296)
      • cmd.exe (PID: 8504)

    • Script adds exclusion process to Windows Defender

      • svchost.exe (PID: 4508)

    • Application launched itself

      • AppLaunch.exe (PID: 8024)
      • Mswgoudnv.exe (PID: 5948)
      • AppLaunch.exe (PID: 8072)
      • AppLaunch.exe (PID: 1604)
      • AppLaunch.exe (PID: 4848)
      • AppLaunch.exe (PID: 3076)
      • AppLaunch.exe (PID: 4952)
      • AppLaunch.exe (PID: 8828)
      • AppLaunch.exe (PID: 2780)
      • AppLaunch.exe (PID: 9208)
      • AppLaunch.exe (PID: 2736)
      • AppLaunch.exe (PID: 5404)
      • AppLaunch.exe (PID: 6300)
      • pimer_bbbcontents7.exe (PID: 8468)
      • jarg.exe (PID: 6612)
      • cmd.exe (PID: 3904)
      • 2020.exe (PID: 5396)
      • golden.exe (PID: 4812)

    • Process drops legitimate windows executable

      • rorukal.exe (PID: 5564)
      • 2020.exe (PID: 5396)
      • stail.tmp (PID: 6524)
      • 4363463463464363463463463.exe (PID: 5956)

    • Likely accesses (executes) a file from the Public directory

      • cmd.exe (PID: 7520)

    • Uses TASKKILL.EXE to kill process

      • AppLaunch.exe (PID: 7568)
      • aaa.exe (PID: 5036)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 7440)
      • cmd.exe (PID: 8072)
      • cmd.exe (PID: 3844)
      • cmd.exe (PID: 7520)
      • cmd.exe (PID: 7508)

    • The process executes via Task Scheduler

      • defnur.exe (PID: 9080)
      • System.exe (PID: 9200)
      • winupsecvmgr.exe (PID: 5296)
      • defnur.exe (PID: 3600)
      • System.exe (PID: 1604)
      • jarg.exe (PID: 6612)
      • System.exe (PID: 4816)
      • jarg.exe (PID: 1156)
      • ravage.exe (PID: 1344)
      • defnur.exe (PID: 3948)
      • jarg.exe (PID: 7592)
      • Gxtuum.exe (PID: 8868)
      • defnur.exe (PID: 7424)

    • Contacting a server suspected of hosting an CnC

      • ktyhpldea.exe (PID: 6176)
      • svchost.exe (PID: 2172)
      • defnur.exe (PID: 7684)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 8412)
      • cmd.exe (PID: 8644)

    • Checks for external IP

      • svchost.exe (PID: 2172)
      • XClient.exe (PID: 6704)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 8536)
      • schtasks.exe (PID: 8736)

    • Connects to unusual port

      • 4363463463464363463463463.exe (PID: 5956)
      • AI2.exe (PID: 3912)
      • newbundle.exe (PID: 4380)
      • svchost.exe (PID: 4508)
      • payload.exe (PID: 4956)

    • Potential Corporate Privacy Violation

      • 4363463463464363463463463.exe (PID: 5956)
      • ktyhpldea.exe (PID: 6176)
      • npp.exe (PID: 4684)
      • svchost.exe (PID: 2172)
      • defnur.exe (PID: 7684)

    • Connects to the server without a host name

      • sysppvrdnvs.exe (PID: 7452)
      • 4363463463464363463463463.exe (PID: 5956)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • svchost.exe (PID: 4508)

    • Executing commands from a ".bat" file

      • rorukal.exe (PID: 5564)
      • utility-inst.tmp (PID: 9016)
      • msrv.exe (PID: 3824)

    • Process requests binary or script from the Internet

      • 4363463463464363463463463.exe (PID: 5956)

    • Drops a system driver (possible attempt to evade defenses)

      • winupsecvmgr.exe (PID: 5296)
      • qsjxfirefkza.exe (PID: 7092)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • SteamDetector.exe (PID: 8984)

    • Executing commands from ".cmd" file

      • PctOccurred.exe (PID: 4792)

    • Get information on the list of running processes

      • cmd.exe (PID: 3904)

    • The executable file from the user directory is run by the CMD process

      • Restructuring.pif (PID: 6300)
      • winfile.exe (PID: 2380)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 3904)

    • Starts application with an unusual extension

      • cmd.exe (PID: 3904)
      • explorer.exe (PID: 3700)

    • The process drops C-runtime libraries

      • 2020.exe (PID: 5396)
      • stail.tmp (PID: 6524)

    • Uses powercfg.exe to modify the power settings

      • Irons.exe (PID: 7600)
      • qsjxfirefkza.exe (PID: 7092)

    • Executes as Windows Service

      • qsjxfirefkza.exe (PID: 7092)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • aaa.exe (PID: 5036)

    • Process drops python dynamic module

      • 2020.exe (PID: 5396)

    • Starts SC.EXE for service management

      • Irons.exe (PID: 7600)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 7844)

    • Starts a Microsoft application from unusual location

      • crypted8888.exe (PID: 8696)

  • INFO

    • Reads the computer name

      • 4363463463464363463463463.exe (PID: 5956)

    • Reads the machine GUID from the registry

      • 4363463463464363463463463.exe (PID: 5956)

    • Disables trace logs

      • 4363463463464363463463463.exe (PID: 5956)

    • The process uses the downloaded file

      • 4363463463464363463463463.exe (PID: 5956)

    • Checks proxy server information

      • 4363463463464363463463463.exe (PID: 5956)

    • Process checks computer location settings

      • 4363463463464363463463463.exe (PID: 5956)

    • Checks supported languages

      • 4363463463464363463463463.exe (PID: 5956)

    • Reads the software policy settings

      • 4363463463464363463463463.exe (PID: 5956)

    • Attempting to use instant messaging service

      • svchost.exe (PID: 4508)
      • svchost.exe (PID: 2172)

    • Creates a new folder

      • cmd.exe (PID: 7264)

    • Checks operating system version

      • 2020.exe (PID: 7344)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

xor-url

(PID) Process(5956) 4363463463464363463463463.exe
Decrypted-URLs (1)http://www.enigmaprotector.com/

XWorm

(PID) Process(6704) XClient.exe
C2return-carol.gl.at.ply.gg:53275
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameXWorm V5.6
MutexJw38N4UjbGjLvbSc
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:12:22 08:29:10+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 80
CodeSize: 5632
InitializedDataSize: 4608
UninitializedDataSize: -
EntryPoint: 0x3552
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 0.0.0.0
InternalName: 4363463463464363463463463.exe
LegalCopyright:
OriginalFileName: 4363463463464363463463463.exe
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
495
Monitored processes
327
Malicious processes
19
Suspicious processes
15

Behavior graph

Click at the process to see the details
start #DCRAT 4363463463464363463463463.exe conhost.exe no specs #XWORM xclient.exe werfault.exe #LUMMA svchost.exe #LUMMA ktyhpldea.exe rorukal.exe rundll32.exe no specs svchost.exe payload.exe ai2.exe npp.exe t1.exe newbundle.exe mswgoudnv.exe powershell.exe no specs conhost.exe no specs slirfa2kcxj660gnimb379daot.exe #PHORPIEX sysklnorbcv.exe werfault.exe #AMADEY defnur.exe 1968717183.exe cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs #PHORPIEX sysppvrdnvs.exe powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs forfiles.exe no specs conhost.exe no specs cmd.exe applaunch.exe no specs applaunch.exe no specs applaunch.exe conhost.exe no specs werfault.exe applaunch.exe no specs werfault.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs powershell.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs rundll32.exe defnur.exe system.exe no specs #TAS17 mswgoudnv.exe 188431998.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs schtasks.exe no specs 3061925726.exe no specs cmd.exe applaunch.exe no specs applaunch.exe no specs conhost.exe no specs applaunch.exe no specs werfault.exe no specs 1253516836.exe cmd.exe applaunch.exe no specs applaunch.exe conhost.exe no specs applaunch.exe no specs werfault.exe no specs werfault.exe no specs cmd.exe applaunch.exe no specs applaunch.exe conhost.exe no specs applaunch.exe no specs werfault.exe no specs werfault.exe no specs 1313110010.exe cmd.exe no specs applaunch.exe conhost.exe no specs applaunch.exe no specs werfault.exe no specs cmd.exe no specs applaunch.exe no specs conhost.exe no specs applaunch.exe no specs cmd.exe no specs applaunch.exe no specs conhost.exe no specs applaunch.exe no specs cmd.exe no specs applaunch.exe no specs applaunch.exe no specs conhost.exe no specs applaunch.exe no specs cmd.exe no specs applaunch.exe no specs conhost.exe no specs applaunch.exe no specs cmd.exe no specs applaunch.exe no specs conhost.exe no specs applaunch.exe no specs cmd.exe no specs applaunch.exe no specs applaunch.exe no specs applaunch.exe no specs conhost.exe no specs applaunch.exe no specs cmd.exe no specs applaunch.exe no specs conhost.exe no specs applaunch.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs winupsecvmgr.exe mm.exe lockapp.exe no specs conhost.exe no specs server.exe no specs random.exe sthealthupdate.exe no specs pimer_bbbcontents7.exe no specs accounts.exe no specs pimer_bbbcontents7.exe no specs powershell.exe no specs conhost.exe no specs tms_c025.exe no specs conhost.exe no specs dwm.exe no specs t.exe regasm.exe no specs winbox.exe no specs bundle.exe no specs sysvplervcs.exe no specs steamdetector.exe file.exe defnur.exe no specs system.exe no specs jarg.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs powershell.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs remcos.exe no specs iexplore.exe no specs 1257610417.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs schtasks.exe no specs steamdetector.exe 108232040.exe no specs netsh.exe no specs conhost.exe no specs 900726023.exe no specs jarg.exe no specs pos_c036.exe no specs pctoccurred.exe no specs cmd.exe conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs restructuring.pif no specs choice.exe no specs tms_c019.exe no specs rage.exe schtasks.exe no specs conhost.exe no specs ravage.exe no specs schtasks.exe no specs cayv0deo9jst417.exe no specs conhost.exe no specs consoleapp3.exe no specs conhost.exe no specs clip.exe no specs 2020.exe kill.exe no specs 2020.exe no specs irons.exe cmd.exe no specs conhost.exe no specs clientcaller.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs qsjxfirefkza.exe powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs explorer.exe no specs aaa.exe explorer.exe no specs 12.exe no specs taskkill.exe no specs conhost.exe no specs lummnew.exe no specs bildnewl.exe taskkill.exe no specs conhost.exe no specs defnur.exe no specs system.exe no specs jarg.exe no specs ravage.exe no specs sgn.exe no specs utility-inst.exe utility-inst.tmp allnew.exe cmd.exe no specs msrv.exe conhost.exe no specs pi.exe no specs gxtuum.exe no specs fping.exe no specs conhost.exe no specs m.exe no specs ji2xlo1f.exe no specs client-built.exe no specs blackload.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs restructuring.pif no specs conhost.exe no specs xyaw4fkp.exe no specs schtasks.exe no specs timeout.exe no specs stail.exe stail.tmp winfile.exe no specs net.exe no specs videopresentmaker32.exe conhost.exe no specs net1.exe no specs pos_product.exe no specs jarg.exe no specs golden.exe no specs conhost.exe no specs bitlockertogo.exe no specs golden.exe no specs 1188%e7%83%88%e7%84%b0.exe no specs crypted8888.exe no specs regasm.exe no specs new_v8.exe no specs cookie250.exe no specs s%d0%b5tu%d1%80111.exe no specs crypted.exe no specs jarg.exe no specs gxtuum.exe no specs defnur.exe no specs 4363463463464363463463463.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
204\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
616\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—LockApp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
780cmd /c copy /b ..\Medicines + ..\While + ..\Remained + ..\Bs + ..\Ak + ..\Statistical + ..\Entity + ..\Autumn + ..\Scott + ..\Keyboards y C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
864\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—AppLaunch.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
1084sc stop DoSvc C:\Windows\SysWOW64\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1062
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\rpcrt4.dll
1156"C:\ProgramData\qnnk\jarg.exe"C:\ProgramData\qnnk\jarg.exe—svchost.exe
User:
admin
Integrity Level:
HIGH
Description:
Mswgoudnv
Exit code:
4294967295
Version:
1.0.0.0
1168\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1168/c echo "XClient.exe"C:\ProgramData\Microsoft\Windows\MSCaches\cmd.exe—forfiles.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225477
1176\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—4363463463464363463463463.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1344"C:\Users\admin\AppData\Local\Temp\243587562342\ravage.exe"C:\Users\admin\AppData\Local\Temp\243587562342\ravage.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Total events
62 858
Read events
62 632
Write events
187
Delete events
39

Modification events

(PID) Process:(5956) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5956) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5956) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(5956) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(5956) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(5956) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(5956) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(5956) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5956) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5956) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
138
Suspicious files
114
Text files
76
Unknown types
4

Dropped files

PID
Process
Filename
Type
4224WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD097.tmp.dmpbinary
MD5:33A15ECBCA5DBCBB73974AF31BD65496
SHA256:D9EF6A6FFB0FB7B0286EC68D9FFF5652686E92534E12A04CE7EF443AEB0AC851
59564363463463464363463463463.exeC:\Users\admin\Desktop\Files\rorukal.exeexecutable
MD5:77ECAFEE1B0BA32BD4E3B90B6D92A81F
SHA256:14D8C36FBAB22C95764169E90E4985F90A171B201BB206BD6EA8883B492083E3
59564363463463464363463463463.exeC:\Users\admin\Desktop\Files\svchost.exeexecutable
MD5:9CF77B2EAFC2CD5D83F532A000BCC027
SHA256:4EBD059D8911B34EAF488D8B938D8EEE6B3F27B4DAD1CA527481348BA6EDE012
4224WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD220.tmp.xmlxml
MD5:885EA9346E201F16B5E18C347D48BECC
SHA256:A7C5945CF8FB6AFD5CE5B120C9503642FDE25156453D3A6C2C83172C5E84D6A1
59564363463463464363463463463.exeC:\Users\admin\Desktop\Files\ktyhpldea.exeexecutable
MD5:E9A83661D98FCA881CD4497A985A20DE
SHA256:F8DBFF120F44CF68BCB802C11F24BBC506F11803E8745883A0F650DECEA1DB47
4224WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD1FF.tmp.WERInternalMetadata.xmlxml
MD5:8330FC2998224DFCCF50EF2F4B9CA10E
SHA256:6896012072952D81DF75BAC3367E3AD257610E041AFCFC7199FB52F2F8A0DFE3
59564363463463464363463463463.exeC:\Users\admin\Desktop\Files\AI2.exeexecutable
MD5:34684DDF1DEAABE5F923E130DBA8C260
SHA256:61E53470EDE2379E70259853CB6B4727CB5BF519DFFF5ED643F22EB9B81C12CD
59564363463463464363463463463.exeC:\Users\admin\Desktop\Files\newbundle.exeexecutable
MD5:58E8B2EB19704C5A59350D4FF92E5AB6
SHA256:07D4B7768E13D79AC5F05F81167B29BB6FBF97828A289D8D11EEC38939846834
59564363463463464363463463463.exeC:\Users\admin\Desktop\Files\npp.exeexecutable
MD5:8D8E6C7952A9DC7C0C73911C4DBC5518
SHA256:FEB4C3AE4566F0ACBB9E0F55417B61FEFD89DC50A4E684DF780813FB01D61278
59564363463463464363463463463.exeC:\Users\admin\Desktop\Files\Mswgoudnv.exeexecutable
MD5:DE64BB0F39113E48A8499D3401461CF8
SHA256:64B58794801F282E92571676E3571AFC5C59033C262406BF0D36E1D6EF3CDA6A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
110
TCP/UDP connections
502
DNS requests
156
Threats
339

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6704
XClient.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
shared
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1880
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5956
4363463463464363463463463.exe
GET
200
185.215.113.217:80
http://185.215.113.217/inc/rorukal.exe
unknown
—
—
unknown
5956
4363463463464363463463463.exe
GET
200
144.34.162.13:80
http://144.34.162.13/payload.exe
unknown
—
—
unknown
5956
4363463463464363463463463.exe
GET
200
185.215.113.16:80
http://185.215.113.16/inc/AI2.exe
unknown
—
—
unknown
5956
4363463463464363463463463.exe
GET
200
185.215.113.66:80
http://rddissisifigifidi.net/npp.exe
unknown
—
—
malicious
5956
4363463463464363463463463.exe
GET
200
185.215.113.66:80
http://deauduafzgezzfgm.top/t1.exe
unknown
—
—
malicious
5956
4363463463464363463463463.exe
GET
200
185.215.113.16:80
http://185.215.113.16/inc/newbundle.exe
unknown
—
—
unknown
5956
4363463463464363463463463.exe
GET
200
185.215.113.217:80
http://185.215.113.217/inc/Mswgoudnv.exe
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5640
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5488
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
—
—
151.101.2.49:443
urlhaus.abuse.ch
FASTLY
US
whitelisted
—
—
185.199.108.133:443
raw.githubusercontent.com
FASTLY
US
unknown
—
—
185.234.216.143:443
—
—
RU
unknown
6704
XClient.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
shared
1880
svchost.exe
40.126.31.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.174
whitelisted
urlhaus.abuse.ch
  • 151.101.2.49
  • 151.101.66.49
  • 151.101.130.49
  • 151.101.194.49
whitelisted
raw.githubusercontent.com
  • 185.199.108.133
  • 185.199.110.133
  • 185.199.111.133
  • 185.199.109.133
shared
ip-api.com
  • 208.95.112.1
shared
login.live.com
  • 40.126.31.67
  • 20.190.159.75
  • 20.190.159.4
  • 40.126.31.69
  • 20.190.159.73
  • 20.190.159.23
  • 20.190.159.0
  • 20.190.159.2
whitelisted
www.bing.com
  • 2.23.209.135
  • 2.23.209.141
  • 2.23.209.160
  • 2.23.209.150
  • 2.23.209.140
  • 2.23.209.149
  • 2.23.209.161
  • 2.23.209.158
  • 2.23.209.133
  • 2.23.209.176
  • 2.23.209.177
  • 104.126.37.131
  • 104.126.37.130
  • 104.126.37.139
  • 104.126.37.186
  • 104.126.37.128
  • 104.126.37.177
  • 104.126.37.153
  • 104.126.37.185
  • 104.126.37.123
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
th.bing.com
  • 2.23.209.160
  • 2.23.209.141
  • 2.23.209.140
  • 2.23.209.176
  • 2.23.209.161
  • 2.23.209.150
  • 2.23.209.177
  • 2.23.209.149
  • 2.23.209.158
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted

Threats

PID
Process
Class
Message
2172
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
5956
4363463463464363463463463.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 33
2172
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2172
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
6704
XClient.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
6704
XClient.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
5956
4363463463464363463463463.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
5956
4363463463464363463463463.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
5956
4363463463464363463463463.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
5956
4363463463464363463463463.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
41 ETPRO signatures available at the full report
Process
Message
XClient.exe
CLR: Managed code called FailFast without specifying a reason.
4363463463464363463463463.exe
The specified executable is not a valid application for this OS platform.
SLIRFA2KCXJ660GNIMB379DAOT.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
defnur.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
rorukal.exe
wanna die
defnur.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
4363463463464363463463463.exe