File name:

4363463463464363463463463.bin

Full analysis: https://app.any.run/tasks/fc80e283-67a8-4c85-8382-d3687258194f
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: January 10, 2024, 13:20:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
redline
loader
hausbomber
opendir
stealc
guloader
rhadamanthys
kelihos
trojan
gcleaner
amadey
botnet
keylogger
payload
rat
backdoor
dcrat
remote
phorpiex
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

2A94F3960C58C6E70826495F76D00B85

SHA1:

E2A1A5641295F5EBF01A37AC1C170AC0814BB71A

SHA256:

2FCAD226B17131DA4274E1B9F8F31359BDD325C9568665F08FD1F6C5D06A23CE

SSDEEP:

192:2we8sGKE6MqyG7c20L7BIW12n/ePSmzkTInu8stYcFwVc03KY:9e8sGKfMqyGg20PKn/cRaInuptYcFwVY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Steals credentials from Web Browsers

      • flesh.exe (PID: 584)

    • Create files in the Startup directory

      • flesh.exe (PID: 584)

    • HAUSBOMBER has been detected (YARA)

      • 4363463463464363463463463.bin.exe (PID: 2064)
      • 4363463463464363463463463.bin.exe (PID: 1748)

    • Actions looks like stealing of personal data

      • flesh.exe (PID: 584)
      • pinf.exe (PID: 2036)

    • Adds process to the Windows Defender exclusion list

      • Gang.exe (PID: 2300)

    • UAC/LUA settings modification

      • Gang.exe (PID: 2300)

    • Starts CMD.EXE for self-deleting

      • a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe (PID: 2964)

    • Detected an obfuscated command line used with Guloader

      • powershell.exe (PID: 4648)

  • SUSPICIOUS

    • Reads the Internet Settings

      • 4363463463464363463463463.bin.exe (PID: 2064)
      • flesh.exe (PID: 584)
      • 4363463463464363463463463.bin.exe (PID: 1748)
      • 4363463463464363463463463.bin.exe (PID: 2660)
      • 4363463463464363463463463.bin.exe (PID: 2892)
      • 4363463463464363463463463.bin.exe (PID: 2532)
      • 4363463463464363463463463.bin.exe (PID: 3068)
      • 4363463463464363463463463.bin.exe (PID: 1408)
      • 4363463463464363463463463.bin.exe (PID: 3136)
      • 4363463463464363463463463.bin.exe (PID: 3200)
      • 4363463463464363463463463.bin.exe (PID: 3388)
      • 4363463463464363463463463.bin.exe (PID: 3792)
      • 4363463463464363463463463.bin.exe (PID: 3904)
      • 4363463463464363463463463.bin.exe (PID: 4020)
      • 4363463463464363463463463.bin.exe (PID: 1592)
      • timeSync.exe (PID: 1740)
      • 4363463463464363463463463.bin.exe (PID: 3284)
      • 4363463463464363463463463.bin.exe (PID: 3044)
      • 4363463463464363463463463.bin.exe (PID: 2560)
      • 4363463463464363463463463.bin.exe (PID: 3844)
      • 4363463463464363463463463.bin.exe (PID: 2244)
      • 4363463463464363463463463.bin.exe (PID: 3144)
      • 4363463463464363463463463.bin.exe (PID: 2812)
      • 4363463463464363463463463.bin.exe (PID: 2168)
      • Gang.exe (PID: 2300)
      • 4363463463464363463463463.bin.exe (PID: 4284)
      • powershell.exe (PID: 1832)
      • a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe (PID: 2964)
      • 4363463463464363463463463.bin.exe (PID: 4564)
      • 4363463463464363463463463.bin.exe (PID: 4708)
      • 4363463463464363463463463.bin.exe (PID: 4872)
      • 4363463463464363463463463.bin.exe (PID: 4992)
      • 4363463463464363463463463.bin.exe (PID: 5212)
      • 4363463463464363463463463.bin.exe (PID: 5100)
      • 4363463463464363463463463.bin.exe (PID: 5360)
      • fortnite3.exe (PID: 5396)
      • 4363463463464363463463463.bin.exe (PID: 5556)
      • 4363463463464363463463463.bin.exe (PID: 5668)
      • 4363463463464363463463463.bin.exe (PID: 5780)
      • 4363463463464363463463463.bin.exe (PID: 5900)
      • 4363463463464363463463463.bin.exe (PID: 6060)
      • InstallUtil.exe (PID: 6116)
      • peinf.exe (PID: 5876)
      • ghjkl.exe (PID: 5996)
      • 4363463463464363463463463.bin.exe (PID: 4692)
      • 4363463463464363463463463.bin.exe (PID: 4116)
      • 4363463463464363463463463.bin.exe (PID: 3120)
      • 4363463463464363463463463.bin.exe (PID: 5264)
      • 4363463463464363463463463.bin.exe (PID: 5552)

    • Reads settings of System Certificates

      • 4363463463464363463463463.bin.exe (PID: 2064)
      • 4363463463464363463463463.bin.exe (PID: 1748)
      • 4363463463464363463463463.bin.exe (PID: 2660)
      • 4363463463464363463463463.bin.exe (PID: 2892)
      • 4363463463464363463463463.bin.exe (PID: 2532)
      • 4363463463464363463463463.bin.exe (PID: 3068)
      • 4363463463464363463463463.bin.exe (PID: 1408)
      • 4363463463464363463463463.bin.exe (PID: 3136)
      • 4363463463464363463463463.bin.exe (PID: 3200)
      • 4363463463464363463463463.bin.exe (PID: 3388)
      • 4363463463464363463463463.bin.exe (PID: 3792)
      • 4363463463464363463463463.bin.exe (PID: 3904)
      • 4363463463464363463463463.bin.exe (PID: 4020)
      • 4363463463464363463463463.bin.exe (PID: 1592)
      • 4363463463464363463463463.bin.exe (PID: 3044)
      • 4363463463464363463463463.bin.exe (PID: 3284)
      • 4363463463464363463463463.bin.exe (PID: 2560)
      • 4363463463464363463463463.bin.exe (PID: 3844)
      • 4363463463464363463463463.bin.exe (PID: 2244)
      • 4363463463464363463463463.bin.exe (PID: 3144)
      • 4363463463464363463463463.bin.exe (PID: 2812)
      • 4363463463464363463463463.bin.exe (PID: 2168)
      • 4363463463464363463463463.bin.exe (PID: 4284)
      • 4363463463464363463463463.bin.exe (PID: 4564)
      • 4363463463464363463463463.bin.exe (PID: 4872)
      • 4363463463464363463463463.bin.exe (PID: 4992)
      • 4363463463464363463463463.bin.exe (PID: 4708)
      • 4363463463464363463463463.bin.exe (PID: 5212)
      • 4363463463464363463463463.bin.exe (PID: 5100)
      • 4363463463464363463463463.bin.exe (PID: 5360)
      • 4363463463464363463463463.bin.exe (PID: 5556)
      • 4363463463464363463463463.bin.exe (PID: 5668)
      • 4363463463464363463463463.bin.exe (PID: 5780)
      • 4363463463464363463463463.bin.exe (PID: 6060)
      • 4363463463464363463463463.bin.exe (PID: 5900)
      • 4363463463464363463463463.bin.exe (PID: 4116)
      • 4363463463464363463463463.bin.exe (PID: 4692)
      • 4363463463464363463463463.bin.exe (PID: 3120)
      • 4363463463464363463463463.bin.exe (PID: 5264)

    • Adds/modifies Windows certificates

      • 4363463463464363463463463.bin.exe (PID: 2064)
      • 4363463463464363463463463.bin.exe (PID: 1748)

    • Searches for installed software

      • flesh.exe (PID: 584)

    • Reads browser cookies

      • flesh.exe (PID: 584)

    • Script adds exclusion process to Windows Defender

      • Gang.exe (PID: 2300)

    • Starts POWERSHELL.EXE for commands execution

      • Gang.exe (PID: 2300)
      • wlanext.exe (PID: 5492)
      • powershell.exe (PID: 4212)
      • BelgiumchainAGRO.exe (PID: 2932)

    • Script adds exclusion path to Windows Defender

      • Gang.exe (PID: 2300)

    • Starts CMD.EXE for commands execution

      • a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe (PID: 2964)
      • wscript.exe (PID: 6440)
      • Wattyl.exe (PID: 7524)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 4336)

    • Using PowerShell to operate with local accounts

      • powershell.exe (PID: 1832)

    • The process checks if it is being run in the virtual environment

      • dialer.exe (PID: 4984)

    • Base64-obfuscated command line is found

      • powershell.exe (PID: 4212)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 6440)

    • The process executes VB scripts

      • new.exe (PID: 6364)

  • INFO

    • Reads the machine GUID from the registry

      • 4363463463464363463463463.bin.exe (PID: 2064)
      • flesh.exe (PID: 584)
      • 4363463463464363463463463.bin.exe (PID: 1748)
      • 4363463463464363463463463.bin.exe (PID: 2660)
      • 4363463463464363463463463.bin.exe (PID: 2892)
      • 4363463463464363463463463.bin.exe (PID: 2532)
      • 4363463463464363463463463.bin.exe (PID: 3068)
      • 4363463463464363463463463.bin.exe (PID: 1408)
      • 4363463463464363463463463.bin.exe (PID: 3200)
      • 4363463463464363463463463.bin.exe (PID: 3136)
      • 4363463463464363463463463.bin.exe (PID: 3388)
      • 4363463463464363463463463.bin.exe (PID: 3792)
      • 4363463463464363463463463.bin.exe (PID: 3904)
      • 4363463463464363463463463.bin.exe (PID: 1592)
      • SuburbansKamacite.exe (PID: 3860)
      • 4363463463464363463463463.bin.exe (PID: 4020)
      • timeSync.exe (PID: 1740)
      • 4363463463464363463463463.bin.exe (PID: 2560)
      • 4363463463464363463463463.bin.exe (PID: 3044)
      • 4363463463464363463463463.bin.exe (PID: 3284)
      • 4363463463464363463463463.bin.exe (PID: 3844)
      • 4363463463464363463463463.bin.exe (PID: 2244)
      • 4363463463464363463463463.bin.exe (PID: 3144)
      • 4363463463464363463463463.bin.exe (PID: 2812)
      • 4363463463464363463463463.bin.exe (PID: 2168)
      • 4363463463464363463463463.bin.exe (PID: 4284)
      • easy.exe (PID: 4292)
      • 4363463463464363463463463.bin.exe (PID: 4564)
      • 4363463463464363463463463.bin.exe (PID: 4708)
      • 4363463463464363463463463.bin.exe (PID: 4992)
      • 4363463463464363463463463.bin.exe (PID: 4872)
      • 4363463463464363463463463.bin.exe (PID: 5212)
      • 4363463463464363463463463.bin.exe (PID: 5100)
      • 4363463463464363463463463.bin.exe (PID: 5360)
      • fortnite3.exe (PID: 5396)
      • 4363463463464363463463463.bin.exe (PID: 5556)
      • 4363463463464363463463463.bin.exe (PID: 5668)
      • 4363463463464363463463463.bin.exe (PID: 5780)
      • ama.exe (PID: 1824)
      • ghjkl.exe (PID: 5996)
      • 4363463463464363463463463.bin.exe (PID: 5900)
      • 4363463463464363463463463.bin.exe (PID: 6060)
      • InstallUtil.exe (PID: 6116)
      • BLduscfibj.exe (PID: 4276)
      • 4363463463464363463463463.bin.exe (PID: 4116)
      • 4363463463464363463463463.bin.exe (PID: 4692)
      • peinf.exe (PID: 5876)
      • BLduscfibj.exe (PID: 4492)
      • 4363463463464363463463463.bin.exe (PID: 3120)
      • 4363463463464363463463463.bin.exe (PID: 5264)
      • 4363463463464363463463463.bin.exe (PID: 5552)
      • Gang.exe (PID: 2300)

    • Checks supported languages

      • 4363463463464363463463463.bin.exe (PID: 2064)
      • flesh.exe (PID: 584)
      • qemu-ga.exe (PID: 1804)
      • ama.exe (PID: 1824)
      • 4363463463464363463463463.bin.exe (PID: 1748)
      • 4363463463464363463463463.bin.exe (PID: 2660)
      • 4363463463464363463463463.bin.exe (PID: 2892)
      • 4363463463464363463463463.bin.exe (PID: 3068)
      • %EC%9D%B8%ED%84%B0%EB%84%B7_%EC%A2%85%EB%9F%89%EC%A0%9C_%ED%85%8C%EC%8A%A4%ED%8A%B8-cksal16.exe (PID: 3028)
      • 4363463463464363463463463.bin.exe (PID: 1408)
      • 4363463463464363463463463.bin.exe (PID: 2532)
      • 4363463463464363463463463.bin.exe (PID: 3136)
      • 4363463463464363463463463.bin.exe (PID: 3200)
      • 75d8077636ee1ec7b44f33cfdc65dc4a5b96d4c0b9ac3df0879b97e2bae1f9dd.exe (PID: 3356)
      • 4363463463464363463463463.bin.exe (PID: 3388)
      • 4363463463464363463463463.bin.exe (PID: 3792)
      • 4363463463464363463463463.bin.exe (PID: 3904)
      • SuburbansKamacite.exe (PID: 3860)
      • ww.exe (PID: 1308)
      • 4363463463464363463463463.bin.exe (PID: 1592)
      • 32.exe (PID: 2204)
      • Gang.exe (PID: 2300)
      • timeSync.exe (PID: 1740)
      • 4363463463464363463463463.bin.exe (PID: 4020)
      • pinf.exe (PID: 2036)
      • PAETools.exe (PID: 2344)
      • 4363463463464363463463463.bin.exe (PID: 2560)
      • 4363463463464363463463463.bin.exe (PID: 3044)
      • 4363463463464363463463463.bin.exe (PID: 3284)
      • 4363463463464363463463463.bin.exe (PID: 3844)
      • jet.exe (PID: 1656)
      • 4363463463464363463463463.bin.exe (PID: 2244)
      • a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe (PID: 2964)
      • 4363463463464363463463463.bin.exe (PID: 3144)
      • 4363463463464363463463463.bin.exe (PID: 2812)
      • 4363463463464363463463463.bin.exe (PID: 2168)
      • 4363463463464363463463463.bin.exe (PID: 4284)
      • 4363463463464363463463463.bin.exe (PID: 4564)
      • toolspub2.exe (PID: 4600)
      • easy.exe (PID: 4292)
      • 4363463463464363463463463.bin.exe (PID: 4708)
      • news2_01.exe (PID: 4764)
      • toolspub2.exe (PID: 4860)
      • 4363463463464363463463463.bin.exe (PID: 4872)
      • 4363463463464363463463463.bin.exe (PID: 4992)
      • 4363463463464363463463463.bin.exe (PID: 5100)
      • 4363463463464363463463463.bin.exe (PID: 5212)
      • 4363463463464363463463463.bin.exe (PID: 5360)
      • fortnite3.exe (PID: 5396)
      • 4363463463464363463463463.bin.exe (PID: 5556)
      • 4363463463464363463463463.bin.exe (PID: 5780)
      • 4363463463464363463463463.bin.exe (PID: 5668)
      • ghjkl.exe (PID: 5996)
      • peinf.exe (PID: 5876)
      • 4363463463464363463463463.bin.exe (PID: 5900)
      • 4363463463464363463463463.bin.exe (PID: 6060)
      • InstallUtil.exe (PID: 6116)
      • ghjkl.exe (PID: 560)
      • BLduscfibj.exe (PID: 4492)
      • 987123.exe (PID: 4260)
      • BLduscfibj.exe (PID: 4276)
      • 4363463463464363463463463.bin.exe (PID: 4116)
      • 4363463463464363463463463.bin.exe (PID: 4692)
      • 4363463463464363463463463.bin.exe (PID: 5264)
      • 4363463463464363463463463.bin.exe (PID: 3120)
      • 4363463463464363463463463.bin.exe (PID: 5552)
      • wlanext.exe (PID: 5492)

    • Drops the executable file immediately after the start

      • 4363463463464363463463463.bin.exe (PID: 2064)
      • flesh.exe (PID: 584)
      • 4363463463464363463463463.bin.exe (PID: 1748)
      • 4363463463464363463463463.bin.exe (PID: 2660)
      • 4363463463464363463463463.bin.exe (PID: 3068)
      • 4363463463464363463463463.bin.exe (PID: 1408)
      • 4363463463464363463463463.bin.exe (PID: 3200)
      • 4363463463464363463463463.bin.exe (PID: 2532)
      • 4363463463464363463463463.bin.exe (PID: 3792)
      • jet.exe (PID: 1656)
      • 4363463463464363463463463.bin.exe (PID: 2244)
      • 4363463463464363463463463.bin.exe (PID: 3284)
      • 4363463463464363463463463.bin.exe (PID: 5100)
      • 4363463463464363463463463.bin.exe (PID: 5212)
      • 4363463463464363463463463.bin.exe (PID: 3388)
      • ghjkl.exe (PID: 5996)
      • ama.exe (PID: 1824)
      • BLduscfibj.exe (PID: 4492)
      • 4363463463464363463463463.bin.exe (PID: 5360)
      • 4363463463464363463463463.bin.exe (PID: 4692)
      • 4363463463464363463463463.bin.exe (PID: 4116)
      • 4363463463464363463463463.bin.exe (PID: 5556)
      • 4363463463464363463463463.bin.exe (PID: 5264)
      • 4363463463464363463463463.bin.exe (PID: 3136)
      • fund.exe (PID: 6360)
      • 4363463463464363463463463.bin.exe (PID: 6452)
      • 4363463463464363463463463.bin.exe (PID: 6040)
      • twztl.exe (PID: 6016)
      • 4363463463464363463463463.bin.exe (PID: 4564)
      • 4363463463464363463463463.bin.exe (PID: 5552)
      • comSvc.exe (PID: 6168)
      • 4363463463464363463463463.bin.exe (PID: 7784)
      • Wattyl.exe (PID: 7524)
      • BelgiumchainAGRO.exe (PID: 2932)

    • Reads the computer name

      • 4363463463464363463463463.bin.exe (PID: 2064)
      • flesh.exe (PID: 584)
      • qemu-ga.exe (PID: 1804)
      • ama.exe (PID: 1824)
      • 4363463463464363463463463.bin.exe (PID: 1748)
      • 4363463463464363463463463.bin.exe (PID: 2660)
      • 4363463463464363463463463.bin.exe (PID: 2892)
      • 4363463463464363463463463.bin.exe (PID: 2532)
      • 4363463463464363463463463.bin.exe (PID: 3068)
      • 4363463463464363463463463.bin.exe (PID: 1408)
      • 4363463463464363463463463.bin.exe (PID: 3200)
      • 4363463463464363463463463.bin.exe (PID: 3136)
      • 4363463463464363463463463.bin.exe (PID: 3388)
      • 4363463463464363463463463.bin.exe (PID: 3792)
      • 4363463463464363463463463.bin.exe (PID: 3904)
      • 4363463463464363463463463.bin.exe (PID: 4020)
      • 4363463463464363463463463.bin.exe (PID: 1592)
      • timeSync.exe (PID: 1740)
      • 4363463463464363463463463.bin.exe (PID: 2560)
      • SuburbansKamacite.exe (PID: 3860)
      • Gang.exe (PID: 2300)
      • 4363463463464363463463463.bin.exe (PID: 3044)
      • 4363463463464363463463463.bin.exe (PID: 3284)
      • 4363463463464363463463463.bin.exe (PID: 2244)
      • 4363463463464363463463463.bin.exe (PID: 3844)
      • 4363463463464363463463463.bin.exe (PID: 2812)
      • 4363463463464363463463463.bin.exe (PID: 3144)
      • 4363463463464363463463463.bin.exe (PID: 2168)
      • 4363463463464363463463463.bin.exe (PID: 4284)
      • easy.exe (PID: 4292)
      • 4363463463464363463463463.bin.exe (PID: 4564)
      • a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe (PID: 2964)
      • 4363463463464363463463463.bin.exe (PID: 4708)
      • 4363463463464363463463463.bin.exe (PID: 4872)
      • 4363463463464363463463463.bin.exe (PID: 4992)
      • 4363463463464363463463463.bin.exe (PID: 5100)
      • 4363463463464363463463463.bin.exe (PID: 5212)
      • 4363463463464363463463463.bin.exe (PID: 5360)
      • fortnite3.exe (PID: 5396)
      • 4363463463464363463463463.bin.exe (PID: 5556)
      • 4363463463464363463463463.bin.exe (PID: 5668)
      • 4363463463464363463463463.bin.exe (PID: 5780)
      • 4363463463464363463463463.bin.exe (PID: 5900)
      • ghjkl.exe (PID: 5996)
      • InstallUtil.exe (PID: 6116)
      • 4363463463464363463463463.bin.exe (PID: 6060)
      • BLduscfibj.exe (PID: 4276)
      • BLduscfibj.exe (PID: 4492)
      • peinf.exe (PID: 5876)
      • 4363463463464363463463463.bin.exe (PID: 4116)
      • 4363463463464363463463463.bin.exe (PID: 4692)
      • 4363463463464363463463463.bin.exe (PID: 5264)
      • 4363463463464363463463463.bin.exe (PID: 3120)
      • wlanext.exe (PID: 5492)
      • 4363463463464363463463463.bin.exe (PID: 5552)

    • Reads Environment values

      • 4363463463464363463463463.bin.exe (PID: 2064)
      • flesh.exe (PID: 584)
      • 4363463463464363463463463.bin.exe (PID: 1748)
      • 4363463463464363463463463.bin.exe (PID: 2660)
      • 4363463463464363463463463.bin.exe (PID: 2892)
      • 4363463463464363463463463.bin.exe (PID: 2532)
      • 4363463463464363463463463.bin.exe (PID: 3068)
      • 4363463463464363463463463.bin.exe (PID: 1408)
      • 4363463463464363463463463.bin.exe (PID: 3136)
      • 4363463463464363463463463.bin.exe (PID: 3200)
      • 4363463463464363463463463.bin.exe (PID: 3388)
      • 4363463463464363463463463.bin.exe (PID: 3792)
      • 4363463463464363463463463.bin.exe (PID: 3904)
      • 4363463463464363463463463.bin.exe (PID: 1592)
      • 4363463463464363463463463.bin.exe (PID: 4020)
      • 4363463463464363463463463.bin.exe (PID: 2560)
      • 4363463463464363463463463.bin.exe (PID: 3044)
      • 4363463463464363463463463.bin.exe (PID: 3284)
      • 4363463463464363463463463.bin.exe (PID: 3844)
      • 4363463463464363463463463.bin.exe (PID: 2244)
      • 4363463463464363463463463.bin.exe (PID: 3144)
      • 4363463463464363463463463.bin.exe (PID: 2812)
      • 4363463463464363463463463.bin.exe (PID: 2168)
      • 4363463463464363463463463.bin.exe (PID: 4284)
      • 4363463463464363463463463.bin.exe (PID: 4564)
      • 4363463463464363463463463.bin.exe (PID: 4708)
      • 4363463463464363463463463.bin.exe (PID: 4872)
      • 4363463463464363463463463.bin.exe (PID: 4992)
      • 4363463463464363463463463.bin.exe (PID: 5100)
      • 4363463463464363463463463.bin.exe (PID: 5212)
      • 4363463463464363463463463.bin.exe (PID: 5360)
      • 4363463463464363463463463.bin.exe (PID: 5556)
      • 4363463463464363463463463.bin.exe (PID: 5668)
      • 4363463463464363463463463.bin.exe (PID: 5780)
      • 4363463463464363463463463.bin.exe (PID: 5900)
      • 4363463463464363463463463.bin.exe (PID: 6060)
      • 4363463463464363463463463.bin.exe (PID: 4116)
      • 4363463463464363463463463.bin.exe (PID: 4692)
      • 4363463463464363463463463.bin.exe (PID: 5264)
      • 4363463463464363463463463.bin.exe (PID: 3120)
      • 4363463463464363463463463.bin.exe (PID: 5552)

    • Reads product name

      • flesh.exe (PID: 584)

    • REDLINE has been detected (SURICATA)

      • flesh.exe (PID: 584)

    • Creates files or folders in the user directory

      • flesh.exe (PID: 584)
      • pinf.exe (PID: 2036)
      • wlanext.exe (PID: 5492)

    • Connects to unusual port

      • flesh.exe (PID: 584)
      • 4363463463464363463463463.bin.exe (PID: 3792)
      • 4363463463464363463463463.bin.exe (PID: 4020)
      • easy.exe (PID: 4292)

    • Process requests binary or script from the Internet

      • 4363463463464363463463463.bin.exe (PID: 2064)
      • 4363463463464363463463463.bin.exe (PID: 1748)
      • 4363463463464363463463463.bin.exe (PID: 1408)
      • 4363463463464363463463463.bin.exe (PID: 2660)
      • 4363463463464363463463463.bin.exe (PID: 3388)
      • 4363463463464363463463463.bin.exe (PID: 2532)
      • 4363463463464363463463463.bin.exe (PID: 3200)
      • 4363463463464363463463463.bin.exe (PID: 3068)
      • 4363463463464363463463463.bin.exe (PID: 3284)

    • Connects to the server without a host name

      • 4363463463464363463463463.bin.exe (PID: 2064)
      • 4363463463464363463463463.bin.exe (PID: 1408)
      • 4363463463464363463463463.bin.exe (PID: 3200)

    • Manual execution by a user

      • 4363463463464363463463463.bin.exe (PID: 1740)
      • 4363463463464363463463463.bin.exe (PID: 1748)
      • 4363463463464363463463463.bin.exe (PID: 664)
      • 4363463463464363463463463.bin.exe (PID: 2660)
      • 4363463463464363463463463.bin.exe (PID: 1196)
      • 4363463463464363463463463.bin.exe (PID: 2804)
      • 4363463463464363463463463.bin.exe (PID: 2892)
      • 4363463463464363463463463.bin.exe (PID: 2532)
      • 4363463463464363463463463.bin.exe (PID: 2844)
      • 4363463463464363463463463.bin.exe (PID: 3068)
      • 4363463463464363463463463.bin.exe (PID: 3044)
      • 4363463463464363463463463.bin.exe (PID: 1408)
      • 4363463463464363463463463.bin.exe (PID: 3148)
      • 4363463463464363463463463.bin.exe (PID: 3136)
      • 4363463463464363463463463.bin.exe (PID: 2956)
      • 4363463463464363463463463.bin.exe (PID: 3200)
      • 4363463463464363463463463.bin.exe (PID: 3388)
      • 4363463463464363463463463.bin.exe (PID: 2772)
      • 4363463463464363463463463.bin.exe (PID: 3676)
      • 4363463463464363463463463.bin.exe (PID: 3792)
      • 4363463463464363463463463.bin.exe (PID: 3832)
      • 4363463463464363463463463.bin.exe (PID: 3904)
      • 4363463463464363463463463.bin.exe (PID: 2148)
      • 4363463463464363463463463.bin.exe (PID: 4020)
      • 4363463463464363463463463.bin.exe (PID: 1736)
      • 4363463463464363463463463.bin.exe (PID: 956)
      • 4363463463464363463463463.bin.exe (PID: 1592)
      • 4363463463464363463463463.bin.exe (PID: 2560)
      • 4363463463464363463463463.bin.exe (PID: 3284)
      • 4363463463464363463463463.bin.exe (PID: 604)
      • 4363463463464363463463463.bin.exe (PID: 3736)
      • 4363463463464363463463463.bin.exe (PID: 2844)
      • 4363463463464363463463463.bin.exe (PID: 3044)
      • 4363463463464363463463463.bin.exe (PID: 3844)
      • 4363463463464363463463463.bin.exe (PID: 1772)
      • 4363463463464363463463463.bin.exe (PID: 2244)
      • 4363463463464363463463463.bin.exe (PID: 3024)
      • 4363463463464363463463463.bin.exe (PID: 2812)
      • 4363463463464363463463463.bin.exe (PID: 1728)
      • 4363463463464363463463463.bin.exe (PID: 3652)
      • 4363463463464363463463463.bin.exe (PID: 2168)
      • 4363463463464363463463463.bin.exe (PID: 3144)
      • 4363463463464363463463463.bin.exe (PID: 4232)
      • 4363463463464363463463463.bin.exe (PID: 4284)
      • 4363463463464363463463463.bin.exe (PID: 4492)
      • 4363463463464363463463463.bin.exe (PID: 4564)
      • 4363463463464363463463463.bin.exe (PID: 4872)
      • 4363463463464363463463463.bin.exe (PID: 4820)
      • 4363463463464363463463463.bin.exe (PID: 4664)
      • 4363463463464363463463463.bin.exe (PID: 4708)
      • 4363463463464363463463463.bin.exe (PID: 4992)
      • 4363463463464363463463463.bin.exe (PID: 5100)
      • 4363463463464363463463463.bin.exe (PID: 5064)
      • 4363463463464363463463463.bin.exe (PID: 4956)
      • 4363463463464363463463463.bin.exe (PID: 5212)
      • 4363463463464363463463463.bin.exe (PID: 5176)
      • 4363463463464363463463463.bin.exe (PID: 5360)
      • 4363463463464363463463463.bin.exe (PID: 5324)
      • 4363463463464363463463463.bin.exe (PID: 5520)
      • 4363463463464363463463463.bin.exe (PID: 5556)
      • 4363463463464363463463463.bin.exe (PID: 5668)
      • 4363463463464363463463463.bin.exe (PID: 5744)
      • 4363463463464363463463463.bin.exe (PID: 5780)
      • 4363463463464363463463463.bin.exe (PID: 5900)
      • 4363463463464363463463463.bin.exe (PID: 6024)
      • 4363463463464363463463463.bin.exe (PID: 5856)
      • 4363463463464363463463463.bin.exe (PID: 5632)
      • 4363463463464363463463463.bin.exe (PID: 6060)
      • 4363463463464363463463463.bin.exe (PID: 4328)
      • 4363463463464363463463463.bin.exe (PID: 4380)
      • 4363463463464363463463463.bin.exe (PID: 4692)
      • 4363463463464363463463463.bin.exe (PID: 4116)
      • 4363463463464363463463463.bin.exe (PID: 5224)
      • 4363463463464363463463463.bin.exe (PID: 5264)
      • 4363463463464363463463463.bin.exe (PID: 4840)
      • 4363463463464363463463463.bin.exe (PID: 3120)
      • 4363463463464363463463463.bin.exe (PID: 5552)
      • 4363463463464363463463463.bin.exe (PID: 5792)
      • 4363463463464363463463463.bin.exe (PID: 4276)
      • 4363463463464363463463463.bin.exe (PID: 5408)
      • 4363463463464363463463463.bin.exe (PID: 6040)
      • 4363463463464363463463463.bin.exe (PID: 5792)
      • 4363463463464363463463463.bin.exe (PID: 4988)
      • 4363463463464363463463463.bin.exe (PID: 6044)
      • 4363463463464363463463463.bin.exe (PID: 4524)
      • 4363463463464363463463463.bin.exe (PID: 6452)
      • 4363463463464363463463463.bin.exe (PID: 6164)
      • 4363463463464363463463463.bin.exe (PID: 5864)
      • 4363463463464363463463463.bin.exe (PID: 7176)
      • 4363463463464363463463463.bin.exe (PID: 7252)
      • 4363463463464363463463463.bin.exe (PID: 7316)
      • 4363463463464363463463463.bin.exe (PID: 7128)
      • 4363463463464363463463463.bin.exe (PID: 7916)
      • 4363463463464363463463463.bin.exe (PID: 7784)
      • 4363463463464363463463463.bin.exe (PID: 7868)
      • 4363463463464363463463463.bin.exe (PID: 7424)
      • 4363463463464363463463463.bin.exe (PID: 7460)
      • 4363463463464363463463463.bin.exe (PID: 7592)
      • 4363463463464363463463463.bin.exe (PID: 7720)
      • 4363463463464363463463463.bin.exe (PID: 7528)

    • Create files in a temporary directory

      • 4363463463464363463463463.bin.exe (PID: 1748)
      • jet.exe (PID: 1656)
      • ghjkl.exe (PID: 5996)
      • ama.exe (PID: 1824)
      • wlanext.exe (PID: 5492)

    • Checks proxy server information

      • timeSync.exe (PID: 1740)
      • fortnite3.exe (PID: 5396)
      • InstallUtil.exe (PID: 6116)
      • peinf.exe (PID: 5876)

    • Process checks whether UAC notifications are on

      • Gang.exe (PID: 2300)

    • Application launched itself

      • toolspub2.exe (PID: 4600)
      • ghjkl.exe (PID: 5996)
      • BLduscfibj.exe (PID: 4276)
      • powershell.exe (PID: 4212)
      • 865b3db67f0565e0b41e72aa036d78183c33dab95bd4be7b4f13aebda88ab0c0.exe (PID: 4412)
      • s5.exe (PID: 3424)
      • d5335cb7e978f712440f2d4eb67ed8b8813daf0f0f817ec690a3c1419e41b4c2.exe (PID: 6500)

    • STEALC has been detected (SURICATA)

      • timeSync.exe (PID: 1740)

    • Connects to the CnC server

      • timeSync.exe (PID: 1740)

    • The process executes via Task Scheduler

      • powershell.exe (PID: 6688)

    • KELIHOS has been detected (SURICATA)

      • 4363463463464363463463463.bin.exe (PID: 1408)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6688)

    • Starts itself from another location

      • twztl.exe (PID: 6016)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6688)

    • Changes the registry key values via Powershell

      • powershell.exe (PID: 4212)

    • Writes files like Keylogger logs

      • 6.exe (PID: 6260)

    • Executed via WMI

      • schtasks.exe (PID: 6700)
      • schtasks.exe (PID: 6828)
      • schtasks.exe (PID: 6696)
      • schtasks.exe (PID: 6852)
      • schtasks.exe (PID: 6744)
      • schtasks.exe (PID: 7128)
      • schtasks.exe (PID: 7064)
      • schtasks.exe (PID: 4536)
      • schtasks.exe (PID: 7016)
      • schtasks.exe (PID: 6908)
      • schtasks.exe (PID: 6880)
      • schtasks.exe (PID: 6924)
      • schtasks.exe (PID: 6976)
      • schtasks.exe (PID: 6716)
      • schtasks.exe (PID: 6800)
      • schtasks.exe (PID: 7020)
      • schtasks.exe (PID: 7256)
      • schtasks.exe (PID: 7300)
      • schtasks.exe (PID: 7264)
      • schtasks.exe (PID: 7432)
      • schtasks.exe (PID: 7444)
      • schtasks.exe (PID: 7472)
      • schtasks.exe (PID: 7088)
      • schtasks.exe (PID: 7588)
      • schtasks.exe (PID: 7720)
      • schtasks.exe (PID: 7032)
      • schtasks.exe (PID: 7048)
      • schtasks.exe (PID: 7056)
      • schtasks.exe (PID: 1192)
      • schtasks.exe (PID: 7152)
      • schtasks.exe (PID: 6732)
      • schtasks.exe (PID: 6160)
      • schtasks.exe (PID: 6224)
      • schtasks.exe (PID: 8000)
      • schtasks.exe (PID: 7672)
      • schtasks.exe (PID: 6476)
      • schtasks.exe (PID: 8160)
      • schtasks.exe (PID: 5404)
      • schtasks.exe (PID: 6448)
      • schtasks.exe (PID: 8132)
      • schtasks.exe (PID: 1832)
      • schtasks.exe (PID: 7796)
      • schtasks.exe (PID: 6780)
      • schtasks.exe (PID: 6820)
      • schtasks.exe (PID: 6772)
      • schtasks.exe (PID: 6756)
      • schtasks.exe (PID: 7896)
      • schtasks.exe (PID: 7996)
      • schtasks.exe (PID: 6896)
      • schtasks.exe (PID: 6812)
      • schtasks.exe (PID: 6864)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:12:22 09:29:10+01:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 80
CodeSize: 5632
InitializedDataSize: 4608
UninitializedDataSize: -
EntryPoint: 0x3552
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 0.0.0.0
InternalName: 4363463463464363463463463.exe
LegalCopyright:
OriginalFileName: 4363463463464363463463463.exe
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
417
Monitored processes
233
Malicious processes
43
Suspicious processes
3

Behavior graph

Click at the process to see the details
start #HAUSBOMBER 4363463463464363463463463.bin.exe #REDLINE flesh.exe qemu-ga.exe no specs ama.exe 4363463463464363463463463.bin.exe no specs #HAUSBOMBER 4363463463464363463463463.bin.exe 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe %ec%9d%b8%ed%84%b0%eb%84%b7_%ec%a2%85%eb%9f%89%ec%a0%9c_%ed%85%8c%ec%8a%a4%ed%8a%b8-cksal16.exe 4363463463464363463463463.bin.exe no specs #KELIHOS 4363463463464363463463463.bin.exe 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe 75d8077636ee1ec7b44f33cfdc65dc4a5b96d4c0b9ac3df0879b97e2bae1f9dd.exe 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe 4363463463464363463463463.bin.exe no specs suburbanskamacite.exe 4363463463464363463463463.bin.exe 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe pinf.exe 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe ww.exe 32.exe 4363463463464363463463463.bin.exe no specs #STEALC timesync.exe gang.exe no specs paetools.exe no specs 4363463463464363463463463.bin.exe 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe 4363463463464363463463463.bin.exe no specs jet.exe no specs 4363463463464363463463463.bin.exe a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe no specs 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe powershell.exe no specs dialer.exe no specs 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe easy.exe cmd.exe no specs taskkill.exe no specs 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe toolspub2.exe no specs 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe ntvdm.exe no specs news2_01.exe no specs 4363463463464363463463463.bin.exe no specs toolspub2.exe no specs 4363463463464363463463463.bin.exe 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe fortnite3.exe no specs 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe 4363463463464363463463463.bin.exe no specs peinf.exe no specs 4363463463464363463463463.bin.exe ghjkl.exe no specs 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe installutil.exe no specs 987123.exe blduscfibj.exe no specs ghjkl.exe 4363463463464363463463463.bin.exe no specs blduscfibj.exe no specs 4363463463464363463463463.bin.exe 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe dialer.exe no specs 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe 4363463463464363463463463.bin.exe no specs wlanext.exe no specs 4363463463464363463463463.bin.exe 4363463463464363463463463.bin.exe no specs powershell.exe no specs 4363463463464363463463463.bin.exe 4363463463464363463463463.bin.exe no specs 865b3db67f0565e0b41e72aa036d78183c33dab95bd4be7b4f13aebda88ab0c0.exe no specs #GULOADER powershell.exe no specs 4363463463464363463463463.bin.exe belgiumchainagro.exe no specs 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe b5ed26bd6f40eda4ff90ec9b4a60b295c77a723d38ebebb0c70997caedc6fb8c.exe update.exe no specs pp.exe no specs 4363463463464363463463463.bin.exe no specs twztl.exe no specs 865b3db67f0565e0b41e72aa036d78183c33dab95bd4be7b4f13aebda88ab0c0.exe no specs 4363463463464363463463463.bin.exe s5.exe no specs 4363463463464363463463463.bin.exe no specs tidex_-_short_stuff.exe no specs 6.exe no specs fund.exe no specs wscript.exe no specs 4363463463464363463463463.bin.exe tpeinf.exe no specs d5335cb7e978f712440f2d4eb67ed8b8813daf0f0f817ec690a3c1419e41b4c2.exe no specs s5.exe no specs ntvdm.exe no specs powershell.exe no specs cs_maltest.exe no specs syspolrvcs.exe no specs ntvdm.exe d5335cb7e978f712440f2d4eb67ed8b8813daf0f0f817ec690a3c1419e41b4c2.exe no specs recorder.exe no specs 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe 4363463463464363463463463.bin.exe no specs ntvdm.exe 4363463463464363463463463.bin.exe 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe 4363463463464363463463463.bin.exe no specs minuscrypt_crypted.exe 4363463463464363463463463.bin.exe applaunch.exe no specs 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe 4363463463464363463463463.bin.exe no specs 4363463463464363463463463.bin.exe ntvdm.exe jsc.exe no specs watchdog.exe no specs cmd.exe no specs comsvc.exe no specs new.exe vbc.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs ntvdm.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs kb^fr_ouverture.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs 891b6cff6879ab69ae185a5956987ec46daaf434c60c93589c9ac06e4a4f7005.exe lodir.exe no specs wattyl.exe no specs cmd.exe no specs at.exe no specs otte-locker.exe no specs cmd.exe no specs at.exe no specs amdau.exe no specs powershell.exe no specs ghjk.exe no specs 4363463463464363463463463.bin.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
560C:\Users\admin\Desktop\Files\ghjkl.exeC:\Users\admin\Desktop\Files\ghjkl.exe
ghjkl.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225477
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\files\ghjkl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
584"C:\Users\admin\Desktop\Files\flesh.exe" C:\Users\admin\Desktop\Files\flesh.exe
4363463463464363463463463.bin.exe
User:
admin
Company:
Sangrias
Integrity Level:
HIGH
Description:
Sangrias
Exit code:
0
Version:
39.86.93
Modules
Images
c:\users\admin\desktop\files\flesh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
604"C:\Users\admin\Desktop\4363463463464363463463463.bin.exe" C:\Users\admin\Desktop\4363463463464363463463463.bin.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
3221226540
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\4363463463464363463463463.bin.exe
c:\windows\system32\ntdll.dll
664"C:\Users\admin\Desktop\4363463463464363463463463.bin.exe" C:\Users\admin\Desktop\4363463463464363463463463.bin.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
3221226540
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\4363463463464363463463463.bin.exe
c:\windows\system32\ntdll.dll
956"C:\Users\admin\Desktop\4363463463464363463463463.bin.exe" C:\Users\admin\Desktop\4363463463464363463463463.bin.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
3221226540
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\4363463463464363463463463.bin.exe
c:\windows\system32\ntdll.dll
1192schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\MSBuild\conhost.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1196"C:\Users\admin\Desktop\4363463463464363463463463.bin.exe" C:\Users\admin\Desktop\4363463463464363463463463.bin.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
3221226540
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\4363463463464363463463463.bin.exe
c:\windows\system32\ntdll.dll
1308"C:\Users\admin\Desktop\Files\ww.exe" C:\Users\admin\Desktop\Files\ww.exe
4363463463464363463463463.bin.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225477
Modules
Images
c:\users\admin\desktop\files\ww.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
1408"C:\Users\admin\Desktop\4363463463464363463463463.bin.exe" C:\Users\admin\Desktop\4363463463464363463463463.bin.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\4363463463464363463463463.bin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1592"C:\Users\admin\Desktop\4363463463464363463463463.bin.exe" C:\Users\admin\Desktop\4363463463464363463463463.bin.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\4363463463464363463463463.bin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
129 117
Read events
128 353
Write events
764
Delete events
0

Modification events

(PID) Process:(2064) 4363463463464363463463463.bin.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2064) 4363463463464363463463463.bin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD
Operation:writeName:Blob
Value:
530000000100000040000000303E301F06092B06010401A032010130123010060A2B0601040182373C0101030200C0301B060567810C010330123010060A2B0601040182373C0101030200C0190000000100000010000000D0FD3C9C380D7B65E26B9A3FEDD39B8F0B000000010000003000000047006C006F00620061006C005300690067006E00200052006F006F00740020004300410020002D002000520033000000620000000100000020000000CBB522D7B7F127AD6A0113865BDF1CD4102E7D0759AF635A7CF4720DC963C53B1400000001000000140000008FF04B7FA82E4524AE4D50FA639A8BDEE2DD1BBC1D000000010000001000000001728E1ECF7A9D86FB3CEC8948ABA953030000000100000014000000D69B561148F01C77C54578C10926DF5B856976AD0F00000001000000200000005229BA15B31B0C6F4CCA89C2985177974327D1B689A3B935A0BD975532AF22AB090000000100000054000000305206082B0601050507030206082B06010505070303060A2B0601040182370A030406082B0601050507030406082B0601050507030606082B0601050507030706082B0601050507030106082B060105050703082000000001000000630300003082035F30820247A003020102020B04000000000121585308A2300D06092A864886F70D01010B0500304C3120301E060355040B1317476C6F62616C5369676E20526F6F74204341202D20523331133011060355040A130A476C6F62616C5369676E311330110603550403130A476C6F62616C5369676E301E170D3039303331383130303030305A170D3239303331383130303030305A304C3120301E060355040B1317476C6F62616C5369676E20526F6F74204341202D20523331133011060355040A130A476C6F62616C5369676E311330110603550403130A476C6F62616C5369676E30820122300D06092A864886F70D01010105000382010F003082010A0282010100CC2576907906782216F5C083B684CA289EFD057611C5AD8872FC460243C7B28A9D045F24CB2E4BE1608246E152AB0C8147706CDD64D1EBF52CA30F823D0C2BAE97D7B614861079BB3B1380778C08E149D26A622F1F5EFA9668DF892795389F06D73EC9CB26590D73DEB0C8E9260E8315C6EF5B8BD20460CA49A628F6693BF6CBC82891E59D8A615737AC7414DC74E03AEE722F2E9CFBD0BBBFF53D00E10633E8822BAE53A63A16738CDD410E203AC0B4A7A1E9B24F902E3260E957CBB904926868E538266075B29F77FF9114EFAE2049FCAD401548D1023161195EB897EFAD77B7649A7ABF5FC113EF9B62FB0D6CE0546916A903DA6EE983937176C6698582170203010001A3423040300E0603551D0F0101FF040403020106300F0603551D130101FF040530030101FF301D0603551D0E041604148FF04B7FA82E4524AE4D50FA639A8BDEE2DD1BBC300D06092A864886F70D01010B050003820101004B40DBC050AAFEC80CEFF796544549BB96000941ACB3138686280733CA6BE674B9BA002DAEA40AD3F5F1F10F8ABF73674A83C7447B78E0AF6E6C6F03298E333945C38EE4B9576CAAFC1296EC53C62DE4246CB99463FBDC536867563E83B8CF3521C3C968FECEDAC253AACC908AE9F05D468C95DD7A58281A2F1DDECD0037418FED446DD75328977EF367041E15D78A96B4D3DE4C27A44C1B737376F41799C21F7A0EE32D08AD0A1C2CFF3CAB550E0F917E36EBC35749BEE12E2D7C608BC3415113239DCEF7326B9401A899E72C331F3A3B25D28640CE3B2C8678C9612F14BAEEDB556FDF84EE05094DBD28D872CED36250651EEB92978331D9B3B5CA47583F5F
(PID) Process:(2064) 4363463463464363463463463.bin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD
Operation:writeName:Blob
Value:
040000000100000010000000C5DFB849CA051355EE2DBA1AC33EB028090000000100000054000000305206082B0601050507030206082B06010505070303060A2B0601040182370A030406082B0601050507030406082B0601050507030606082B0601050507030706082B0601050507030106082B060105050703080F00000001000000200000005229BA15B31B0C6F4CCA89C2985177974327D1B689A3B935A0BD975532AF22AB030000000100000014000000D69B561148F01C77C54578C10926DF5B856976AD1D000000010000001000000001728E1ECF7A9D86FB3CEC8948ABA9531400000001000000140000008FF04B7FA82E4524AE4D50FA639A8BDEE2DD1BBC620000000100000020000000CBB522D7B7F127AD6A0113865BDF1CD4102E7D0759AF635A7CF4720DC963C53B0B000000010000003000000047006C006F00620061006C005300690067006E00200052006F006F00740020004300410020002D002000520033000000190000000100000010000000D0FD3C9C380D7B65E26B9A3FEDD39B8F530000000100000040000000303E301F06092B06010401A032010130123010060A2B0601040182373C0101030200C0301B060567810C010330123010060A2B0601040182373C0101030200C02000000001000000630300003082035F30820247A003020102020B04000000000121585308A2300D06092A864886F70D01010B0500304C3120301E060355040B1317476C6F62616C5369676E20526F6F74204341202D20523331133011060355040A130A476C6F62616C5369676E311330110603550403130A476C6F62616C5369676E301E170D3039303331383130303030305A170D3239303331383130303030305A304C3120301E060355040B1317476C6F62616C5369676E20526F6F74204341202D20523331133011060355040A130A476C6F62616C5369676E311330110603550403130A476C6F62616C5369676E30820122300D06092A864886F70D01010105000382010F003082010A0282010100CC2576907906782216F5C083B684CA289EFD057611C5AD8872FC460243C7B28A9D045F24CB2E4BE1608246E152AB0C8147706CDD64D1EBF52CA30F823D0C2BAE97D7B614861079BB3B1380778C08E149D26A622F1F5EFA9668DF892795389F06D73EC9CB26590D73DEB0C8E9260E8315C6EF5B8BD20460CA49A628F6693BF6CBC82891E59D8A615737AC7414DC74E03AEE722F2E9CFBD0BBBFF53D00E10633E8822BAE53A63A16738CDD410E203AC0B4A7A1E9B24F902E3260E957CBB904926868E538266075B29F77FF9114EFAE2049FCAD401548D1023161195EB897EFAD77B7649A7ABF5FC113EF9B62FB0D6CE0546916A903DA6EE983937176C6698582170203010001A3423040300E0603551D0F0101FF040403020106300F0603551D130101FF040530030101FF301D0603551D0E041604148FF04B7FA82E4524AE4D50FA639A8BDEE2DD1BBC300D06092A864886F70D01010B050003820101004B40DBC050AAFEC80CEFF796544549BB96000941ACB3138686280733CA6BE674B9BA002DAEA40AD3F5F1F10F8ABF73674A83C7447B78E0AF6E6C6F03298E333945C38EE4B9576CAAFC1296EC53C62DE4246CB99463FBDC536867563E83B8CF3521C3C968FECEDAC253AACC908AE9F05D468C95DD7A58281A2F1DDECD0037418FED446DD75328977EF367041E15D78A96B4D3DE4C27A44C1B737376F41799C21F7A0EE32D08AD0A1C2CFF3CAB550E0F917E36EBC35749BEE12E2D7C608BC3415113239DCEF7326B9401A899E72C331F3A3B25D28640CE3B2C8678C9612F14BAEEDB556FDF84EE05094DBD28D872CED36250651EEB92978331D9B3B5CA47583F5F
(PID) Process:(2064) 4363463463464363463463463.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2064) 4363463463464363463463463.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2064) 4363463463464363463463463.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2064) 4363463463464363463463463.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(584) flesh.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(584) flesh.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(584) flesh.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
Executable files
83
Suspicious files
34
Text files
37
Unknown types
0

Dropped files

PID
Process
Filename
Type
17484363463463464363463463463.bin.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:AC05D27423A85ADC1622C714F2CB6184
SHA256:C6456E12E5E53287A547AF4103E0397CB9697E466CF75844312DC296D43D144D
584flesh.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exeexecutable
MD5:A5CE3ABA68BDB438E98B1D0C70A3D95C
SHA256:9B860BE98A046EA97A7F67B006E0B1BC9AB7731DD2A0F3A9FD3D710F6C43278A
17484363463463464363463463463.bin.exeC:\Users\admin\Desktop\Files\Saint-Menace.exeexecutable
MD5:9B8A05314C09DB5EF6AE5410B40E109A
SHA256:D244F5129DD0DA39E8808311B3FD46120F5DDD4AA4B67BE258F8EF42A3A6DAFA
1832powershell.exeC:\Users\admin\AppData\Local\Temp\rn02p4wg.4fo.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
14084363463463464363463463463.bin.exeC:\Users\admin\Desktop\Files\Gang.exeexecutable
MD5:D4AA07253504503ADBE12331EE6149B6
SHA256:CEA50BB5162CB062F9C1BB03CE6A5D59B2247D0FBEEC76E47948B1F90FE5F7CC
1656jet.exeC:\Users\admin\AppData\Local\Temp\gs64B2.tmpbinary
MD5:E667DC95FC4777DFE2922456CCAB51E8
SHA256:2F15F2CCDC2F8E6E2F5A2969E97755590F0BEA72F03D60A59AF8F9DD0284D15F
17484363463463464363463463463.bin.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:BA00CDA824AED3562B003AFD345C4D28
SHA256:2C0F8DE2E1A59F937CF65747E351AA8624B2E0D0FBBDB9B8DD544EEA373EA6D4
17484363463463464363463463463.bin.exeC:\Users\admin\AppData\Local\Temp\Cab26FC.tmpcompressed
MD5:AC05D27423A85ADC1622C714F2CB6184
SHA256:C6456E12E5E53287A547AF4103E0397CB9697E466CF75844312DC296D43D144D
22444363463463464363463463463.bin.exeC:\Users\admin\Desktop\Files\toolspub2.exeexecutable
MD5:CE67C364513FC67E13215D7B25E0A039
SHA256:185D500E68DB0931B23E580C949FCDE4B1CDDF87F13D5A9D95AC9D0BA7014714
1656jet.exeC:\Users\admin\AppData\Local\Temp\GS6492.tmpexecutable
MD5:7D46EA623EBA5073B7E3A2834FE58CC9
SHA256:4EBF13835A117A2551D80352CA532F6596E6F2729E41B3DE7015DB558429DEA5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
84
TCP/UDP connections
191
DNS requests
67
Threats
340

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2064
4363463463464363463463463.bin.exe
GET
200
185.172.128.121:80
http://185.172.128.121/ama.exe
unknown
executable
5.94 Mb
unknown
2064
4363463463464363463463463.bin.exe
GET
200
77.91.68.21:80
http://77.91.68.21/lend/flesh.exe
unknown
executable
342 Kb
unknown
2064
4363463463464363463463463.bin.exe
GET
200
88.151.192.77:80
http://88.151.192.77/382498393934ena-rr.exe
unknown
executable
5.28 Mb
unknown
1748
4363463463464363463463463.bin.exe
GET
200
184.24.77.194:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?0c6364f78002bafb
unknown
compressed
65.2 Kb
unknown
2064
4363463463464363463463463.bin.exe
GET
200
121.53.202.238:80
http://cfs7.blog.daum.net/upload_control/download.blog?fhandle=MEtnWE5AZnM3LmJsb2cuZGF1bS5uZXQ6L0lNQUdFLzAvMC5leGU=&filename=%EC%9D%B8%ED%84%B0%EB%84%B7_%EC%A2%85%EB%9F%89%EC%A0%9C_%ED%85%8C%EC%8A%A4%ED%8A%B8-cksal16.exe/%EC%9D%B8%ED%84%B0%EB%84%B7_%EC%A2%85%EB%9F%89%EC%A0%9C_%ED%85%8C%EC%8A%A4%ED%8A%B8-cksal16.exe
unknown
executable
268 Kb
unknown
2660
4363463463464363463463463.bin.exe
GET
200
42.177.83.63:80
http://download.doumaibiji.cn/doumai/news2/v1.0.7.01/news2_01.exe
unknown
executable
1.66 Mb
unknown
1748
4363463463464363463463463.bin.exe
GET
200
39.106.158.243:80
http://soft.110route.com/PAETools.exe
unknown
executable
183 Kb
unknown
3068
4363463463464363463463463.bin.exe
GET
200
176.126.201.5:80
http://artmediastudio.ro/Amdau.exe
unknown
executable
3.20 Mb
unknown
1408
4363463463464363463463463.bin.exe
GET
200
85.209.11.204:80
http://85.209.11.204/api/files/software/ww.exe
unknown
executable
494 Kb
unknown
2064
4363463463464363463463463.bin.exe
GET
200
185.172.128.53:80
http://185.172.128.53/timeSync.exe
unknown
executable
260 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2064
4363463463464363463463463.bin.exe
151.101.2.49:443
urlhaus.abuse.ch
FASTLY
US
unknown
2064
4363463463464363463463463.bin.exe
77.91.68.21:80
—
Foton Telecom CJSC
RU
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2064
4363463463464363463463463.bin.exe
185.172.128.121:80
—
OOO Nadym Svyaz Service
RU
unknown
584
flesh.exe
5.42.65.31:48396
—
CJSC Kolomna-Sviaz TV
RU
malicious
2064
4363463463464363463463463.bin.exe
88.151.192.77:80
—
Dyjix Association
DE
unknown
2064
4363463463464363463463463.bin.exe
121.53.202.238:80
cfs7.blog.daum.net
Kakao Corp
KR
unknown
1748
4363463463464363463463463.bin.exe
151.101.2.49:443
urlhaus.abuse.ch
FASTLY
US
unknown

DNS requests

Domain
IP
Reputation
urlhaus.abuse.ch
  • 151.101.2.49
  • 151.101.66.49
  • 151.101.130.49
  • 151.101.194.49
whitelisted
cfs7.blog.daum.net
  • 121.53.202.238
unknown
paingta.xyz
  • 185.199.108.153
  • 185.199.111.153
  • 185.199.109.153
  • 185.199.110.153
malicious
ctldl.windowsupdate.com
  • 184.24.77.194
  • 184.24.77.202
whitelisted
soft.110route.com
  • 39.106.158.243
malicious
download.doumaibiji.cn
  • 42.177.83.63
  • 60.220.213.207
  • 42.177.83.115
  • 61.243.13.101
  • 124.163.196.88
  • 14.205.47.136
  • 42.177.83.214
  • 116.177.242.62
  • 42.177.83.87
  • 14.205.47.70
  • 221.204.166.213
  • 221.204.209.156
  • 116.177.242.69
malicious
needs.hitsturbo.com
  • 172.67.168.30
  • 104.21.46.59
malicious
github.com
  • 140.82.121.3
shared
bitbucket.org
  • 104.192.141.1
shared
raw.githubusercontent.com
  • 185.199.111.133
  • 185.199.110.133
  • 185.199.108.133
  • 185.199.109.133
shared

Threats

PID
Process
Class
Message
2064
4363463463464363463463463.bin.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2064
4363463463464363463463463.bin.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
2064
4363463463464363463463463.bin.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2064
4363463463464363463463463.bin.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2064
4363463463464363463463463.bin.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
2064
4363463463464363463463463.bin.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
2064
4363463463464363463463463.bin.exe
Potentially Bad Traffic
ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
2064
4363463463464363463463463.bin.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2064
4363463463464363463463463.bin.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2064
4363463463464363463463463.bin.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
11 ETPRO signatures available at the full report
Process
Message
4363463463464363463463463.bin.exe
The specified executable is not a valid application for this OS platform.
4363463463464363463463463.bin.exe
The specified executable is not a valid application for this OS platform.
4363463463464363463463463.bin.exe
The request was aborted: Could not create SSL/TLS secure channel.
4363463463464363463463463.bin.exe
An exception occurred during a WebClient request.
4363463463464363463463463.bin.exe
The remote server returned an error: (403) Forbidden.
4363463463464363463463463.bin.exe
An exception occurred during a WebClient request.
4363463463464363463463463.bin.exe
The request was aborted: Could not create SSL/TLS secure channel.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
4363463463464363463463463.bin