File name:

file

Full analysis: https://app.any.run/tasks/c991f57f-bd95-4a2c-94b6-4dcf3bb22f3a
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: August 16, 2024, 04:12:45
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
amadey
botnet
stealer
themida
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

B2ED31D82898F46AA1A3B0EB1E0FB2CE

SHA1:

979F835E7933FCDC870B29DBB0D3547FFC0A15A7

SHA256:

3416C215EE14749E6341F4A4AA2AC79D4D0611AA69CC0F7A5DA14BF13545D3AC

SSDEEP:

98304:tf3zbByIqFZRJWL3hkPxi+M1AzvNkfOuRxXmqlpWZwTn+hvC10W9J5AhQCCKMpJa:XF5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • axplong.exe (PID: 6700)

    • AMADEY has been detected (SURICATA)

      • axplong.exe (PID: 6700)

    • AMADEY has been detected (YARA)

      • axplong.exe (PID: 6700)

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • file.exe (PID: 6544)

    • Reads the BIOS version

      • file.exe (PID: 6544)
      • axplong.exe (PID: 6700)
      • axplong.exe (PID: 7032)
      • axplong.exe (PID: 5940)

    • Reads security settings of Internet Explorer

      • file.exe (PID: 6544)
      • axplong.exe (PID: 6700)

    • Executable content was dropped or overwritten

      • file.exe (PID: 6544)

    • Reads the date of Windows installation

      • file.exe (PID: 6544)

    • Starts itself from another location

      • file.exe (PID: 6544)

    • Contacting a server suspected of hosting an CnC

      • axplong.exe (PID: 6700)

    • Connects to the server without a host name

      • axplong.exe (PID: 6700)

    • The process executes via Task Scheduler

      • axplong.exe (PID: 7032)
      • axplong.exe (PID: 5940)

  • INFO

    • Reads the computer name

      • file.exe (PID: 6544)
      • axplong.exe (PID: 6700)

    • Checks supported languages

      • file.exe (PID: 6544)
      • axplong.exe (PID: 6700)
      • axplong.exe (PID: 7032)
      • axplong.exe (PID: 5940)

    • Reads Environment values

      • file.exe (PID: 6544)
      • axplong.exe (PID: 6700)

    • Create files in a temporary directory

      • file.exe (PID: 6544)

    • Process checks computer location settings

      • file.exe (PID: 6544)

    • Checks proxy server information

      • axplong.exe (PID: 6700)

    • Themida protector has been detected

      • axplong.exe (PID: 6700)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(6700) axplong.exe
C2185.215.113.16
URLhttp://185.215.113.16/Jo89Ku7d/index.php
Version4.41
Options
Drop directory44111dbc49
Drop nameaxplong.exe
Strings (119)ESET
|
zip
CurrentBuild
&& Exit"
Kaspersky Lab
<c>
vs:
abcdefghijklmnopqrstuvwxyz0123456789-_
\0000
\
id:
cred.dll
dm:
shutdown -s -t 0
------
Content-Type: multipart/form-data; boundary=----
360TotalSecurity
/Plugins/
+++
Programs
rundll32.exe
S-%lu-
cred.dll|clip.dll|
Startup
%-lu
=
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
WinDefender
Comodo
Bitdefender
ComputerName
kernel32.dll
cmd /C RMDIR /s/q
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
shell32.dll
/k
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Norton
ProgramData\
av:
Content-Disposition: form-data; name="data"; filename="
os:
/Jo89Ku7d/index.php
/quiet
bi:
:::
pc:
-unicode-
clip.dll
%USERPROFILE%
2019
POST
" && timeout 1 && del
ar:
cmd
"
?scr=1
&&
exe
Rem
&unit=
sd:
e1
wb
4.41
http://
r=
random
rb
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
og:
Doctor Web
-executionpolicy remotesigned -File "
-%lu
d1
185.215.113.16
#
Sophos
------
" Content-Type: application/octet-stream
un:
.jpg
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
"taskkill /f /im "
AVAST Software
msi
lv:
44111dbc49
0123456789
st=s
GET
AVG
ProductName
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
\App
Avira
<d>
SOFTWARE\Microsoft\Windows NT\CurrentVersion
Content-Type: application/x-www-form-urlencoded
DefaultSettings.YResolution
Powershell.exe
e0
https://
Panda Security
2022
2016
e2
dll
" && ren
--
SYSTEM\ControlSet001\Services\BasicDisplay\Video
axplong.exe
rundll32
DefaultSettings.XResolution
VideoID
ps1
GetNativeSystemInfo
Main
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:25 12:10:38+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.24
CodeSize: 321024
InitializedDataSize: 117248
UninitializedDataSize: -
EntryPoint: 0x4c3000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
132
Monitored processes
4
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start file.exe #AMADEY axplong.exe axplong.exe axplong.exe

Process information

PID
CMD
Path
Indicators
Parent process
5940"C:\Users\admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\admin\AppData\Local\Temp\44111dbc49\axplong.exe
svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\44111dbc49\axplong.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
6544"C:\Users\admin\AppData\Local\Temp\file.exe" C:\Users\admin\AppData\Local\Temp\file.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\file.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6700"C:\Users\admin\AppData\Local\Temp\44111dbc49\axplong.exe" C:\Users\admin\AppData\Local\Temp\44111dbc49\axplong.exe
file.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\44111dbc49\axplong.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Amadey
(PID) Process(6700) axplong.exe
C2185.215.113.16
URLhttp://185.215.113.16/Jo89Ku7d/index.php
Version4.41
Options
Drop directory44111dbc49
Drop nameaxplong.exe
Strings (119)ESET
|
zip
CurrentBuild
&& Exit"
Kaspersky Lab
<c>
vs:
abcdefghijklmnopqrstuvwxyz0123456789-_
\0000
\
id:
cred.dll
dm:
shutdown -s -t 0
------
Content-Type: multipart/form-data; boundary=----
360TotalSecurity
/Plugins/
+++
Programs
rundll32.exe
S-%lu-
cred.dll|clip.dll|
Startup
%-lu
=
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
WinDefender
Comodo
Bitdefender
ComputerName
kernel32.dll
cmd /C RMDIR /s/q
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
shell32.dll
/k
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Norton
ProgramData\
av:
Content-Disposition: form-data; name="data"; filename="
os:
/Jo89Ku7d/index.php
/quiet
bi:
:::
pc:
-unicode-
clip.dll
%USERPROFILE%
2019
POST
" && timeout 1 && del
ar:
cmd
"
?scr=1
&&
exe
Rem
&unit=
sd:
e1
wb
4.41
http://
r=
random
rb
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
og:
Doctor Web
-executionpolicy remotesigned -File "
-%lu
d1
185.215.113.16
#
Sophos
------
" Content-Type: application/octet-stream
un:
.jpg
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
"taskkill /f /im "
AVAST Software
msi
lv:
44111dbc49
0123456789
st=s
GET
AVG
ProductName
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
\App
Avira
<d>
SOFTWARE\Microsoft\Windows NT\CurrentVersion
Content-Type: application/x-www-form-urlencoded
DefaultSettings.YResolution
Powershell.exe
e0
https://
Panda Security
2022
2016
e2
dll
" && ren
--
SYSTEM\ControlSet001\Services\BasicDisplay\Video
axplong.exe
rundll32
DefaultSettings.XResolution
VideoID
ps1
GetNativeSystemInfo
Main
7032"C:\Users\admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\admin\AppData\Local\Temp\44111dbc49\axplong.exe
svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\44111dbc49\axplong.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
Total events
4 205
Read events
4 186
Write events
19
Delete events
0

Modification events

(PID) Process:(6544) file.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6544) file.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6544) file.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6544) file.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6700) axplong.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6700) axplong.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6700) axplong.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6700) axplong.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6700) axplong.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6700) axplong.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
Executable files
1
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6544file.exeC:\Users\admin\AppData\Local\Temp\44111dbc49\axplong.exeexecutable
MD5:B2ED31D82898F46AA1A3B0EB1E0FB2CE
SHA256:3416C215EE14749E6341F4A4AA2AC79D4D0611AA69CC0F7A5DA14BF13545D3AC
6544file.exeC:\Windows\Tasks\axplong.jobbinary
MD5:ABF4C21D2DAB66AFA481C3C39DCEAA42
SHA256:32D566032BF9F45565D2D3DB692372A955B295E820E1B8EFE2565CE6A6815E59
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
46
DNS requests
17
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6700
axplong.exe
POST
200
185.215.113.16:80
http://185.215.113.16/Jo89Ku7d/index.php
unknown
—
—
unknown
6700
axplong.exe
POST
200
185.215.113.16:80
http://185.215.113.16/Jo89Ku7d/index.php
unknown
—
—
unknown
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2456
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2456
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6456
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6444
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4088
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4308
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2120
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6700
axplong.exe
185.215.113.16:80
—
1337team Limited
SC
malicious
4088
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5336
SearchApp.exe
104.126.37.170:443
www.bing.com
Akamai International B.V.
DE
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2456
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
  • 51.124.78.146
whitelisted
google.com
  • 142.250.184.238
whitelisted
www.bing.com
  • 104.126.37.170
  • 104.126.37.176
  • 104.126.37.137
  • 104.126.37.139
  • 104.126.37.163
  • 104.126.37.162
  • 104.126.37.155
  • 104.126.37.153
  • 104.126.37.136
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.0
  • 20.190.159.2
  • 40.126.31.69
  • 20.190.159.23
  • 40.126.31.71
  • 40.126.31.67
  • 40.126.31.73
  • 20.190.159.75
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
th.bing.com
  • 104.126.37.137
  • 104.126.37.163
  • 104.126.37.139
  • 104.126.37.162
  • 104.126.37.170
  • 104.126.37.136
  • 104.126.37.155
  • 104.126.37.176
  • 104.126.37.144
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

PID
Process
Class
Message
6700
axplong.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 33
6700
axplong.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
1 ETPRO signatures available at the full report
Process
Message
file.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
axplong.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
axplong.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
axplong.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------