File name:

3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe

Full analysis: https://app.any.run/tasks/a02e750f-3b4b-4efe-9107-92a419a64376
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: July 08, 2024, 10:24:27
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
stealc
loader
antivm
amadey
botnet
themida
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

372C9047C2F9BC0241A64B506054FA0A

SHA1:

A3DCA1DC8B61381C1FCA9F6951352AA5F6A2403F

SHA256:

3781240686F18F44CFB8397DFE462C164A00F0C4B08177B468129BC8C41A1F22

SSDEEP:

98304:DOw7SLZfcraki12jyNr2yy8BXo5M2UahFhSn91TKYNjOnMCqzBuFn6JQlvmd7f4E:oB/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
      • HCFBKKEBKE.exe (PID: 6612)
      • explorti.exe (PID: 1220)

    • Steals credentials from Web Browsers

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)

    • Connects to the CnC server

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
      • explorti.exe (PID: 1220)

    • STEALC has been detected (SURICATA)

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)

    • STEALC has been detected (YARA)

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)

    • AMADEY has been detected (YARA)

      • explorti.exe (PID: 1220)

    • AMADEY has been detected (SURICATA)

      • explorti.exe (PID: 1220)

    • Actions looks like stealing of personal data

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)

  • SUSPICIOUS

    • There is functionality for VM detection (VirtualBox)

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)

    • Process drops legitimate windows executable

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)

    • Reads security settings of Internet Explorer

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
      • HCFBKKEBKE.exe (PID: 6612)
      • IJECAEHJJJ.exe (PID: 6932)
      • explorti.exe (PID: 1220)

    • Windows Defender mutex has been found

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)

    • Searches for installed software

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)

    • Executable content was dropped or overwritten

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
      • HCFBKKEBKE.exe (PID: 6612)
      • explorti.exe (PID: 1220)

    • Starts CMD.EXE for commands execution

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
      • explorti.exe (PID: 1220)

    • Reads the date of Windows installation

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
      • HCFBKKEBKE.exe (PID: 6612)
      • IJECAEHJJJ.exe (PID: 6932)
      • explorti.exe (PID: 1220)

    • Reads the BIOS version

      • HCFBKKEBKE.exe (PID: 6612)
      • IJECAEHJJJ.exe (PID: 6932)
      • explorti.exe (PID: 1220)
      • explorti.exe (PID: 4092)
      • explorti.exe (PID: 6360)
      • explorti.exe (PID: 8424)

    • The executable file from the user directory is run by the CMD process

      • IJECAEHJJJ.exe (PID: 6932)
      • HCFBKKEBKE.exe (PID: 6612)

    • Starts itself from another location

      • HCFBKKEBKE.exe (PID: 6612)
      • IJECAEHJJJ.exe (PID: 6932)

    • There is functionality for taking screenshot (YARA)

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)

    • The process drops Mozilla's DLL files

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)

    • The process drops C-runtime libraries

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)

    • The process executes via Task Scheduler

      • explorti.exe (PID: 6360)
      • explorti.exe (PID: 8424)

    • Contacting a server suspected of hosting an CnC

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
      • explorti.exe (PID: 1220)

    • Potential Corporate Privacy Violation

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
      • explorti.exe (PID: 1220)

    • Executing commands from ".cmd" file

      • explorti.exe (PID: 1220)

    • Connects to the server without a host name

      • explorti.exe (PID: 1220)

  • INFO

    • Checks supported languages

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
      • IJECAEHJJJ.exe (PID: 6932)
      • HCFBKKEBKE.exe (PID: 6612)
      • explorti.exe (PID: 1220)
      • explorti.exe (PID: 4092)
      • explorti.exe (PID: 6360)
      • explorti.exe (PID: 8424)

    • Checks proxy server information

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
      • explorti.exe (PID: 1220)

    • Reads the computer name

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
      • HCFBKKEBKE.exe (PID: 6612)
      • IJECAEHJJJ.exe (PID: 6932)
      • explorti.exe (PID: 1220)

    • Reads Environment values

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
      • HCFBKKEBKE.exe (PID: 6612)
      • IJECAEHJJJ.exe (PID: 6932)
      • explorti.exe (PID: 1220)

    • Reads CPU info

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)

    • Reads product name

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)

    • Process checks computer location settings

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
      • HCFBKKEBKE.exe (PID: 6612)
      • IJECAEHJJJ.exe (PID: 6932)
      • explorti.exe (PID: 1220)

    • Create files in a temporary directory

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
      • HCFBKKEBKE.exe (PID: 6612)
      • explorti.exe (PID: 1220)

    • Creates files in the program directory

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)

    • Creates files or folders in the user directory

      • explorti.exe (PID: 1220)
      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)

    • Application launched itself

      • msedge.exe (PID: 3776)
      • firefox.exe (PID: 2916)
      • chrome.exe (PID: 5508)
      • firefox.exe (PID: 2292)

    • Reads Microsoft Office registry keys

      • msedge.exe (PID: 3776)
      • firefox.exe (PID: 2916)
      • chrome.exe (PID: 5508)

    • Reads the software policy settings

      • slui.exe (PID: 4356)

    • Themida protector has been detected

      • explorti.exe (PID: 1220)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Stealc

(PID) Process(3724) 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
C285.28.47.30
Strings (102)INSERT_KEY_HERE
22
07
20
24
GetProcAddress
LoadLibraryA
lstrcatA
OpenEventA
CreateEventA
CloseHandle
Sleep
GetUserDefaultLangID
VirtualAllocExNuma
VirtualFree
GetSystemInfo
VirtualAlloc
HeapAlloc
GetComputerNameA
lstrcpyA
GetProcessHeap
GetCurrentProcess
lstrlenA
ExitProcess
GlobalMemoryStatusEx
GetSystemTime
SystemTimeToFileTime
advapi32.dll
gdi32.dll
user32.dll
crypt32.dll
ntdll.dll
GetUserNameA
CreateDCA
GetDeviceCaps
ReleaseDC
CryptStringToBinaryA
sscanf
VMwareVMware
HAL9TH
JohnDoe
DISPLAY
%hu/%hu/%hu
http://85.28.47.30
/920475a59bac849d.php
/69934896f997d5bb/
Nice
GetEnvironmentVariableA
GetFileAttributesA
GlobalLock
HeapFree
GetFileSize
GlobalSize
CreateToolhelp32Snapshot
IsWow64Process
Process32Next
GetLocalTime
FreeLibrary
GetTimeZoneInformation
GetSystemPowerStatus
GetVolumeInformationA
GetWindowsDirectoryA
Process32First
GetLocaleInfoA
GetUserDefaultLocaleName
GetModuleFileNameA
DeleteFileA
FindNextFileA
LocalFree
FindClose
SetEnvironmentVariableA
LocalAlloc
GetFileSizeEx
ReadFile
SetFilePointer
WriteFile
CreateFileA
FindFirstFileA
CopyFileA
VirtualProtect
GetLogicalProcessorInformationEx
GetLastError
lstrcpynA
MultiByteToWideChar
GlobalFree
WideCharToMultiByte
GlobalAlloc
OpenProcess
TerminateProcess
GetCurrentProcessId
gdiplus.dll
ole32.dll
bcrypt.dll
wininet.dll
shlwapi.dll
shell32.dll
psapi.dll
rstrtmgr.dll
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteObject

Amadey

(PID) Process(1220) explorti.exe
C277.91.77.82
URLhttp://77.91.77.82/Hun4Ko/index.php
Version4.30
Options
Drop directoryad40971b6b
Drop nameexplorti.exe
Strings (113)Content-Disposition: form-data; name="data"; filename="
ar:
/k
DefaultSettings.XResolution
SOFTWARE\Microsoft\Windows NT\CurrentVersion
abcdefghijklmnopqrstuvwxyz0123456789-_
random
Norton
rb
sd:
Doctor Web
2022
\0000
id:
/Hun4Ko/index.php
#
kernel32.dll
.jpg
AVAST Software
"taskkill /f /im "
lv:
S-%lu-
shutdown -s -t 0
&& Exit"
e0
ProgramData\
\
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
explorti.exe
dm:
pc:
av:
st=s
Kaspersky Lab
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Avira
Startup
exe
|
+++
http://
-unicode-
2016
Programs
\App
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
og:
vs:
rundll32
d1
un:
AVG
Bitdefender
Content-Type: application/x-www-form-urlencoded
-%lu
" Content-Type: application/octet-stream
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
VideoID
cmd
<c>
ComputerName
Sophos
GetNativeSystemInfo
------
77.91.77.82
Content-Type: multipart/form-data; boundary=----
Panda Security
" && timeout 1 && del
:::
https://
2019
POST
4.30
SYSTEM\ControlSet001\Services\BasicDisplay\Video
GET
CurrentBuild
------
bi:
ProductName
"
360TotalSecurity
Powershell.exe
ESET
DefaultSettings.YResolution
%-lu
cmd /C RMDIR /s/q
%USERPROFILE%
ps1
dll
/Plugins/
" && ren
<d>
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
cred.dll|clip.dll|
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Comodo
&&
Main
wb
rundll32.exe
ad40971b6b
Rem
os:
shell32.dll
--
WinDefender
?scr=1
0123456789
e1
-executionpolicy remotesigned -File "
=
r=
&unit=
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:04 18:15:36+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 109568
InitializedDataSize: 2222080
UninitializedDataSize: -
EntryPoint: 0xbfb960
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
184
Monitored processes
46
Malicious processes
7
Suspicious processes
2

Behavior graph

Click at the process to see the details
start THREAT 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe sppextcomobj.exe no specs slui.exe cmd.exe no specs conhost.exe no specs hcfbkkebke.exe cmd.exe no specs conhost.exe no specs ijecaehjjj.exe #AMADEY explorti.exe explorti.exe explorti.exe cmd.exe no specs conhost.exe no specs chrome.exe msedge.exe firefox.exe no specs msedge.exe no specs firefox.exe msedge.exe no specs msedge.exe firefox.exe no specs chrome.exe no specs firefox.exe no specs msedge.exe no specs firefox.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs firefox.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs msedge.exe no specs slui.exe no specs explorti.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
776"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2264 --field-trial-handle=2352,i,12484991983409855011,8553159130456685610,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1220"C:\Users\admin\AppData\Local\Temp\ad40971b6b\explorti.exe" C:\Users\admin\AppData\Local\Temp\ad40971b6b\explorti.exe
HCFBKKEBKE.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\ad40971b6b\explorti.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Amadey
(PID) Process(1220) explorti.exe
C277.91.77.82
URLhttp://77.91.77.82/Hun4Ko/index.php
Version4.30
Options
Drop directoryad40971b6b
Drop nameexplorti.exe
Strings (113)Content-Disposition: form-data; name="data"; filename="
ar:
/k
DefaultSettings.XResolution
SOFTWARE\Microsoft\Windows NT\CurrentVersion
abcdefghijklmnopqrstuvwxyz0123456789-_
random
Norton
rb
sd:
Doctor Web
2022
\0000
id:
/Hun4Ko/index.php
#
kernel32.dll
.jpg
AVAST Software
"taskkill /f /im "
lv:
S-%lu-
shutdown -s -t 0
&& Exit"
e0
ProgramData\
\
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
explorti.exe
dm:
pc:
av:
st=s
Kaspersky Lab
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Avira
Startup
exe
|
+++
http://
-unicode-
2016
Programs
\App
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
og:
vs:
rundll32
d1
un:
AVG
Bitdefender
Content-Type: application/x-www-form-urlencoded
-%lu
" Content-Type: application/octet-stream
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
VideoID
cmd
<c>
ComputerName
Sophos
GetNativeSystemInfo
------
77.91.77.82
Content-Type: multipart/form-data; boundary=----
Panda Security
" && timeout 1 && del
:::
https://
2019
POST
4.30
SYSTEM\ControlSet001\Services\BasicDisplay\Video
GET
CurrentBuild
------
bi:
ProductName
"
360TotalSecurity
Powershell.exe
ESET
DefaultSettings.YResolution
%-lu
cmd /C RMDIR /s/q
%USERPROFILE%
ps1
dll
/Plugins/
" && ren
<d>
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
cred.dll|clip.dll|
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Comodo
&&
Main
wb
rundll32.exe
ad40971b6b
Rem
os:
shell32.dll
--
WinDefender
?scr=1
0123456789
e1
-executionpolicy remotesigned -File "
=
r=
&unit=
2028\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2216"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3528 --field-trial-handle=2352,i,12484991983409855011,8553159130456685610,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2292"C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"C:\Program Files\Mozilla Firefox\firefox.exe—cmd.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\program files\mozilla firefox\vcruntime140_1.dll
2916"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/accountC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
3616C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\1000008021\ec50648a98.cmd" "C:\Windows\SysWOW64\cmd.exe—explorti.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3616"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4152 --field-trial-handle=2352,i,12484991983409855011,8553159130456685610,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3724"C:\Users\admin\AppData\Local\Temp\3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe" C:\Users\admin\AppData\Local\Temp\3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Stealc
(PID) Process(3724) 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
C285.28.47.30
Strings (102)INSERT_KEY_HERE
22
07
20
24
GetProcAddress
LoadLibraryA
lstrcatA
OpenEventA
CreateEventA
CloseHandle
Sleep
GetUserDefaultLangID
VirtualAllocExNuma
VirtualFree
GetSystemInfo
VirtualAlloc
HeapAlloc
GetComputerNameA
lstrcpyA
GetProcessHeap
GetCurrentProcess
lstrlenA
ExitProcess
GlobalMemoryStatusEx
GetSystemTime
SystemTimeToFileTime
advapi32.dll
gdi32.dll
user32.dll
crypt32.dll
ntdll.dll
GetUserNameA
CreateDCA
GetDeviceCaps
ReleaseDC
CryptStringToBinaryA
sscanf
VMwareVMware
HAL9TH
JohnDoe
DISPLAY
%hu/%hu/%hu
http://85.28.47.30
/920475a59bac849d.php
/69934896f997d5bb/
Nice
GetEnvironmentVariableA
GetFileAttributesA
GlobalLock
HeapFree
GetFileSize
GlobalSize
CreateToolhelp32Snapshot
IsWow64Process
Process32Next
GetLocalTime
FreeLibrary
GetTimeZoneInformation
GetSystemPowerStatus
GetVolumeInformationA
GetWindowsDirectoryA
Process32First
GetLocaleInfoA
GetUserDefaultLocaleName
GetModuleFileNameA
DeleteFileA
FindNextFileA
LocalFree
FindClose
SetEnvironmentVariableA
LocalAlloc
GetFileSizeEx
ReadFile
SetFilePointer
WriteFile
CreateFileA
FindFirstFileA
CopyFileA
VirtualProtect
GetLogicalProcessorInformationEx
GetLastError
lstrcpynA
MultiByteToWideChar
GlobalFree
WideCharToMultiByte
GlobalAlloc
OpenProcess
TerminateProcess
GetCurrentProcessId
gdiplus.dll
ole32.dll
bcrypt.dll
wininet.dll
shlwapi.dll
shell32.dll
psapi.dll
rstrtmgr.dll
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteObject
3748\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
33 572
Read events
33 474
Write events
96
Delete events
2

Modification events

(PID) Process:(3724) 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3724) 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3724) 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3724) 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3724) 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3724) 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3724) 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6612) HCFBKKEBKE.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6612) HCFBKKEBKE.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6612) HCFBKKEBKE.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
Executable files
18
Suspicious files
234
Text files
78
Unknown types
7

Dropped files

PID
Process
Filename
Type
37243781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeC:\ProgramData\msvcp140.dllexecutable
MD5:5FF1FCA37C466D6723EC67BE93B51442
SHA256:5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
37243781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeC:\ProgramData\IJKKKFCFHCFIECBGDHIDsqlite
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
37243781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeC:\ProgramData\KFCAFIIDHIDGHIECGDGIDHCGCF —
MD5:—
SHA256:—
37243781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeC:\ProgramData\FCFBFBFBKFIDHJKFCAFCFBKJEBsqlite
MD5:F22EDD4E28E57033993F2F3E6F879EB8
SHA256:4EA1511F508E6DA130F9CE4220C3BBD8635AA0BEB4836542222C300641278356
37243781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\freebl3[1].dllexecutable
MD5:550686C0EE48C386DFCB40199BD076AC
SHA256:EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
37243781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeC:\ProgramData\FBFIDBFHsqlite
MD5:77A1AFF2DA29DD2F8E9E6B2A0CDE8562
SHA256:C479E249237494E65B4D4220499072D69829E6649DEC2B4FB8762256A55D6AB6
37243781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeC:\ProgramData\freebl3.dllexecutable
MD5:550686C0EE48C386DFCB40199BD076AC
SHA256:EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
37243781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeC:\ProgramData\DHCBGDHIsqlite
MD5:F6C33AC5E1032A0873BE7BFC65169287
SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83
37243781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeC:\ProgramData\GDAAKKEHDHCAAAKFCBAKKEHIECbinary
MD5:06AD9E737639FDC745B3B65312857109
SHA256:C8925892CA8E213746633033AE95ACFB8DD9531BC376B82066E686AC6F40A404
37243781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeC:\ProgramData\vcruntime140.dllexecutable
MD5:A37EE36B536409056A86F50E67777DD7
SHA256:8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
68
TCP/UDP connections
170
DNS requests
175
Threats
37

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
POST
200
85.28.47.30:80
http://85.28.47.30/920475a59bac849d.php
unknown
—
—
unknown
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
POST
200
85.28.47.30:80
http://85.28.47.30/920475a59bac849d.php
unknown
—
—
unknown
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
POST
200
85.28.47.30:80
http://85.28.47.30/920475a59bac849d.php
unknown
—
—
unknown
3992
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
2248
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
POST
200
85.28.47.30:80
http://85.28.47.30/920475a59bac849d.php
unknown
—
—
unknown
2248
MoUsoCoreWorker.exe
GET
200
2.16.164.9:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
POST
200
85.28.47.30:80
http://85.28.47.30/920475a59bac849d.php
unknown
—
—
unknown
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
POST
200
85.28.47.30:80
http://85.28.47.30/920475a59bac849d.php
unknown
—
—
unknown
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
POST
200
85.28.47.30:80
http://85.28.47.30/920475a59bac849d.php
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2252
RUXIMICS.exe
20.106.86.13:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
85.28.47.30:80
—
—
RU
malicious
3992
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3992
svchost.exe
192.229.221.95:80
fp2e7a.wpc.phicdn.net
EDGECAST
US
whitelisted
2248
MoUsoCoreWorker.exe
2.16.164.9:80
crl.microsoft.com
Akamai International B.V.
NL
unknown
2248
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.23.209.157:443
—
Akamai International B.V.
GB
unknown

DNS requests

Domain
IP
Reputation
login.live.com
  • 20.190.159.0
  • 20.190.159.68
  • 20.190.159.71
  • 40.126.31.67
  • 20.190.159.64
  • 40.126.31.73
  • 40.126.31.71
  • 20.190.159.73
whitelisted
crl.microsoft.com
  • 2.16.164.9
  • 2.16.164.106
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 184.30.21.171
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
go.microsoft.com
  • 23.218.210.69
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.13
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
arc.msn.com
  • 20.74.47.205
whitelisted
www.bing.com
  • 92.123.104.11
  • 92.123.104.18
  • 92.123.104.15
  • 92.123.104.19
  • 92.123.104.14
  • 92.123.104.13
  • 92.123.104.16
  • 92.123.104.12
  • 92.123.104.17
  • 104.126.37.186
  • 104.126.37.161
  • 104.126.37.178
  • 104.126.37.171
  • 104.126.37.128
  • 104.126.37.177
  • 104.126.37.139
  • 104.126.37.131
  • 104.126.37.144
whitelisted
fd.api.iris.microsoft.com
  • 20.105.99.58
whitelisted

Threats

PID
Process
Class
Message
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 9
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] Stealc
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/Stealc Requesting browsers Config from C2
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
Malware Command and Control Activity Detected
ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/Stealc Requesting plugins Config from C2
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
A suspicious filename was detected
ET HUNTING HTTP GET Request for sqlite3.dll - Possible Infostealer Activity
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/Stealc Submitting System Information to C2
3 ETPRO signatures available at the full report
Process
Message
HCFBKKEBKE.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
IJECAEHJJJ.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
explorti.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
explorti.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
explorti.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
explorti.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe