analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe

Full analysis: https://app.any.run/tasks/a02e750f-3b4b-4efe-9107-92a419a64376
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: July 08, 2024, 10:24:27
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
stealc
loader
antivm
amadey
botnet
themida
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

372C9047C2F9BC0241A64B506054FA0A

SHA1:

A3DCA1DC8B61381C1FCA9F6951352AA5F6A2403F

SHA256:

3781240686F18F44CFB8397DFE462C164A00F0C4B08177B468129BC8C41A1F22

SSDEEP:

98304:DOw7SLZfcraki12jyNr2yy8BXo5M2UahFhSn91TKYNjOnMCqzBuFn6JQlvmd7f4E:oB/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Drops the executable file immediately after the start

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
      • HCFBKKEBKE.exe (PID: 6612)
      • explorti.exe (PID: 1220)
    • STEALC has been detected (YARA)

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
    • Steals credentials from Web Browsers

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
    • Connects to the CnC server

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
      • explorti.exe (PID: 1220)
    • AMADEY has been detected (SURICATA)

      • explorti.exe (PID: 1220)
    • STEALC has been detected (SURICATA)

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
    • AMADEY has been detected (YARA)

      • explorti.exe (PID: 1220)
    • Actions looks like stealing of personal data

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
  • SUSPICIOUS

    • Windows Defender mutex has been found

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
    • Reads security settings of Internet Explorer

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
      • HCFBKKEBKE.exe (PID: 6612)
      • IJECAEHJJJ.exe (PID: 6932)
      • explorti.exe (PID: 1220)
    • Searches for installed software

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
    • Executable content was dropped or overwritten

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
      • HCFBKKEBKE.exe (PID: 6612)
      • explorti.exe (PID: 1220)
    • The process drops Mozilla's DLL files

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
    • The process drops C-runtime libraries

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
    • Process drops legitimate windows executable

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
    • There is functionality for taking screenshot (YARA)

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
    • Reads the date of Windows installation

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
      • HCFBKKEBKE.exe (PID: 6612)
      • IJECAEHJJJ.exe (PID: 6932)
      • explorti.exe (PID: 1220)
    • There is functionality for VM detection (VirtualBox)

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
    • Starts CMD.EXE for commands execution

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
      • explorti.exe (PID: 1220)
    • The executable file from the user directory is run by the CMD process

      • HCFBKKEBKE.exe (PID: 6612)
      • IJECAEHJJJ.exe (PID: 6932)
    • Reads the BIOS version

      • HCFBKKEBKE.exe (PID: 6612)
      • IJECAEHJJJ.exe (PID: 6932)
      • explorti.exe (PID: 1220)
      • explorti.exe (PID: 4092)
      • explorti.exe (PID: 6360)
      • explorti.exe (PID: 8424)
    • Starts itself from another location

      • HCFBKKEBKE.exe (PID: 6612)
      • IJECAEHJJJ.exe (PID: 6932)
    • The process executes via Task Scheduler

      • explorti.exe (PID: 6360)
      • explorti.exe (PID: 8424)
    • Contacting a server suspected of hosting an CnC

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
      • explorti.exe (PID: 1220)
    • Potential Corporate Privacy Violation

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
      • explorti.exe (PID: 1220)
    • Executing commands from ".cmd" file

      • explorti.exe (PID: 1220)
    • Connects to the server without a host name

      • explorti.exe (PID: 1220)
  • INFO

    • Checks supported languages

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
      • HCFBKKEBKE.exe (PID: 6612)
      • IJECAEHJJJ.exe (PID: 6932)
      • explorti.exe (PID: 1220)
      • explorti.exe (PID: 4092)
      • explorti.exe (PID: 6360)
      • explorti.exe (PID: 8424)
    • Reads the computer name

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
      • HCFBKKEBKE.exe (PID: 6612)
      • IJECAEHJJJ.exe (PID: 6932)
      • explorti.exe (PID: 1220)
    • Checks proxy server information

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
      • explorti.exe (PID: 1220)
    • Reads product name

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
    • Reads Environment values

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
      • HCFBKKEBKE.exe (PID: 6612)
      • IJECAEHJJJ.exe (PID: 6932)
      • explorti.exe (PID: 1220)
    • Reads CPU info

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
    • Creates files in the program directory

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
    • Creates files or folders in the user directory

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
      • explorti.exe (PID: 1220)
    • Create files in a temporary directory

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
      • HCFBKKEBKE.exe (PID: 6612)
      • explorti.exe (PID: 1220)
    • Process checks computer location settings

      • 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe (PID: 3724)
      • HCFBKKEBKE.exe (PID: 6612)
      • IJECAEHJJJ.exe (PID: 6932)
      • explorti.exe (PID: 1220)
    • Application launched itself

      • firefox.exe (PID: 2292)
      • msedge.exe (PID: 3776)
      • firefox.exe (PID: 2916)
      • chrome.exe (PID: 5508)
    • Reads Microsoft Office registry keys

      • msedge.exe (PID: 3776)
      • firefox.exe (PID: 2916)
      • chrome.exe (PID: 5508)
    • Themida protector has been detected

      • explorti.exe (PID: 1220)
    • Reads the software policy settings

      • slui.exe (PID: 4356)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Stealc

(PID) Process(3724) 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
C285.28.47.30
Strings (102)INSERT_KEY_HERE
22
07
20
24
GetProcAddress
LoadLibraryA
lstrcatA
OpenEventA
CreateEventA
CloseHandle
Sleep
GetUserDefaultLangID
VirtualAllocExNuma
VirtualFree
GetSystemInfo
VirtualAlloc
HeapAlloc
GetComputerNameA
lstrcpyA
GetProcessHeap
GetCurrentProcess
lstrlenA
ExitProcess
GlobalMemoryStatusEx
GetSystemTime
SystemTimeToFileTime
advapi32.dll
gdi32.dll
user32.dll
crypt32.dll
ntdll.dll
GetUserNameA
CreateDCA
GetDeviceCaps
ReleaseDC
CryptStringToBinaryA
sscanf
VMwareVMware
HAL9TH
JohnDoe
DISPLAY
%hu/%hu/%hu
http://85.28.47.30
/920475a59bac849d.php
/69934896f997d5bb/
Nice
GetEnvironmentVariableA
GetFileAttributesA
GlobalLock
HeapFree
GetFileSize
GlobalSize
CreateToolhelp32Snapshot
IsWow64Process
Process32Next
GetLocalTime
FreeLibrary
GetTimeZoneInformation
GetSystemPowerStatus
GetVolumeInformationA
GetWindowsDirectoryA
Process32First
GetLocaleInfoA
GetUserDefaultLocaleName
GetModuleFileNameA
DeleteFileA
FindNextFileA
LocalFree
FindClose
SetEnvironmentVariableA
LocalAlloc
GetFileSizeEx
ReadFile
SetFilePointer
WriteFile
CreateFileA
FindFirstFileA
CopyFileA
VirtualProtect
GetLogicalProcessorInformationEx
GetLastError
lstrcpynA
MultiByteToWideChar
GlobalFree
WideCharToMultiByte
GlobalAlloc
OpenProcess
TerminateProcess
GetCurrentProcessId
gdiplus.dll
ole32.dll
bcrypt.dll
wininet.dll
shlwapi.dll
shell32.dll
psapi.dll
rstrtmgr.dll
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteObject

Amadey

(PID) Process(1220) explorti.exe
C277.91.77.82
URLhttp://77.91.77.82/Hun4Ko/index.php
Version4.30
Options
Drop directoryad40971b6b
Drop nameexplorti.exe
Strings (113)Content-Disposition: form-data; name="data"; filename="
ar:
/k
DefaultSettings.XResolution
SOFTWARE\Microsoft\Windows NT\CurrentVersion
abcdefghijklmnopqrstuvwxyz0123456789-_
random
Norton
rb
sd:
Doctor Web
2022
\0000
id:
/Hun4Ko/index.php
#
kernel32.dll
.jpg
AVAST Software
"taskkill /f /im "
lv:
S-%lu-
shutdown -s -t 0
&& Exit"
e0
ProgramData\
\
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
explorti.exe
dm:
pc:
av:
st=s
Kaspersky Lab
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Avira
Startup
exe
|
+++
http://
-unicode-
2016
Programs
\App
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
og:
vs:
rundll32
d1
un:
AVG
Bitdefender
Content-Type: application/x-www-form-urlencoded
-%lu
" Content-Type: application/octet-stream
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
VideoID
cmd
<c>
ComputerName
Sophos
GetNativeSystemInfo
------
77.91.77.82
Content-Type: multipart/form-data; boundary=----
Panda Security
" && timeout 1 && del
:::
https://
2019
POST
4.30
SYSTEM\ControlSet001\Services\BasicDisplay\Video
GET
CurrentBuild
------
bi:
ProductName
"
360TotalSecurity
Powershell.exe
ESET
DefaultSettings.YResolution
%-lu
cmd /C RMDIR /s/q
%USERPROFILE%
ps1
dll
/Plugins/
" && ren
<d>
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
cred.dll|clip.dll|
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Comodo
&&
Main
wb
rundll32.exe
ad40971b6b
Rem
os:
shell32.dll
--
WinDefender
?scr=1
0123456789
e1
-executionpolicy remotesigned -File "
=
r=
&unit=
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0xbfb960
UninitializedDataSize: -
InitializedDataSize: 2222080
CodeSize: 109568
LinkerVersion: 10
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2024:07:04 18:15:36+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
184
Monitored processes
46
Malicious processes
7
Suspicious processes
2

Behavior graph

Click at the process to see the details
start THREAT 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe sppextcomobj.exe no specs slui.exe cmd.exe no specs conhost.exe no specs hcfbkkebke.exe cmd.exe no specs conhost.exe no specs ijecaehjjj.exe #AMADEY explorti.exe explorti.exe explorti.exe cmd.exe no specs conhost.exe no specs chrome.exe msedge.exe firefox.exe no specs msedge.exe no specs firefox.exe msedge.exe no specs msedge.exe firefox.exe no specs chrome.exe no specs firefox.exe no specs msedge.exe no specs firefox.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs firefox.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs msedge.exe no specs slui.exe no specs explorti.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3724"C:\Users\admin\AppData\Local\Temp\3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe" C:\Users\admin\AppData\Local\Temp\3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Stealc
(PID) Process(3724) 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
C285.28.47.30
Strings (102)INSERT_KEY_HERE
22
07
20
24
GetProcAddress
LoadLibraryA
lstrcatA
OpenEventA
CreateEventA
CloseHandle
Sleep
GetUserDefaultLangID
VirtualAllocExNuma
VirtualFree
GetSystemInfo
VirtualAlloc
HeapAlloc
GetComputerNameA
lstrcpyA
GetProcessHeap
GetCurrentProcess
lstrlenA
ExitProcess
GlobalMemoryStatusEx
GetSystemTime
SystemTimeToFileTime
advapi32.dll
gdi32.dll
user32.dll
crypt32.dll
ntdll.dll
GetUserNameA
CreateDCA
GetDeviceCaps
ReleaseDC
CryptStringToBinaryA
sscanf
VMwareVMware
HAL9TH
JohnDoe
DISPLAY
%hu/%hu/%hu
http://85.28.47.30
/920475a59bac849d.php
/69934896f997d5bb/
Nice
GetEnvironmentVariableA
GetFileAttributesA
GlobalLock
HeapFree
GetFileSize
GlobalSize
CreateToolhelp32Snapshot
IsWow64Process
Process32Next
GetLocalTime
FreeLibrary
GetTimeZoneInformation
GetSystemPowerStatus
GetVolumeInformationA
GetWindowsDirectoryA
Process32First
GetLocaleInfoA
GetUserDefaultLocaleName
GetModuleFileNameA
DeleteFileA
FindNextFileA
LocalFree
FindClose
SetEnvironmentVariableA
LocalAlloc
GetFileSizeEx
ReadFile
SetFilePointer
WriteFile
CreateFileA
FindFirstFileA
CopyFileA
VirtualProtect
GetLogicalProcessorInformationEx
GetLastError
lstrcpynA
MultiByteToWideChar
GlobalFree
WideCharToMultiByte
GlobalAlloc
OpenProcess
TerminateProcess
GetCurrentProcessId
gdiplus.dll
ole32.dll
bcrypt.dll
wininet.dll
shlwapi.dll
shell32.dll
psapi.dll
rstrtmgr.dll
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteObject
5776C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exesvchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4356"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4720"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\admin\AppData\Local\Temp\HCFBKKEBKE.exe"C:\Windows\SysWOW64\cmd.exe3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2028\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6612"C:\Users\admin\AppData\Local\Temp\HCFBKKEBKE.exe" C:\Users\admin\AppData\Local\Temp\HCFBKKEBKE.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\hcfbkkebke.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4180"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\admin\AppData\Local\Temp\IJECAEHJJJ.exe"C:\Windows\SysWOW64\cmd.exe3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3748\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6932"C:\Users\admin\AppData\Local\Temp\IJECAEHJJJ.exe" C:\Users\admin\AppData\Local\Temp\IJECAEHJJJ.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ijecaehjjj.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1220"C:\Users\admin\AppData\Local\Temp\ad40971b6b\explorti.exe" C:\Users\admin\AppData\Local\Temp\ad40971b6b\explorti.exe
HCFBKKEBKE.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\ad40971b6b\explorti.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Amadey
(PID) Process(1220) explorti.exe
C277.91.77.82
URLhttp://77.91.77.82/Hun4Ko/index.php
Version4.30
Options
Drop directoryad40971b6b
Drop nameexplorti.exe
Strings (113)Content-Disposition: form-data; name="data"; filename="
ar:
/k
DefaultSettings.XResolution
SOFTWARE\Microsoft\Windows NT\CurrentVersion
abcdefghijklmnopqrstuvwxyz0123456789-_
random
Norton
rb
sd:
Doctor Web
2022
\0000
id:
/Hun4Ko/index.php
#
kernel32.dll
.jpg
AVAST Software
"taskkill /f /im "
lv:
S-%lu-
shutdown -s -t 0
&& Exit"
e0
ProgramData\
\
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
explorti.exe
dm:
pc:
av:
st=s
Kaspersky Lab
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Avira
Startup
exe
|
+++
http://
-unicode-
2016
Programs
\App
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
og:
vs:
rundll32
d1
un:
AVG
Bitdefender
Content-Type: application/x-www-form-urlencoded
-%lu
" Content-Type: application/octet-stream
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
VideoID
cmd
<c>
ComputerName
Sophos
GetNativeSystemInfo
------
77.91.77.82
Content-Type: multipart/form-data; boundary=----
Panda Security
" && timeout 1 && del
:::
https://
2019
POST
4.30
SYSTEM\ControlSet001\Services\BasicDisplay\Video
GET
CurrentBuild
------
bi:
ProductName
"
360TotalSecurity
Powershell.exe
ESET
DefaultSettings.YResolution
%-lu
cmd /C RMDIR /s/q
%USERPROFILE%
ps1
dll
/Plugins/
" && ren
<d>
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
cred.dll|clip.dll|
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Comodo
&&
Main
wb
rundll32.exe
ad40971b6b
Rem
os:
shell32.dll
--
WinDefender
?scr=1
0123456789
e1
-executionpolicy remotesigned -File "
=
r=
&unit=
Total events
33 572
Read events
33 474
Write events
96
Delete events
2

Modification events

(PID) Process:(3724) 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3724) 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3724) 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3724) 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3724) 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3724) 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3724) 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6612) HCFBKKEBKE.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6612) HCFBKKEBKE.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6612) HCFBKKEBKE.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
Executable files
18
Suspicious files
234
Text files
78
Unknown types
7

Dropped files

PID
Process
Filename
Type
37243781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeC:\ProgramData\IJKKKFCFHCFIECBGDHIDsqlite
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
37243781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeC:\ProgramData\GDHDHJEBGHJKFIECBGCBsqlite
MD5:29A644B1F0D96166A05602FE27B3F4AD
SHA256:BF96902FEB97E990A471492F78EE8386BCF430D66BDAEFDEAFBF912C8CF7CE46
37243781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeC:\ProgramData\FCFBFBFBKFIDHJKFCAFCFBKJEBsqlite
MD5:F22EDD4E28E57033993F2F3E6F879EB8
SHA256:4EA1511F508E6DA130F9CE4220C3BBD8635AA0BEB4836542222C300641278356
37243781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeC:\ProgramData\GDAAKKEHDHCAAAKFCBAKKEHIECbinary
MD5:06AD9E737639FDC745B3B65312857109
SHA256:C8925892CA8E213746633033AE95ACFB8DD9531BC376B82066E686AC6F40A404
37243781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeC:\ProgramData\KFCAFIIDHIDGHIECGDGIDHCGCF
MD5:
SHA256:
37243781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cookies.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
37243781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\softokn3[1].dllexecutable
MD5:4E52D739C324DB8225BD9AB2695F262F
SHA256:74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
37243781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\mozglue[1].dllexecutable
MD5:C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA256:BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
37243781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeC:\ProgramData\DHCBGDHIsqlite
MD5:F6C33AC5E1032A0873BE7BFC65169287
SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83
37243781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\vcruntime140[1].dllexecutable
MD5:A37EE36B536409056A86F50E67777DD7
SHA256:8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
68
TCP/UDP connections
170
DNS requests
175
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
POST
200
85.28.47.30:80
http://85.28.47.30/920475a59bac849d.php
unknown
unknown
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
POST
200
85.28.47.30:80
http://85.28.47.30/920475a59bac849d.php
unknown
unknown
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
POST
200
85.28.47.30:80
http://85.28.47.30/920475a59bac849d.php
unknown
unknown
3992
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
unknown
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
POST
200
85.28.47.30:80
http://85.28.47.30/920475a59bac849d.php
unknown
unknown
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
GET
200
85.28.47.30:80
http://85.28.47.30/69934896f997d5bb/sqlite3.dll
unknown
unknown
2248
MoUsoCoreWorker.exe
GET
200
2.16.164.9:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
unknown
2248
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
unknown
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
POST
200
85.28.47.30:80
http://85.28.47.30/920475a59bac849d.php
unknown
unknown
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
POST
200
85.28.47.30:80
http://85.28.47.30/920475a59bac849d.php
unknown
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4032
svchost.exe
239.255.255.250:1900
whitelisted
2252
RUXIMICS.exe
20.106.86.13:443
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
4
System
192.168.100.255:138
whitelisted
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
85.28.47.30:80
RU
malicious
3992
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3992
svchost.exe
192.229.221.95:80
fp2e7a.wpc.phicdn.net
EDGECAST
US
whitelisted
2248
MoUsoCoreWorker.exe
2.16.164.9:80
crl.microsoft.com
Akamai International B.V.
NL
unknown
2248
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2.23.209.157:443
Akamai International B.V.
GB
unknown

DNS requests

Domain
IP
Reputation
login.live.com
  • 20.190.159.0
  • 20.190.159.68
  • 20.190.159.71
  • 40.126.31.67
  • 20.190.159.64
  • 40.126.31.73
  • 40.126.31.71
  • 20.190.159.73
whitelisted
crl.microsoft.com
  • 2.16.164.9
  • 2.16.164.106
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 184.30.21.171
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
go.microsoft.com
  • 23.218.210.69
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.13
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
arc.msn.com
  • 20.74.47.205
whitelisted
www.bing.com
  • 92.123.104.11
  • 92.123.104.18
  • 92.123.104.15
  • 92.123.104.19
  • 92.123.104.14
  • 92.123.104.13
  • 92.123.104.16
  • 92.123.104.12
  • 92.123.104.17
  • 104.126.37.186
  • 104.126.37.161
  • 104.126.37.178
  • 104.126.37.171
  • 104.126.37.128
  • 104.126.37.177
  • 104.126.37.139
  • 104.126.37.131
  • 104.126.37.144
whitelisted
fd.api.iris.microsoft.com
  • 20.105.99.58
whitelisted

Threats

PID
Process
Class
Message
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 9
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] Stealc
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/Stealc Requesting browsers Config from C2
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
Malware Command and Control Activity Detected
ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/Stealc Requesting plugins Config from C2
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
A suspicious filename was detected
ET HUNTING HTTP GET Request for sqlite3.dll - Possible Infostealer Activity
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3724
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/Stealc Submitting System Information to C2
3 ETPRO signatures available at the full report
Process
Message
HCFBKKEBKE.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
IJECAEHJJJ.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
explorti.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
explorti.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
explorti.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
explorti.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------