download:

/mine/random.exe

Full analysis: https://app.any.run/tasks/2569e893-57c9-446c-9e01-a270262ede15
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: April 06, 2025, 20:58:10
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
amadey
botnet
stealer
loader
rdp
themida
telegram
lumma
purecrypter
miner
credentialflusher
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

A7E13E87C8203E64B0E5EF07E1647AB6

SHA1:

D7B9975FE9B8DE9DD142999B16AA5924314B8D82

SHA256:

3BEC8776B8759FB5B45F2B4A4354A522911872D722400F61FAC838C02CA3DCFB

SSDEEP:

98304:nCKg39+ztgrjJ1+Hwhn8nParcDqrn2UmaAclZuyLXOJEpDj0diAbvaiZ:s

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AMADEY mutex has been found

      • random.exe (PID: 7376)
      • rapes.exe (PID: 7548)
      • rapes.exe (PID: 7868)

    • AMADEY has been detected (SURICATA)

      • rapes.exe (PID: 7548)

    • Connects to the CnC server

      • rapes.exe (PID: 7548)
      • AddInProcess.exe (PID: 7964)
      • svchost.exe (PID: 2196)

    • Changes the autorun value in the registry

      • 5Jq9U1v.exe (PID: 8144)
      • rapes.exe (PID: 7548)

    • AMADEY has been detected (YARA)

      • rapes.exe (PID: 7548)

    • LUMMA mutex has been found

      • MSBuild.exe (PID: 2140)
      • 86e1dba58b.exe (PID: 6708)
      • 2ab8e6dba4.exe (PID: 8784)

    • Steals credentials from Web Browsers

      • MSBuild.exe (PID: 2140)
      • 86e1dba58b.exe (PID: 6708)
      • 2ab8e6dba4.exe (PID: 8784)

    • PURECRYPTER has been detected (SURICATA)

      • RegSvcs.exe (PID: 7352)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)
      • 86e1dba58b.exe (PID: 6708)

    • Actions looks like stealing of personal data

      • 86e1dba58b.exe (PID: 6708)
      • MSBuild.exe (PID: 2140)
      • 2ab8e6dba4.exe (PID: 8784)

    • MINER has been detected (SURICATA)

      • AddInProcess.exe (PID: 7964)

    • Possible tool for stealing has been detected

      • 663e75fd7b.exe (PID: 8028)
      • firefox.exe (PID: 1196)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 8168)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 8652)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 8532)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • random.exe (PID: 7376)
      • rapes.exe (PID: 7548)
      • c105f70d16.exe (PID: 7512)
      • 0f23991077.exe (PID: 5156)
      • 272.exe (PID: 7900)
      • 47251438a0.exe (PID: 8352)
      • 272.exe (PID: 7476)

    • Reads the BIOS version

      • random.exe (PID: 7376)
      • rapes.exe (PID: 7548)
      • 86e1dba58b.exe (PID: 6708)
      • c105f70d16.exe (PID: 7512)
      • rapes.exe (PID: 7868)
      • 2ab8e6dba4.exe (PID: 8784)
      • c6189cc19f.exe (PID: 3032)

    • Connects to the server without a host name

      • rapes.exe (PID: 7548)
      • c105f70d16.exe (PID: 7512)
      • 47251438a0.exe (PID: 8352)

    • Starts itself from another location

      • random.exe (PID: 7376)

    • Executable content was dropped or overwritten

      • random.exe (PID: 7376)
      • rapes.exe (PID: 7548)
      • 5Jq9U1v.exe (PID: 8144)
      • 0f23991077.exe (PID: 5156)

    • Contacting a server suspected of hosting an CnC

      • rapes.exe (PID: 7548)
      • RegSvcs.exe (PID: 7352)
      • 86e1dba58b.exe (PID: 6708)
      • svchost.exe (PID: 2196)

    • Potential Corporate Privacy Violation

      • rapes.exe (PID: 7548)
      • AddInProcess.exe (PID: 7964)

    • Process requests binary or script from the Internet

      • rapes.exe (PID: 7548)

    • There is functionality for enable RDP (YARA)

      • rapes.exe (PID: 7548)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • MSBuild.exe (PID: 2140)

    • Searches for installed software

      • MSBuild.exe (PID: 2140)
      • 86e1dba58b.exe (PID: 6708)
      • 2ab8e6dba4.exe (PID: 8784)

    • Connects to unusual port

      • RegSvcs.exe (PID: 7352)
      • AddInProcess.exe (PID: 7964)

    • Executes application which crashes

      • MSBuild.exe (PID: 2140)
      • 86e1dba58b.exe (PID: 6708)

    • Uses TASKKILL.EXE to kill Browsers

      • 663e75fd7b.exe (PID: 8028)

    • Uses TASKKILL.EXE to kill process

      • 663e75fd7b.exe (PID: 8028)

    • Drops a system driver (possible attempt to evade defenses)

      • 0f23991077.exe (PID: 5156)

    • Starts CMD.EXE for commands execution

      • 272.exe (PID: 7476)
      • 272.exe (PID: 7900)
      • fcb927be5d.exe (PID: 8108)

    • Executing commands from a ".bat" file

      • 272.exe (PID: 7476)
      • 272.exe (PID: 7900)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 8168)

    • Windows service management via SC.EXE

      • sc.exe (PID: 6184)
      • sc.exe (PID: 8356)
      • sc.exe (PID: 8296)
      • sc.exe (PID: 8480)
      • sc.exe (PID: 8536)
      • sc.exe (PID: 8424)
      • sc.exe (PID: 8204)
      • sc.exe (PID: 8652)
      • sc.exe (PID: 8772)
      • sc.exe (PID: 8712)
      • sc.exe (PID: 8908)
      • sc.exe (PID: 8828)
      • sc.exe (PID: 9028)
      • sc.exe (PID: 8596)
      • sc.exe (PID: 9088)
      • sc.exe (PID: 8968)
      • sc.exe (PID: 9144)
      • sc.exe (PID: 9196)
      • sc.exe (PID: 8296)

    • Stops a currently running service

      • sc.exe (PID: 1452)
      • sc.exe (PID: 8276)
      • sc.exe (PID: 8336)
      • sc.exe (PID: 8516)
      • sc.exe (PID: 8576)
      • sc.exe (PID: 8632)
      • sc.exe (PID: 8752)
      • sc.exe (PID: 8692)
      • sc.exe (PID: 8812)
      • sc.exe (PID: 8872)
      • sc.exe (PID: 8948)
      • sc.exe (PID: 9008)
      • sc.exe (PID: 9068)
      • sc.exe (PID: 9124)
      • sc.exe (PID: 9180)
      • sc.exe (PID: 8276)
      • sc.exe (PID: 8464)
      • sc.exe (PID: 8396)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 8168)

    • Creates a new Windows service

      • sc.exe (PID: 1072)

    • Takes ownership (TAKEOWN.EXE)

      • cmd.exe (PID: 8168)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 8168)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 8168)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 8212)
      • schtasks.exe (PID: 8228)
      • schtasks.exe (PID: 8256)
      • schtasks.exe (PID: 8240)

    • The process executes via Task Scheduler

      • rapes.exe (PID: 7868)

    • Probably download files using WebClient

      • mshta.exe (PID: 8540)

    • Starts process via Powershell

      • powershell.exe (PID: 8652)

    • Manipulates environment variables

      • powershell.exe (PID: 8652)

    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 8540)

    • Found IP address in command line

      • powershell.exe (PID: 8652)

  • INFO

    • Reads the computer name

      • rapes.exe (PID: 7548)
      • 5Jq9U1v.exe (PID: 8144)
      • 5Jq9U1v.exe (PID: 4244)
      • MSBuild.exe (PID: 2140)
      • RegSvcs.exe (PID: 7248)
      • RegSvcs.exe (PID: 7352)
      • random.exe (PID: 7376)
      • 86e1dba58b.exe (PID: 6708)
      • c105f70d16.exe (PID: 7512)
      • AddInProcess.exe (PID: 7964)
      • 663e75fd7b.exe (PID: 8028)
      • 0f23991077.exe (PID: 5156)
      • 272.exe (PID: 7476)
      • 272.exe (PID: 7900)
      • 47251438a0.exe (PID: 8352)
      • fcb927be5d.exe (PID: 8108)
      • 2ab8e6dba4.exe (PID: 8784)

    • Checks proxy server information

      • rapes.exe (PID: 7548)
      • RegSvcs.exe (PID: 7352)
      • c105f70d16.exe (PID: 7512)
      • 47251438a0.exe (PID: 8352)

    • Checks supported languages

      • random.exe (PID: 7376)
      • rapes.exe (PID: 7548)
      • 5Jq9U1v.exe (PID: 8144)
      • 5Jq9U1v.exe (PID: 4244)
      • 36c684debc.exe (PID: 6028)
      • MSBuild.exe (PID: 2140)
      • RegSvcs.exe (PID: 7352)
      • 86e1dba58b.exe (PID: 6708)
      • c105f70d16.exe (PID: 7512)
      • AddInProcess.exe (PID: 7964)
      • 663e75fd7b.exe (PID: 8028)
      • 0f23991077.exe (PID: 5156)
      • RegSvcs.exe (PID: 7248)
      • 272.exe (PID: 7476)
      • 272.exe (PID: 7900)
      • 0620503ddf.exe (PID: 2392)
      • 47251438a0.exe (PID: 8352)
      • rapes.exe (PID: 7868)
      • fcb927be5d.exe (PID: 8108)
      • 2ab8e6dba4.exe (PID: 8784)
      • c6189cc19f.exe (PID: 3032)

    • Process checks computer location settings

      • random.exe (PID: 7376)
      • rapes.exe (PID: 7548)
      • 0f23991077.exe (PID: 5156)
      • 272.exe (PID: 7900)
      • 272.exe (PID: 7476)

    • Create files in a temporary directory

      • random.exe (PID: 7376)
      • rapes.exe (PID: 7548)
      • 0f23991077.exe (PID: 5156)
      • 272.exe (PID: 7900)
      • 272.exe (PID: 7476)
      • fcb927be5d.exe (PID: 8108)

    • Creates files or folders in the user directory

      • rapes.exe (PID: 7548)
      • 5Jq9U1v.exe (PID: 8144)
      • WerFault.exe (PID: 5728)
      • WerFault.exe (PID: 6132)

    • Reads the machine GUID from the registry

      • 5Jq9U1v.exe (PID: 8144)
      • 5Jq9U1v.exe (PID: 4244)
      • RegSvcs.exe (PID: 7248)
      • RegSvcs.exe (PID: 7352)

    • Reads Environment values

      • 5Jq9U1v.exe (PID: 8144)
      • 5Jq9U1v.exe (PID: 4244)
      • RegSvcs.exe (PID: 7248)
      • RegSvcs.exe (PID: 7352)

    • Manual execution by a user

      • 5Jq9U1v.exe (PID: 4244)
      • RegSvcs.exe (PID: 7352)
      • AddInProcess.exe (PID: 7964)

    • Themida protector has been detected

      • rapes.exe (PID: 7548)

    • Reads the software policy settings

      • MSBuild.exe (PID: 2140)
      • 86e1dba58b.exe (PID: 6708)
      • 2ab8e6dba4.exe (PID: 8784)
      • slui.exe (PID: 7604)

    • Disables trace logs

      • RegSvcs.exe (PID: 7352)

    • Reads mouse settings

      • 663e75fd7b.exe (PID: 8028)
      • fcb927be5d.exe (PID: 8108)

    • Application launched itself

      • firefox.exe (PID: 1196)
      • firefox.exe (PID: 6988)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 8540)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(7548) rapes.exe
C2176.113.115.6
URLhttp://176.113.115.6/Ni9kiput/index.php
Version5.21
Options
Drop directorybb556cff4a
Drop namerapes.exe
Strings (125)pc:
\App
2022
&unit=
rb
id:
Norton
------
http://
" && ren
2016
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
00000419
--
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
st=s
0123456789
5.21
Comodo
msi
Panda Security
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Doctor Web
/Plugins/
-unicode-
:::
&&
|
DefaultSettings.YResolution
dm:
/Ni9kiput/index.php
------
Main
ar:
cmd /C RMDIR /s/q
SOFTWARE\Microsoft\Windows NT\CurrentVersion
&& Exit"
rundll32
Content-Disposition: form-data; name="data"; filename="
<c>
/quiet
=
2019
<d>
Kaspersky Lab
cred.dll|clip.dll|
ps1
%-lu
un:
kernel32.dll
DefaultSettings.XResolution
ESET
WinDefender
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
rapes.exe
Powershell.exe
?scr=1
.jpg
ProductName
shutdown -s -t 0
random
POST
bi:
zip
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Programs
Sophos
r=
AVG
%USERPROFILE%
og:
176.113.115.6
cmd
rundll32.exe
Bitdefender
+++
exe
cred.dll
lv:
VideoID
S-%lu-
e2
d1
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
ProgramData\
sd:
GetNativeSystemInfo
360TotalSecurity
os:
\0000
Avira
abcdefghijklmnopqrstuvwxyz0123456789-_
-%lu
AVAST Software
-executionpolicy remotesigned -File "
SYSTEM\ControlSet001\Services\BasicDisplay\Video
e1
wb
bb556cff4a
" && timeout 1 && del
av:
dll
/k
"taskkill /f /im "
ComputerName
Startup
CurrentBuild
2025
00000423
GET
#
\
Content-Type: multipart/form-data; boundary=----
https://
"
vs:
" Content-Type: application/octet-stream
Content-Type: application/x-www-form-urlencoded
Rem
0000043f
shell32.dll
Keyboard Layout\Preload
e3
00000422
clip.dll
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:02:23 11:06:11+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 324096
InitializedDataSize: 114688
UninitializedDataSize: -
EntryPoint: 0x4b2000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
248
Monitored processes
119
Malicious processes
17
Suspicious processes
5

Behavior graph

Click at the process to see the details
start random.exe #AMADEY rapes.exe sppextcomobj.exe no specs slui.exe 5jq9u1v.exe 5jq9u1v.exe no specs 36c684debc.exe no specs #LUMMA msbuild.exe regsvcs.exe no specs #PURECRYPTER regsvcs.exe #LUMMA 86e1dba58b.exe werfault.exe no specs #LUMMA svchost.exe c105f70d16.exe werfault.exe no specs #MINER addinprocess.exe conhost.exe no specs #CREDENTIALFLUSHER 663e75fd7b.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs #CREDENTIALFLUSHER firefox.exe no specs firefox.exe 0f23991077.exe firefox.exe no specs firefox.exe no specs 272.exe no specs firefox.exe no specs cmd.exe no specs conhost.exe no specs firefox.exe no specs 272.exe no specs firefox.exe no specs cmd.exe no specs conhost.exe no specs firefox.exe no specs sc.exe no specs sc.exe no specs firefox.exe no specs firefox.exe no specs timeout.exe no specs firefox.exe no specs 0620503ddf.exe no specs sc.exe no specs sc.exe no specs takeown.exe no specs icacls.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs sc.exe no specs sc.exe no specs 47251438a0.exe rapes.exe no specs fcb927be5d.exe no specs cmd.exe no specs mshta.exe no specs conhost.exe no specs schtasks.exe no specs powershell.exe no specs conhost.exe no specs #LUMMA 2ab8e6dba4.exe c6189cc19f.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1072sc create ddrver type= kernel binPath= "C:\Users\admin\AppData\Local\Temp\ssisd.sys" C:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Service Control Manager Configuration Tool
Exit code:
5
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1196"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blockingC:\Program Files\Mozilla Firefox\firefox.exe
663e75fd7b.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\program files\mozilla firefox\msvcp140.dll
1276"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5328 -childID 5 -isForBrowser -prefsHandle 5320 -prefMapHandle 5316 -prefsLen 31243 -prefMapSize 244583 -jsInitHandle 1308 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e8573b5d-2466-41c0-9182-dd82b86a83a4} 6988 "\\.\pipe\gecko-crash-server-pipe.6988" 19b3765b4d0 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
1452sc stop ddrver C:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
2140"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
36c684debc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
3221226356
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2240\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2392"C:\Users\admin\AppData\Local\Temp\10483440101\0620503ddf.exe" C:\Users\admin\AppData\Local\Temp\10483440101\0620503ddf.exe—rapes.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\10483440101\0620503ddf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
2984\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3032"C:\Users\admin\AppData\Local\Temp\10483480101\c6189cc19f.exe" C:\Users\admin\AppData\Local\Temp\10483480101\c6189cc19f.exe—rapes.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\10483480101\c6189cc19f.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
27 463
Read events
27 429
Write events
34
Delete events
0

Modification events

(PID) Process:(7548) rapes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7548) rapes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7548) rapes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(8144) 5Jq9U1v.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:runtimebroker
Value:
C:\Users\admin\AppData\Roaming\runtimebroker.exe
(PID) Process:(7352) RegSvcs.exeKey:HKEY_CURRENT_USER\SOFTWARE\a7bf5d9fcc50896f2d9e711b76f848c7
Operation:writeName:7152b3679e93b22ae30c8f7015a82bf2
Value:
12E4020AB1012D2D616C676F2072782F30202D6F203139362E3235312E38312E36343A3439333031202D752034366859675053534C5A546A6D6B6F59783939343139384775733537564A6957744245697A34646B3871467744747A344869315A55673252586F6D4D4C344E59355054684D6964624C354D6E4165637538564148757A353148766B4D4657772E6A6F677072656574202D702078202D2D6370752D6D61782D746872656164732D68696E743D3530202D6B2040014A0C416464496E50726F63657373522036384343303431303142303339393839303836333338314634394546423038385A26687474703A2F2F736B69707070732E636F6D2F706C7567696E732F706C7567696E332E706C67725468747470733A2F2F6769746875622E636F6D2F786D7269672F786D7269672F72656C65617365732F646F776E6C6F61642F76362E32322E322F786D7269672D362E32322E322D6D7376632D77696E36342E7A6970
(PID) Process:(7352) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7352) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7352) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(7352) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(7352) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
Executable files
22
Suspicious files
139
Text files
23
Unknown types
0

Dropped files

PID
Process
Filename
Type
5728WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_97bdc4f8e635441e450764b9d76f58ede0ef71_d13e9d18_641dc29c-a97e-450e-84a3-2af186b1d2e5\Report.wer —
MD5:—
SHA256:—
6132WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_86e1dba58b.exe_9f3223ffdcf858f20584bb160ce7fe95f521e4e_04f13a88_555cdb48-e901-4499-95cd-38933309c0b3\Report.wer —
MD5:—
SHA256:—
6132WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\86e1dba58b.exe.6708.dmp —
MD5:—
SHA256:—
7376random.exeC:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exeexecutable
MD5:A7E13E87C8203E64B0E5EF07E1647AB6
SHA256:3BEC8776B8759FB5B45F2B4A4354A522911872D722400F61FAC838C02CA3DCFB
5728WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER9D3.tmp.xmlxml
MD5:F9A41388A36C3ABC5C4F869AC1BEAD41
SHA256:8B403B340A4AAC6425AFD2C9B17D9263554E650847B194CCEF5DC38D7E7C5CCF
7548rapes.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\5Jq9U1v[1].exeexecutable
MD5:23EA0A13AAD9B0F8DF6679C1693F1EAC
SHA256:4E7CD5823DBA8F66B9803339621B78D3040A77D3FF473E4AAADDA767489B3551
5728WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER9A3.tmp.WERInternalMetadata.xmlbinary
MD5:0D8A213EDD4DF17CC00B0653D07BE17A
SHA256:314A9F12B65F66AC8363D9A3F1D67D27CE8B08C8C67C5EB6A97D515E2EC947DA
7548rapes.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\random[1].exeexecutable
MD5:5D2BDA989990F76F4FABF32F3275DCC5
SHA256:F364D9D68FC64E12397DC82BD86EBDE2298E21A93EDC275133A3BB77FC81082A
6988firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
7548rapes.exeC:\Users\admin\AppData\Local\Temp\10483150101\5Jq9U1v.exeexecutable
MD5:23EA0A13AAD9B0F8DF6679C1693F1EAC
SHA256:4E7CD5823DBA8F66B9803339621B78D3040A77D3FF473E4AAADDA767489B3551
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
60
TCP/UDP connections
110
DNS requests
115
Threats
47

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7548
rapes.exe
POST
200
176.113.115.6:80
http://176.113.115.6/Ni9kiput/index.php
unknown
—
—
malicious
5496
MoUsoCoreWorker.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7548
rapes.exe
POST
200
176.113.115.6:80
http://176.113.115.6/Ni9kiput/index.php
unknown
—
—
malicious
7548
rapes.exe
POST
200
176.113.115.6:80
http://176.113.115.6/Ni9kiput/index.php
unknown
—
—
malicious
—
—
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7548
rapes.exe
GET
—
176.113.115.7:80
http://176.113.115.7/files/6092974123/5Jq9U1v.exe
unknown
—
—
malicious
7548
rapes.exe
GET
200
176.113.115.7:80
http://176.113.115.7/files/fate/random.exe
unknown
—
—
malicious
7548
rapes.exe
GET
200
176.113.115.7:80
http://176.113.115.7/luma/random.exe
unknown
—
—
malicious
7352
RegSvcs.exe
GET
—
196.251.81.64:80
http://skippps.com/plugins/plugin3.plg
unknown
—
—
unknown
7512
c105f70d16.exe
POST
200
45.93.20.28:80
http://45.93.20.28/3d15e67552d448ff.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.172.255.218:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7548
rapes.exe
176.113.115.6:80
—
Red Bytes LLC
RU
malicious
7548
rapes.exe
176.113.115.7:80
—
Red Bytes LLC
RU
malicious

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
whitelisted
google.com
  • 142.250.185.78
whitelisted
client.wns.windows.com
  • 172.172.255.218
whitelisted
login.live.com
  • 20.190.160.5
  • 40.126.32.138
  • 40.126.32.74
  • 40.126.32.134
  • 20.190.160.17
  • 20.190.160.130
  • 20.190.160.128
  • 20.190.160.65
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
t.me
  • 149.154.167.99
whitelisted
reformzv.digital
  • 172.67.137.32
  • 104.21.38.181
unknown
pepperiop.digital
  • —
malicious
jrxsafer.top
  • 104.21.32.1
  • 104.21.112.1
  • 104.21.96.1
  • 104.21.16.1
  • 104.21.64.1
  • 104.21.80.1
  • 104.21.48.1
malicious

Threats

PID
Process
Class
Message
7548
rapes.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
7548
rapes.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
7548
rapes.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7548
rapes.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7548
rapes.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
7548
rapes.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
7548
rapes.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7548
rapes.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7548
rapes.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
7548
rapes.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/mine/random.exe