File name:

SmLAztxc1o8yfogkJXrRjbDt.exe

Full analysis: https://app.any.run/tasks/40ab98fa-2b87-4a82-88e7-39e7c96ab332
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: August 09, 2024, 20:50:48
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
amadey
botnet
stealer
darktortilla
rat
asyncrat
remote
pastebin
purecrypter
purelogs
netreactor
purehvnc
exfiltration
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

A386741A24F6DD80F0A87A8AF51C37C7

SHA1:

51DD4F9A6BA686E40123E6200B292534FE15B529

SHA256:

4410E6509EF90E0B6D680E04C05552C0CF8729C40D3CBB6FFD39126D022D3A11

SSDEEP:

98304:QStEC335r1M0pqbp1q4JPvgKeqp6IcloFwG1hKL6SPSTcm1qbUOOYo4OHppFKU3/:L3DD3bXnhWpcC8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AMADEY has been detected (SURICATA)

      • ednfosi.exe (PID: 6488)

    • Connects to the CnC server

      • ednfosi.exe (PID: 6488)

    • Antivirus name has been found in the command line (generic signature)

      • findstr.exe (PID: 6896)
      • findstr.exe (PID: 7012)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 6212)
      • cmd.exe (PID: 3176)

    • Create files in the Startup directory

      • cmd.exe (PID: 2852)
      • cmd.exe (PID: 3032)
      • InstallUtil.exe (PID: 7220)

    • AMADEY has been detected (YARA)

      • ednfosi.exe (PID: 6488)

    • Actions looks like stealing of personal data

      • RegAsm.exe (PID: 7536)
      • RegAsm.exe (PID: 7916)
      • RegAsm.exe (PID: 2272)
      • RegAsm.exe (PID: 8000)
      • RegAsm.exe (PID: 1964)

    • ASYNCRAT has been detected (SURICATA)

      • RegAsm.exe (PID: 7536)

    • DARKTORTILLA has been detected (YARA)

      • VLC3.exe (PID: 752)

    • PURECRYPTER has been detected (SURICATA)

      • RegAsm.exe (PID: 7916)
      • RegAsm.exe (PID: 2272)
      • RegAsm.exe (PID: 8000)
      • RegAsm.exe (PID: 1964)

    • Steals credentials from Web Browsers

      • RegAsm.exe (PID: 7916)
      • RegAsm.exe (PID: 2272)
      • RegAsm.exe (PID: 8000)

    • PUREHVNC has been detected (YARA)

      • RegAsm.exe (PID: 7536)

    • Stealers network behavior

      • RegAsm.exe (PID: 7916)

    • PURELOGS has been detected (SURICATA)

      • RegAsm.exe (PID: 7916)

    • Scans artifacts that could help determine the target

      • RegAsm.exe (PID: 7916)
      • RegAsm.exe (PID: 8000)
      • RegAsm.exe (PID: 2272)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • SmLAztxc1o8yfogkJXrRjbDt.exe (PID: 6432)
      • ednfosi.exe (PID: 6488)
      • ReadilyAccompanied.exe (PID: 6732)
      • InstallUtil.exe (PID: 7220)
      • Had.pif (PID: 6276)

    • Drops the executable file immediately after the start

      • SmLAztxc1o8yfogkJXrRjbDt.exe (PID: 6432)
      • ednfosi.exe (PID: 6488)
      • ReadilyAccompanied.exe (PID: 6732)
      • cmd.exe (PID: 6772)
      • Had.pif (PID: 7124)
      • Had.pif (PID: 7164)

    • Executable content was dropped or overwritten

      • SmLAztxc1o8yfogkJXrRjbDt.exe (PID: 6432)
      • ednfosi.exe (PID: 6488)
      • cmd.exe (PID: 6772)
      • Had.pif (PID: 7124)
      • Had.pif (PID: 7164)

    • Reads the date of Windows installation

      • SmLAztxc1o8yfogkJXrRjbDt.exe (PID: 6432)
      • ednfosi.exe (PID: 6488)
      • ReadilyAccompanied.exe (PID: 6732)
      • InstallUtil.exe (PID: 7220)

    • Starts itself from another location

      • SmLAztxc1o8yfogkJXrRjbDt.exe (PID: 6432)

    • Checks Windows Trust Settings

      • ednfosi.exe (PID: 6488)

    • The process executes via Task Scheduler

      • ednfosi.exe (PID: 6576)
      • ednfosi.exe (PID: 7012)
      • ednfosi.exe (PID: 4772)
      • ednfosi.exe (PID: 6788)
      • ednfosi.exe (PID: 6388)

    • Starts CMD.EXE for commands execution

      • ReadilyAccompanied.exe (PID: 6732)
      • cmd.exe (PID: 6772)
      • explorer.exe (PID: 4552)

    • Contacting a server suspected of hosting an CnC

      • ednfosi.exe (PID: 6488)
      • RegAsm.exe (PID: 7536)

    • Executing commands from ".cmd" file

      • ReadilyAccompanied.exe (PID: 6732)

    • Get information on the list of running processes

      • cmd.exe (PID: 6772)

    • Application launched itself

      • cmd.exe (PID: 6772)

    • Drops a file with a rarely used extension (PIF)

      • cmd.exe (PID: 6772)
      • Had.pif (PID: 7124)
      • Had.pif (PID: 7164)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6772)
      • explorer.exe (PID: 4552)

    • The executable file from the user directory is run by the CMD process

      • Had.pif (PID: 7164)
      • Had.pif (PID: 7124)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 6772)

    • Process drops legitimate windows executable

      • Had.pif (PID: 7124)

    • Connects to unusual port

      • RegAsm.exe (PID: 7536)
      • RegAsm.exe (PID: 7916)
      • RegAsm.exe (PID: 2272)
      • RegAsm.exe (PID: 8000)
      • RegAsm.exe (PID: 1964)

    • Starts a Microsoft application from unusual location

      • RegAsm.exe (PID: 7916)
      • RegAsm.exe (PID: 7536)
      • RegAsm.exe (PID: 2272)
      • RegAsm.exe (PID: 1964)
      • RegAsm.exe (PID: 8000)

    • The process creates files with name similar to system file names

      • Had.pif (PID: 7124)

  • INFO

    • Checks supported languages

      • SmLAztxc1o8yfogkJXrRjbDt.exe (PID: 6432)
      • ednfosi.exe (PID: 6488)
      • ReadilyAccompanied.exe (PID: 6732)
      • ednfosi.exe (PID: 6576)
      • Had.pif (PID: 7124)
      • Had.pif (PID: 7164)
      • VLC3.exe (PID: 752)
      • RegAsm.exe (PID: 7536)
      • InstallUtil.exe (PID: 7220)
      • RegAsm.exe (PID: 7916)
      • RegAsm.exe (PID: 2272)
      • ednfosi.exe (PID: 7012)
      • ednfosi.exe (PID: 4772)
      • Had.pif (PID: 6276)
      • ednfosi.exe (PID: 6788)
      • RegAsm.exe (PID: 8000)
      • ednfosi.exe (PID: 6388)
      • RegAsm.exe (PID: 1964)

    • Reads Environment values

      • SmLAztxc1o8yfogkJXrRjbDt.exe (PID: 6432)
      • ednfosi.exe (PID: 6488)
      • RegAsm.exe (PID: 7536)
      • InstallUtil.exe (PID: 7220)
      • RegAsm.exe (PID: 7916)
      • RegAsm.exe (PID: 2272)
      • RegAsm.exe (PID: 8000)
      • RegAsm.exe (PID: 1964)

    • Create files in a temporary directory

      • SmLAztxc1o8yfogkJXrRjbDt.exe (PID: 6432)
      • ednfosi.exe (PID: 6488)
      • ReadilyAccompanied.exe (PID: 6732)
      • Had.pif (PID: 7124)
      • RegAsm.exe (PID: 7916)
      • RegAsm.exe (PID: 2272)
      • RegAsm.exe (PID: 8000)
      • RegAsm.exe (PID: 1964)

    • Process checks computer location settings

      • SmLAztxc1o8yfogkJXrRjbDt.exe (PID: 6432)
      • ednfosi.exe (PID: 6488)
      • ReadilyAccompanied.exe (PID: 6732)
      • InstallUtil.exe (PID: 7220)

    • Reads the computer name

      • SmLAztxc1o8yfogkJXrRjbDt.exe (PID: 6432)
      • ednfosi.exe (PID: 6488)
      • ReadilyAccompanied.exe (PID: 6732)
      • Had.pif (PID: 7124)
      • Had.pif (PID: 7164)
      • VLC3.exe (PID: 752)
      • RegAsm.exe (PID: 7536)
      • InstallUtil.exe (PID: 7220)
      • RegAsm.exe (PID: 7916)
      • RegAsm.exe (PID: 2272)
      • Had.pif (PID: 6276)
      • RegAsm.exe (PID: 8000)
      • RegAsm.exe (PID: 1964)

    • Checks proxy server information

      • ednfosi.exe (PID: 6488)
      • InstallUtil.exe (PID: 7220)
      • explorer.exe (PID: 4552)

    • Reads the machine GUID from the registry

      • ednfosi.exe (PID: 6488)
      • VLC3.exe (PID: 752)
      • RegAsm.exe (PID: 7536)
      • InstallUtil.exe (PID: 7220)
      • RegAsm.exe (PID: 7916)
      • RegAsm.exe (PID: 2272)
      • RegAsm.exe (PID: 8000)
      • RegAsm.exe (PID: 1964)

    • Reads the software policy settings

      • ednfosi.exe (PID: 6488)
      • RegAsm.exe (PID: 7536)
      • InstallUtil.exe (PID: 7220)
      • explorer.exe (PID: 4552)

    • Creates files or folders in the user directory

      • ednfosi.exe (PID: 6488)
      • Had.pif (PID: 7124)
      • Had.pif (PID: 7164)
      • explorer.exe (PID: 4552)
      • InstallUtil.exe (PID: 7220)

    • Reads mouse settings

      • Had.pif (PID: 7164)
      • Had.pif (PID: 7124)
      • Had.pif (PID: 6276)

    • Manual execution by a user

      • cmd.exe (PID: 6212)
      • cmd.exe (PID: 2852)
      • cmd.exe (PID: 3176)
      • cmd.exe (PID: 3032)
      • RegAsm.exe (PID: 7536)
      • RegAsm.exe (PID: 7916)
      • RegAsm.exe (PID: 2272)
      • Taskmgr.exe (PID: 2572)
      • Taskmgr.exe (PID: 4280)

    • Disables trace logs

      • InstallUtil.exe (PID: 7220)

    • Reads Microsoft Office registry keys

      • RegAsm.exe (PID: 7916)
      • RegAsm.exe (PID: 2272)
      • explorer.exe (PID: 4552)
      • RegAsm.exe (PID: 8000)

    • .NET Reactor protector has been detected

      • RegAsm.exe (PID: 2272)
      • RegAsm.exe (PID: 7536)
      • RegAsm.exe (PID: 8000)
      • RegAsm.exe (PID: 1964)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 4552)
      • Taskmgr.exe (PID: 2572)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(6488) ednfosi.exe
C2api.garageserviceoperation.com
URLhttp://api.garageserviceoperation.com/CoreOPT/index.php
Version4.41
Options
Drop directory69c36458f5
Drop nameednfosi.exe
Strings (119)AVG
69c36458f5
\App
0123456789
SOFTWARE\Microsoft\Windows NT\CurrentVersion
os:
r=
zip
cmd /C RMDIR /s/q
/CoreOPT/index.php
Bitdefender
dm:
360TotalSecurity
-executionpolicy remotesigned -File "
.jpg
S-%lu-
POST
ESET
abcdefghijklmnopqrstuvwxyz0123456789-_
&&
2022
shutdown -s -t 0
/Plugins/
Content-Disposition: form-data; name="data"; filename="
un:
--
/quiet
ProductName
Comodo
cmd
Kaspersky Lab
"taskkill /f /im "
+++
|
:::
e1
"
random
GET
bi:
=
wb
" Content-Type: application/octet-stream
-%lu
2019
kernel32.dll
\0000
pc:
shell32.dll
Startup
ComputerName
av:
ar:
lv:
DefaultSettings.XResolution
Avira
&unit=
AVAST Software
%USERPROFILE%
exe
-unicode-
2016
e0
id:
DefaultSettings.YResolution
vs:
%-lu
/k
Powershell.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
#
rundll32.exe
Sophos
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
CurrentBuild
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
<d>
https://
Content-Type: application/x-www-form-urlencoded
VideoID
d1
Main
cred.dll
rb
Doctor Web
4.41
http://
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
ProgramData\
msi
Norton
&& Exit"
cred.dll|clip.dll|
Panda Security
\
og:
" && ren
GetNativeSystemInfo
rundll32
api.garageserviceoperation.com
st=s
e2
<c>
Programs
Content-Type: multipart/form-data; boundary=----
Rem
?scr=1
sd:
------
------
SYSTEM\ControlSet001\Services\BasicDisplay\Video
dll
clip.dll
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
" && timeout 1 && del
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
ednfosi.exe
ps1
WinDefender
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:08:07 12:47:37+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.24
CodeSize: 321024
InitializedDataSize: 117248
UninitializedDataSize: -
EntryPoint: 0x60e275
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
181
Monitored processes
43
Malicious processes
11
Suspicious processes
2

Behavior graph

Click at the process to see the details
start smlaztxc1o8yfogkjxrrjbdt.exe #AMADEY ednfosi.exe ednfosi.exe no specs readilyaccompanied.exe cmd.exe conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs had.pif cmd.exe no specs had.pif choice.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe conhost.exe no specs #DARKTORTILLA vlc3.exe no specs installutil.exe #ASYNCRAT regasm.exe #PURECRYPTER regasm.exe ednfosi.exe no specs #PURECRYPTER regasm.exe ednfosi.exe no specs taskmgr.exe no specs taskmgr.exe rundll32.exe no specs explorer.exe had.pif no specs #PURECRYPTER regasm.exe ednfosi.exe no specs #PURECRYPTER regasm.exe ednfosi.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
752"C:\Users\admin\AppData\Local\Temp\1000056001\VLC3.exe" C:\Users\admin\AppData\Local\Temp\1000056001\VLC3.exe
ednfosi.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\1000056001\vlc3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1860schtasks.exe /create /tn "Dpi" /tr "wscript //B 'C:\Users\admin\AppData\Local\DataSynergy Technologies LLC\VirtuoSync.js'" /sc minute /mo 5 /FC:\Windows\SysWOW64\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1964C:\Users\admin\AppData\Local\Temp\129441\RegAsm.exe C:\Users\admin\AppData\Local\Temp\129441\RegAsm.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\users\admin\appdata\local\temp\129441\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2272C:\Users\admin\AppData\Local\Temp\129441\RegAsm.exe C:\Users\admin\AppData\Local\Temp\129441\RegAsm.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\users\admin\appdata\local\temp\129441\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2464\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2572"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Manager
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
2796\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2852cmd /k echo [InternetShortcut] > "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VirtuoSync.url" & echo URL="C:\Users\admin\AppData\Local\DataSynergy Technologies LLC\VirtuoSync.js" >> "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VirtuoSync.url" & exitC:\Windows\SysWOW64\cmd.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3032cmd /k echo [InternetShortcut] > "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VirtuoSync11.url" & echo URL="C:\Users\admin\AppData\Local\DataSynergy Technologies LLC11\VirtuoSync.js" >> "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VirtuoSync11.url" & exitC:\Windows\SysWOW64\cmd.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3076\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
79 675
Read events
79 504
Write events
165
Delete events
6

Modification events

(PID) Process:(4552) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Security and Maintenance\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
23004100430042006C006F00620000000000000000000000010000000000000000000000
(PID) Process:(6432) SmLAztxc1o8yfogkJXrRjbDt.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6432) SmLAztxc1o8yfogkJXrRjbDt.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6432) SmLAztxc1o8yfogkJXrRjbDt.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6432) SmLAztxc1o8yfogkJXrRjbDt.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6488) ednfosi.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6488) ednfosi.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6488) ednfosi.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6488) ednfosi.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6488) ednfosi.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
10
Suspicious files
110
Text files
10
Unknown types
13

Dropped files

PID
Process
Filename
Type
6432SmLAztxc1o8yfogkJXrRjbDt.exeC:\Users\admin\AppData\Local\Temp\69c36458f5\ednfosi.exeexecutable
MD5:A386741A24F6DD80F0A87A8AF51C37C7
SHA256:4410E6509EF90E0B6D680E04C05552C0CF8729C40D3CBB6FFD39126D022D3A11
4552explorer.exeC:\Users\admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.datbinary
MD5:E49C56350AEDF784BFE00E444B879672
SHA256:A8BD235303668981563DFB5AAE338CB802817C4060E2C199B7C84901D57B7E1E
6432SmLAztxc1o8yfogkJXrRjbDt.exeC:\Windows\Tasks\ednfosi.jobbinary
MD5:5F1BBF4E57D4FF6C7E3E9703032402C7
SHA256:E7B0818628DBBDB6359A4F281D55D9BE43662E4D2DC6C61A3A21B7339F51185C
6488ednfosi.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dder
MD5:51883DF11BA0F75D2AAD9E88EBD057DC
SHA256:1CC443E507D740FEDC646DCA7116EEAD8084ED9B7C70ABBB34281DD1E7DBBA10
6488ednfosi.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Eder
MD5:C230AEA800CBDA62DF63052973D78649
SHA256:5DDF1CB320A0C45491F91E5FD4866E8E91AA60DF9C60873F9C9DD86ADDFDC145
6488ednfosi.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:263FDE6ECCBF41C2F26C23339E10DCE6
SHA256:361990BAD074FBCFD18033327EDFCD153CDE58B4EBFC1CA722D12AE26E631192
6732ReadilyAccompanied.exeC:\Users\admin\AppData\Local\Temp\Boldbinary
MD5:8654DD5B437C6F0C7DE0B920BAA5916E
SHA256:768C61FBDEEE5166498D1BFA613DF6F3657E63E64FFDD4C3C109D80AB039DCB7
6732ReadilyAccompanied.exeC:\Users\admin\AppData\Local\Temp\Complicationsbinary
MD5:D252CE50EDA29D3DF6F7C3E4F58182D5
SHA256:099591F60002FAD8EF56C55DFD03CC23A2D9A301AAE82467BF37B6669CF45366
6732ReadilyAccompanied.exeC:\Users\admin\AppData\Local\Temp\Dressesbinary
MD5:C0C86A53CCEBBB11E9A785F8F91E1AF5
SHA256:75547130CE3D282EB2B8D7AC9045C9295B5A8E846E4E720E3BFECBEC5A28B092
6732ReadilyAccompanied.exeC:\Users\admin\AppData\Local\Temp\Rightbinary
MD5:A2F598DC4D649E356C2651107DB20194
SHA256:82D9A0F615E0AAF3C334FD44F0E6D3E5C93ED131666C6EA9FFC4771110E04614
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
67
DNS requests
32
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6488
ednfosi.exe
POST
200
185.208.158.115:80
http://api.garageserviceoperation.com/CoreOPT/index.php
unknown
—
—
unknown
6488
ednfosi.exe
POST
200
185.208.158.115:80
http://api.garageserviceoperation.com/CoreOPT/index.php
unknown
—
—
unknown
—
—
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
—
—
whitelisted
6488
ednfosi.exe
GET
200
172.64.149.23:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQChefxDqizHp%2BUDESVkPX%2B3
unknown
—
—
whitelisted
6488
ednfosi.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
unknown
—
—
whitelisted
4168
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6488
ednfosi.exe
POST
200
185.208.158.115:80
http://api.garageserviceoperation.com/CoreOPT/index.php
unknown
—
—
unknown
6488
ednfosi.exe
POST
200
185.208.158.115:80
http://api.garageserviceoperation.com/CoreOPT/index.php
unknown
—
—
unknown
6180
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4484
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1184
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2120
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6488
ednfosi.exe
185.208.158.115:80
api.garageserviceoperation.com
—
US
unknown
6488
ednfosi.exe
162.0.209.124:443
helleaa.com
NAMECHEAP-NET
US
unknown
6488
ednfosi.exe
104.18.38.233:80
ocsp.comodoca.com
CLOUDFLARENET
—
shared
6488
ednfosi.exe
172.64.149.23:80
ocsp.comodoca.com
CLOUDFLARENET
US
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
  • 4.231.128.59
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.238
whitelisted
api.garageserviceoperation.com
  • 185.208.158.115
malicious
helleaa.com
  • 162.0.209.124
unknown
ocsp.comodoca.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.usertrust.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.sectigo.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
fTklZVzzlysZHeldfzSjVCiKTVtL.fTklZVzzlysZHeldfzSjVCiKTVtL
  • —
unknown
umGPgIUKlmbxKNhoefdnUvgjrV.umGPgIUKlmbxKNhoefdnUvgjrV
  • —
unknown
www.bing.com
  • 184.86.251.10
  • 184.86.251.22
  • 184.86.251.23
  • 184.86.251.9
  • 184.86.251.27
  • 184.86.251.29
  • 184.86.251.24
  • 184.86.251.25
  • 184.86.251.6
  • 184.86.251.5
  • 184.86.251.30
  • 184.86.251.7
  • 184.86.251.8
  • 184.86.251.28
whitelisted

Threats

PID
Process
Class
Message
6488
ednfosi.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 33
6488
ednfosi.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
6488
ednfosi.exe
A Network Trojan was detected
ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2
6488
ednfosi.exe
A Network Trojan was detected
ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2
7536
RegAsm.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 25
7536
RegAsm.exe
Domain Observed Used for C2 Detected
ET MALWARE Generic AsyncRAT Style SSL Cert
2256
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Online Pastebin Text Storage
7916
RegAsm.exe
A Network Trojan was detected
LOADER [ANY.RUN] PureLogs Download Attempt (LOAD)
7536
RegAsm.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] AsyncRAT Successful Connection
2272
RegAsm.exe
A Network Trojan was detected
LOADER [ANY.RUN] PureLogs Download Attempt (LOAD)
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SmLAztxc1o8yfogkJXrRjbDt.exe