File name:

random.exe

Full analysis: https://app.any.run/tasks/5f3e544c-5a5c-4598-a35c-fdf33772a577
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: May 26, 2025, 16:24:43
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
amadey
botnet
stealer
loader
lumma
auto-reg
themida
rdp
xmrig
auto-sch
evasion
miner
gcleaner
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

D20D9543B2D43F5811061F2BFA40BDAB

SHA1:

46EF9B100E3DEC32076B070BBD90C916F177DEFD

SHA256:

494DF8DEFF9A9C926534940FC6330B429E672ED64B7A2C2F75A0357ECF0EFF35

SSDEEP:

98304:FnCybWZQH3pYmNlwT5NOls7Cdlt3X/ANIffuMAk4coGOh3MGMwJUTw6G5X9b37GQ:b

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • AMADEY mutex has been found

      • ramez.exe (PID: 1696)
      • random.exe (PID: 6820)
      • ramez.exe (PID: 6940)
    • AMADEY has been detected (SURICATA)

      • ramez.exe (PID: 1696)
      • saren.exe (PID: 10516)
    • Connects to the CnC server

      • ramez.exe (PID: 1696)
      • svchost.exe (PID: 2196)
      • cmd.exe (PID: 8824)
      • saren.exe (PID: 10516)
    • AMADEY has been detected (YARA)

      • ramez.exe (PID: 1696)
    • LUMMA mutex has been found

      • 1c5dd6f0d2.exe (PID: 1764)
      • 1c5dd6f0d2.exe (PID: 3272)
    • Changes the autorun value in the registry

      • ramez.exe (PID: 1696)
    • Actions looks like stealing of personal data

      • 1c5dd6f0d2.exe (PID: 1764)
      • 1c5dd6f0d2.exe (PID: 3272)
    • Steals credentials from Web Browsers

      • 1c5dd6f0d2.exe (PID: 1764)
      • 1c5dd6f0d2.exe (PID: 3272)
    • Changes Windows Defender settings

      • NSudoLG.exe (PID: 7624)
      • NSudoLG.exe (PID: 7720)
      • WinTemp-v4.exe (PID: 8076)
    • Adds path to the Windows Defender exclusion list

      • cmd.exe (PID: 8160)
      • NSudoLG.exe (PID: 7720)
      • cmd.exe (PID: 7976)
      • NSudoLG.exe (PID: 7624)
    • XMRig has been detected

      • oxDU0MW.exe (PID: 7344)
    • Known privilege escalation attack

      • dllhost.exe (PID: 7192)
    • Adds process to the Windows Defender exclusion list

      • WinTemp-v4.exe (PID: 8076)
    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)
      • MSBuild.exe (PID: 4628)
      • MSBuild.exe (PID: 8564)
    • Starts SC.EXE for service management

      • cmd.exe (PID: 8160)
      • cmd.exe (PID: 7976)
      • cmd.exe (PID: 9568)
    • Starts REAGENTC.EXE to disable the Windows Recovery Environment

      • ReAgentc.exe (PID: 2516)
    • MINER has been detected (SURICATA)

      • cmd.exe (PID: 8824)
    • Executing a file with an untrusted certificate

      • 583137f536.exe (PID: 10728)
    • GCLEANER has been detected (SURICATA)

      • 583137f536.exe (PID: 10728)
  • SUSPICIOUS

    • Starts itself from another location

      • random.exe (PID: 6820)
      • XUE1F42RQHVQXV6MR7NVXU9UEU.exe (PID: 10408)
    • Reads the BIOS version

      • random.exe (PID: 6820)
      • ramez.exe (PID: 1696)
      • ramez.exe (PID: 6940)
      • 1c5dd6f0d2.exe (PID: 1764)
      • 1c5dd6f0d2.exe (PID: 3272)
    • Reads security settings of Internet Explorer

      • random.exe (PID: 6820)
      • ramez.exe (PID: 1696)
      • 3f17e198c5.exe (PID: 7176)
      • nircmd.exe (PID: 7508)
      • 3f17e198c5.exe (PID: 7612)
      • nircmd.exe (PID: 3308)
      • Unlocker.exe (PID: 7748)
      • Unlocker.exe (PID: 7460)
      • Unlocker.exe (PID: 3192)
    • Executable content was dropped or overwritten

      • random.exe (PID: 6820)
      • ramez.exe (PID: 1696)
      • 3f17e198c5.exe (PID: 7176)
      • 7z.exe (PID: 7664)
      • 7z.exe (PID: 7572)
      • Unlocker.exe (PID: 3192)
      • oxDU0MW.exe (PID: 7344)
      • cmd.exe (PID: 8160)
      • WinTemp-v4.exe (PID: 8076)
      • yCyZ3or.exe (PID: 7220)
      • 7z.exe (PID: 9304)
      • MSBuild.exe (PID: 8564)
      • XUE1F42RQHVQXV6MR7NVXU9UEU.exe (PID: 10408)
    • Contacting a server suspected of hosting an CnC

      • ramez.exe (PID: 1696)
      • svchost.exe (PID: 2196)
      • MSBuild.exe (PID: 4628)
      • MSBuild.exe (PID: 8564)
      • saren.exe (PID: 10516)
    • The process executes via Task Scheduler

      • ramez.exe (PID: 6940)
      • ramez.exe (PID: 10864)
    • Connects to the server without a host name

      • ramez.exe (PID: 1696)
      • 1c5dd6f0d2.exe (PID: 1764)
      • 1c5dd6f0d2.exe (PID: 3272)
      • control.exe (PID: 8316)
      • MSBuild.exe (PID: 8564)
      • saren.exe (PID: 10516)
      • 583137f536.exe (PID: 10728)
    • There is functionality for enable RDP (YARA)

      • ramez.exe (PID: 1696)
    • Potential Corporate Privacy Violation

      • ramez.exe (PID: 1696)
      • 1c5dd6f0d2.exe (PID: 1764)
      • 1c5dd6f0d2.exe (PID: 3272)
      • cmd.exe (PID: 8824)
      • MSBuild.exe (PID: 8564)
    • Process requests binary or script from the Internet

      • ramez.exe (PID: 1696)
      • 1c5dd6f0d2.exe (PID: 1764)
      • 1c5dd6f0d2.exe (PID: 3272)
      • MSBuild.exe (PID: 8564)
    • Searches for installed software

      • 1c5dd6f0d2.exe (PID: 3272)
      • 1c5dd6f0d2.exe (PID: 1764)
    • Executes application which crashes

      • 1c5dd6f0d2.exe (PID: 1764)
      • 1c5dd6f0d2.exe (PID: 3272)
      • Win-v42.exe (PID: 9012)
      • Win-v41.exe (PID: 9944)
    • Drops 7-zip archiver for unpacking

      • 3f17e198c5.exe (PID: 7176)
    • The process creates files with name similar to system file names

      • 3f17e198c5.exe (PID: 7176)
    • Executing commands from a ".bat" file

      • 3f17e198c5.exe (PID: 7176)
      • cmd.exe (PID: 7328)
      • nircmd.exe (PID: 7508)
      • cmd.exe (PID: 7584)
      • cmd.exe (PID: 7904)
      • NSudoLG.exe (PID: 7836)
      • 3f17e198c5.exe (PID: 7612)
      • cmd.exe (PID: 7840)
      • nircmd.exe (PID: 3308)
      • cmd.exe (PID: 8088)
      • cmd.exe (PID: 8136)
      • NSudoLG.exe (PID: 1072)
      • d6a045ea1b.exe (PID: 8992)
      • nircmd.exe (PID: 2616)
      • cmd.exe (PID: 9508)
      • NSudoLG.exe (PID: 9492)
      • cmd.exe (PID: 2136)
      • cmd.exe (PID: 9284)
    • Starts application with an unusual extension

      • cmd.exe (PID: 7392)
      • cmd.exe (PID: 7668)
      • cmd.exe (PID: 7976)
      • cmd.exe (PID: 7920)
      • cmd.exe (PID: 4244)
      • cmd.exe (PID: 8160)
      • cmd.exe (PID: 7648)
      • cmd.exe (PID: 9368)
      • cmd.exe (PID: 9568)
    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 7328)
      • cmd.exe (PID: 7584)
      • nircmd.exe (PID: 7508)
      • NSudoLG.exe (PID: 7836)
      • cmd.exe (PID: 7904)
      • 3f17e198c5.exe (PID: 7176)
      • cmd.exe (PID: 7976)
      • 3f17e198c5.exe (PID: 7612)
      • cmd.exe (PID: 7840)
      • nircmd.exe (PID: 3308)
      • NSudoLG.exe (PID: 1072)
      • cmd.exe (PID: 8088)
      • cmd.exe (PID: 8136)
      • cmd.exe (PID: 8160)
      • Unlocker.exe (PID: 7748)
      • Unlocker.exe (PID: 7460)
      • Unlocker.exe (PID: 3192)
      • Unlocker.exe (PID: 7388)
      • Unlocker.exe (PID: 8384)
      • WinTemp-v4.exe (PID: 8076)
      • Unlocker.exe (PID: 9132)
      • yCyZ3or.exe (PID: 5344)
      • d6a045ea1b.exe (PID: 8992)
      • nircmd.exe (PID: 2616)
      • cmd.exe (PID: 9284)
      • NSudoLG.exe (PID: 9492)
      • cmd.exe (PID: 2136)
      • cmd.exe (PID: 9568)
      • Unlocker.exe (PID: 9968)
      • Unlocker.exe (PID: 10952)
      • cmd.exe (PID: 9508)
    • The executable file from the user directory is run by the CMD process

      • nircmd.exe (PID: 7508)
      • NSudoLG.exe (PID: 7836)
      • NSudoLG.exe (PID: 7624)
      • nircmd.exe (PID: 3308)
      • NSudoLG.exe (PID: 1072)
      • NSudoLG.exe (PID: 7720)
      • 7z.exe (PID: 7664)
      • Unlocker.exe (PID: 7748)
      • 7z.exe (PID: 7572)
      • Unlocker.exe (PID: 7460)
      • Unlocker.exe (PID: 3192)
      • Unlocker.exe (PID: 7388)
      • Unlocker.exe (PID: 8384)
      • Unlocker.exe (PID: 9132)
      • NSudoLG.exe (PID: 9492)
      • nircmd.exe (PID: 2616)
      • 7z.exe (PID: 9304)
      • Unlocker.exe (PID: 9968)
      • Unlocker.exe (PID: 10952)
    • Application launched itself

      • cmd.exe (PID: 7328)
      • cmd.exe (PID: 7584)
      • cmd.exe (PID: 7904)
      • cmd.exe (PID: 7976)
      • cmd.exe (PID: 7840)
      • cmd.exe (PID: 8088)
      • cmd.exe (PID: 8136)
      • cmd.exe (PID: 8160)
      • yCyZ3or.exe (PID: 7220)
      • cmd.exe (PID: 2136)
      • cmd.exe (PID: 9284)
      • cmd.exe (PID: 9508)
      • cmd.exe (PID: 9568)
    • Reads the date of Windows installation

      • nircmd.exe (PID: 7508)
      • nircmd.exe (PID: 3308)
      • Unlocker.exe (PID: 7748)
      • Unlocker.exe (PID: 7460)
      • Unlocker.exe (PID: 3192)
    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 7668)
      • cmd.exe (PID: 7976)
      • cmd.exe (PID: 4244)
      • cmd.exe (PID: 8160)
      • cmd.exe (PID: 9368)
      • cmd.exe (PID: 9568)
    • PowerShell delay command usage (probably sleep evasion)

      • powershell.exe (PID: 7404)
      • powershell.exe (PID: 7972)
    • Script adds exclusion path to Windows Defender

      • NSudoLG.exe (PID: 7624)
      • NSudoLG.exe (PID: 7720)
      • WinTemp-v4.exe (PID: 8076)
    • Get information on the list of running processes

      • cmd.exe (PID: 7976)
      • cmd.exe (PID: 2392)
      • cmd.exe (PID: 1348)
      • cmd.exe (PID: 8160)
      • cmd.exe (PID: 9568)
      • cmd.exe (PID: 9756)
    • Starts POWERSHELL.EXE for commands execution

      • NSudoLG.exe (PID: 7624)
      • NSudoLG.exe (PID: 7720)
      • WinTemp-v4.exe (PID: 8076)
      • cmd.exe (PID: 8228)
    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 7976)
      • cmd.exe (PID: 8160)
      • cmd.exe (PID: 9568)
    • Starts SC.EXE for service management

      • cmd.exe (PID: 4424)
      • cmd.exe (PID: 7976)
      • cmd.exe (PID: 7532)
      • cmd.exe (PID: 8160)
      • cmd.exe (PID: 2416)
      • cmd.exe (PID: 7408)
      • cmd.exe (PID: 7512)
      • cmd.exe (PID: 7584)
      • cmd.exe (PID: 8580)
      • cmd.exe (PID: 8416)
      • cmd.exe (PID: 9912)
      • cmd.exe (PID: 9568)
      • cmd.exe (PID: 11224)
    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 5776)
      • cmd.exe (PID: 3884)
      • cmd.exe (PID: 5452)
      • cmd.exe (PID: 7348)
      • cmd.exe (PID: 8820)
      • cmd.exe (PID: 8668)
      • cmd.exe (PID: 9476)
      • cmd.exe (PID: 10464)
    • Windows service management via SC.EXE

      • sc.exe (PID: 7268)
      • sc.exe (PID: 6824)
      • sc.exe (PID: 7536)
      • sc.exe (PID: 7452)
      • sc.exe (PID: 8056)
      • sc.exe (PID: 7628)
      • sc.exe (PID: 1568)
      • sc.exe (PID: 5452)
      • sc.exe (PID: 6564)
      • sc.exe (PID: 7552)
      • sc.exe (PID: 8012)
      • sc.exe (PID: 4404)
      • sc.exe (PID: 6840)
      • sc.exe (PID: 8188)
      • sc.exe (PID: 8176)
      • sc.exe (PID: 8064)
      • sc.exe (PID: 7708)
      • sc.exe (PID: 8044)
      • sc.exe (PID: 8108)
      • sc.exe (PID: 7380)
      • sc.exe (PID: 7560)
      • sc.exe (PID: 7480)
      • sc.exe (PID: 7744)
      • sc.exe (PID: 1128)
      • sc.exe (PID: 7664)
      • sc.exe (PID: 4376)
      • sc.exe (PID: 6708)
      • sc.exe (PID: 6564)
      • sc.exe (PID: 2908)
      • sc.exe (PID: 2984)
      • sc.exe (PID: 7464)
      • sc.exe (PID: 5776)
      • sc.exe (PID: 7712)
      • sc.exe (PID: 7444)
      • sc.exe (PID: 7912)
      • sc.exe (PID: 7204)
      • sc.exe (PID: 4068)
      • sc.exe (PID: 7356)
      • sc.exe (PID: 7956)
      • sc.exe (PID: 3132)
      • sc.exe (PID: 7492)
      • sc.exe (PID: 8136)
      • sc.exe (PID: 7808)
      • sc.exe (PID: 3272)
      • sc.exe (PID: 6416)
      • sc.exe (PID: 7260)
      • sc.exe (PID: 8056)
      • sc.exe (PID: 3848)
      • sc.exe (PID: 7776)
      • sc.exe (PID: 7892)
      • sc.exe (PID: 7972)
      • sc.exe (PID: 6816)
      • sc.exe (PID: 7732)
      • sc.exe (PID: 7688)
      • sc.exe (PID: 7180)
      • sc.exe (PID: 1568)
      • sc.exe (PID: 7196)
      • sc.exe (PID: 8356)
      • sc.exe (PID: 8276)
      • sc.exe (PID: 8208)
      • sc.exe (PID: 8412)
      • sc.exe (PID: 8468)
      • sc.exe (PID: 8608)
      • sc.exe (PID: 8708)
      • sc.exe (PID: 8656)
      • sc.exe (PID: 8700)
      • sc.exe (PID: 8752)
      • sc.exe (PID: 8792)
      • sc.exe (PID: 8868)
      • sc.exe (PID: 8916)
      • sc.exe (PID: 8984)
      • sc.exe (PID: 9028)
      • sc.exe (PID: 9156)
      • sc.exe (PID: 9104)
      • sc.exe (PID: 9196)
      • sc.exe (PID: 8196)
      • sc.exe (PID: 9204)
      • sc.exe (PID: 9064)
      • sc.exe (PID: 1616)
      • sc.exe (PID: 8112)
      • sc.exe (PID: 8644)
      • sc.exe (PID: 9856)
      • sc.exe (PID: 2244)
      • sc.exe (PID: 9952)
      • sc.exe (PID: 9684)
      • sc.exe (PID: 10116)
      • sc.exe (PID: 9448)
      • sc.exe (PID: 4172)
      • sc.exe (PID: 9996)
      • sc.exe (PID: 9672)
      • sc.exe (PID: 10256)
      • sc.exe (PID: 10312)
      • sc.exe (PID: 10424)
      • sc.exe (PID: 10536)
      • sc.exe (PID: 10368)
      • sc.exe (PID: 10480)
      • sc.exe (PID: 10596)
      • sc.exe (PID: 8532)
      • sc.exe (PID: 10652)
      • sc.exe (PID: 10708)
      • sc.exe (PID: 10928)
      • sc.exe (PID: 10872)
      • sc.exe (PID: 11048)
      • sc.exe (PID: 10992)
      • sc.exe (PID: 11104)
      • sc.exe (PID: 11164)
      • sc.exe (PID: 4696)
      • sc.exe (PID: 11220)
      • sc.exe (PID: 10332)
      • sc.exe (PID: 10764)
      • sc.exe (PID: 10820)
      • sc.exe (PID: 10628)
      • sc.exe (PID: 10504)
      • sc.exe (PID: 10560)
      • sc.exe (PID: 10364)
      • sc.exe (PID: 10412)
      • sc.exe (PID: 10808)
      • sc.exe (PID: 10832)
    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 7976)
    • Drops a system driver (possible attempt to evade defenses)

      • Unlocker.exe (PID: 3192)
    • Script adds exclusion process to Windows Defender

      • WinTemp-v4.exe (PID: 8076)
    • Stops a currently running service

      • sc.exe (PID: 7692)
      • sc.exe (PID: 4892)
      • sc.exe (PID: 3896)
      • sc.exe (PID: 3032)
      • sc.exe (PID: 7616)
      • sc.exe (PID: 7324)
      • sc.exe (PID: 5096)
      • sc.exe (PID: 776)
      • sc.exe (PID: 6384)
      • sc.exe (PID: 5024)
      • sc.exe (PID: 7472)
      • sc.exe (PID: 7668)
      • sc.exe (PID: 7248)
      • sc.exe (PID: 7996)
      • sc.exe (PID: 6652)
      • sc.exe (PID: 7792)
      • sc.exe (PID: 7368)
      • sc.exe (PID: 5720)
      • sc.exe (PID: 7484)
      • sc.exe (PID: 6632)
      • sc.exe (PID: 7716)
      • sc.exe (PID: 7424)
      • sc.exe (PID: 7784)
      • sc.exe (PID: 8156)
      • sc.exe (PID: 3900)
      • sc.exe (PID: 8300)
      • sc.exe (PID: 8444)
      • sc.exe (PID: 8560)
      • sc.exe (PID: 8680)
      • sc.exe (PID: 8776)
      • sc.exe (PID: 8896)
      • sc.exe (PID: 9008)
      • sc.exe (PID: 9080)
      • sc.exe (PID: 9176)
      • sc.exe (PID: 9588)
      • sc.exe (PID: 9564)
      • sc.exe (PID: 9744)
      • sc.exe (PID: 10176)
      • sc.exe (PID: 10284)
      • sc.exe (PID: 10508)
      • sc.exe (PID: 10624)
      • sc.exe (PID: 10396)
      • sc.exe (PID: 10956)
      • sc.exe (PID: 11076)
      • sc.exe (PID: 11192)
      • sc.exe (PID: 10736)
      • sc.exe (PID: 10844)
      • sc.exe (PID: 10292)
      • sc.exe (PID: 10612)
      • sc.exe (PID: 10428)
    • Process drops legitimate windows executable

      • ramez.exe (PID: 1696)
      • cmd.exe (PID: 8160)
      • yCyZ3or.exe (PID: 7220)
    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 5364)
      • schtasks.exe (PID: 5116)
      • schtasks.exe (PID: 5800)
      • schtasks.exe (PID: 7440)
      • schtasks.exe (PID: 7376)
      • schtasks.exe (PID: 8396)
      • schtasks.exe (PID: 8368)
      • schtasks.exe (PID: 8324)
      • schtasks.exe (PID: 8460)
      • schtasks.exe (PID: 8492)
      • schtasks.exe (PID: 5760)
      • schtasks.exe (PID: 10804)
      • schtasks.exe (PID: 10868)
      • schtasks.exe (PID: 10944)
      • schtasks.exe (PID: 10892)
    • Starts a Microsoft application from unusual location

      • GQoCrEB.exe (PID: 7600)
    • Takes ownership (TAKEOWN.EXE)

      • cmd.exe (PID: 9124)
    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 8256)
      • cmd.exe (PID: 8772)
    • Uses powercfg.exe to modify the power settings

      • WinTemp-v4.exe (PID: 8076)
    • Process drops python dynamic module

      • yCyZ3or.exe (PID: 7220)
    • Checks for external IP

      • svchost.exe (PID: 2196)
      • WinTemp-v4.exe (PID: 8076)
    • The process drops C-runtime libraries

      • yCyZ3or.exe (PID: 7220)
    • Hides command output

      • cmd.exe (PID: 8328)
    • Connects to unusual port

      • WinTemp-v4.exe (PID: 8076)
      • cmd.exe (PID: 8824)
    • Executes as Windows Service

      • cmd.exe (PID: 8228)
    • Invokes assembly entry point (POWERSHELL)

      • powershell.exe (PID: 7992)
    • Probably obfuscated PowerShell command line is found

      • cmd.exe (PID: 8228)
  • INFO

    • Checks supported languages

      • random.exe (PID: 6820)
      • ramez.exe (PID: 1696)
      • ramez.exe (PID: 6940)
      • 1c5dd6f0d2.exe (PID: 1764)
      • 1c5dd6f0d2.exe (PID: 3272)
      • 3f17e198c5.exe (PID: 7176)
      • chcp.com (PID: 7464)
      • nircmd.exe (PID: 7508)
      • chcp.com (PID: 7764)
      • NSudoLG.exe (PID: 7836)
      • NSudoLG.exe (PID: 7624)
      • mode.com (PID: 8108)
      • chcp.com (PID: 8040)
      • 3f17e198c5.exe (PID: 7612)
      • chcp.com (PID: 1052)
      • nircmd.exe (PID: 3308)
      • chcp.com (PID: 5984)
      • NSudoLG.exe (PID: 1072)
      • chcp.com (PID: 5164)
      • mode.com (PID: 4272)
      • NSudoLG.exe (PID: 7720)
      • 08IyOOF.exe (PID: 8048)
      • 7z.exe (PID: 7664)
      • Unlocker.exe (PID: 7748)
      • 7z.exe (PID: 7572)
      • Unlocker.exe (PID: 7460)
      • IObitUnlocker.exe (PID: 6760)
      • oxDU0MW.exe (PID: 7344)
      • Unlocker.exe (PID: 3192)
    • Reads the computer name

      • random.exe (PID: 6820)
      • ramez.exe (PID: 1696)
      • 1c5dd6f0d2.exe (PID: 1764)
      • 1c5dd6f0d2.exe (PID: 3272)
      • 3f17e198c5.exe (PID: 7176)
      • nircmd.exe (PID: 7508)
      • NSudoLG.exe (PID: 7836)
      • NSudoLG.exe (PID: 7624)
      • 3f17e198c5.exe (PID: 7612)
      • nircmd.exe (PID: 3308)
      • NSudoLG.exe (PID: 1072)
      • NSudoLG.exe (PID: 7720)
      • 7z.exe (PID: 7664)
      • Unlocker.exe (PID: 7748)
      • 7z.exe (PID: 7572)
      • Unlocker.exe (PID: 7460)
      • Unlocker.exe (PID: 3192)
      • IObitUnlocker.exe (PID: 6760)
      • oxDU0MW.exe (PID: 7344)
    • Process checks computer location settings

      • random.exe (PID: 6820)
      • ramez.exe (PID: 1696)
      • 3f17e198c5.exe (PID: 7176)
      • nircmd.exe (PID: 7508)
      • 3f17e198c5.exe (PID: 7612)
      • nircmd.exe (PID: 3308)
    • Create files in a temporary directory

      • random.exe (PID: 6820)
      • ramez.exe (PID: 1696)
      • 3f17e198c5.exe (PID: 7176)
      • 3f17e198c5.exe (PID: 7612)
      • 7z.exe (PID: 7664)
      • 7z.exe (PID: 7572)
      • oxDU0MW.exe (PID: 7344)
    • Checks proxy server information

      • ramez.exe (PID: 1696)
    • Themida protector has been detected

      • ramez.exe (PID: 1696)
    • Creates files or folders in the user directory

      • ramez.exe (PID: 1696)
      • WerFault.exe (PID: 6132)
      • WerFault.exe (PID: 7748)
    • Reads the software policy settings

      • 1c5dd6f0d2.exe (PID: 1764)
      • 1c5dd6f0d2.exe (PID: 3272)
    • Manual execution by a user

      • 1c5dd6f0d2.exe (PID: 3272)
      • 3f17e198c5.exe (PID: 7612)
      • Win-v42.exe (PID: 9012)
    • The sample compiled with english language support

      • 3f17e198c5.exe (PID: 7176)
      • Unlocker.exe (PID: 3192)
      • ramez.exe (PID: 1696)
      • cmd.exe (PID: 8160)
      • yCyZ3or.exe (PID: 7220)
    • NirSoft software is detected

      • nircmd.exe (PID: 7508)
      • nircmd.exe (PID: 3308)
      • nircmd.exe (PID: 2616)
    • Changes the display of characters in the console

      • cmd.exe (PID: 7392)
      • cmd.exe (PID: 7668)
      • cmd.exe (PID: 7976)
      • cmd.exe (PID: 7920)
      • cmd.exe (PID: 4244)
      • cmd.exe (PID: 8160)
      • cmd.exe (PID: 7648)
      • cmd.exe (PID: 9368)
      • cmd.exe (PID: 9568)
    • Launch of the file from Registry key

      • ramez.exe (PID: 1696)
    • Checks operating system version

      • cmd.exe (PID: 7976)
      • cmd.exe (PID: 8160)
      • yCyZ3or.exe (PID: 5344)
      • cmd.exe (PID: 9568)
    • Starts MODE.COM to configure console settings

      • mode.com (PID: 4272)
      • mode.com (PID: 8108)
      • mode.com (PID: 9680)
    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7972)
      • powershell.exe (PID: 7404)
    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7972)
      • powershell.exe (PID: 7404)
    • Reads the machine GUID from the registry

      • Unlocker.exe (PID: 7748)
      • Unlocker.exe (PID: 7460)
      • Unlocker.exe (PID: 3192)
      • oxDU0MW.exe (PID: 7344)
    • Checks transactions between databases Windows and Oracle

      • oxDU0MW.exe (PID: 7344)
    • Uses Task Scheduler to autorun other applications (AUTOMATE)

      • WinTemp-v4.exe (PID: 8076)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:01 04:57:19+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 317952
InitializedDataSize: 107520
UninitializedDataSize: -
EntryPoint: 0x317000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
736
Monitored processes
590
Malicious processes
45
Suspicious processes
11

Behavior graph

Click at the process to see the details
start random.exe sppextcomobj.exe no specs slui.exe #AMADEY ramez.exe ramez.exe no specs #LUMMA 1c5dd6f0d2.exe #LUMMA svchost.exe #LUMMA 1c5dd6f0d2.exe werfault.exe no specs 3f17e198c5.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs nircmd.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs werfault.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs nsudolg.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs mode.com no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs tasklist.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs find.exe no specs nsudolg.exe no specs powershell.exe no specs 3f17e198c5.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs nircmd.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs nsudolg.exe no specs cmd.exe conhost.exe no specs cmd.exe conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs mode.com no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs tasklist.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs find.exe no specs nsudolg.exe no specs powershell.exe no specs conhost.exe no specs 08iyoof.exe no specs conhost.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs findstr.exe no specs 7z.exe unlocker.exe no specs msbuild.exe no specs #LUMMA msbuild.exe cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs find.exe no specs sc.exe no specs cmd.exe no specs findstr.exe no specs find.exe no specs 7z.exe sc.exe no specs sc.exe no specs timeout.exe no specs unlocker.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs find.exe no specs sc.exe no specs sc.exe no specs unlocker.exe cmd.exe no specs conhost.exe no specs sc.exe no specs iobitunlocker.exe no specs #XMRIG oxdu0mw.exe CMSTPLUA wintemp-v4.exe powershell.exe no specs conhost.exe no specs unlocker.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs iobitunlocker.exe no specs powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs cmd.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs taskkill.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs powershell.exe no specs conhost.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs schtasks.exe no specs reg.exe no specs schtasks.exe no specs sc.exe no specs sc.exe no specs schtasks.exe no specs sc.exe no specs reg.exe no specs schtasks.exe no specs sc.exe no specs schtasks.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs gqocreb.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs control.exe sc.exe no specs reg.exe no specs unlocker.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs taskkill.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs schtasks.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs unlocker.exe no specs cmd.exe no specs conhost.exe no specs reagentc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs win-v42.exe sc.exe no specs sc.exe no specs werfault.exe no specs cmd.exe no specs conhost.exe no specs takeown.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs ycyz3or.exe ycyz3or.exe cmd.exe no specs conhost.exe no specs fpbjy1q.exe no specs conhost.exe no specs #MINER cmd.exe #LUMMA msbuild.exe svchost.exe no specs cmd.exe no specs powershell.exe no specs conhost.exe no specs d6a045ea1b.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs nircmd.exe no specs slui.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs nsudolg.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs mode.com no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs tasklist.exe no specs win-v41.exe no specs werfault.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs findstr.exe no specs 7z.exe unlocker.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs #GCLEANER 583137f536.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs ramez.exe no specs unlocker.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs sc.exe no specs sc.exe no specs xue1f42rqhvqxv6mr7nvxu9ueu.exe #AMADEY saren.exe

Process information

PID
CMD
Path
Indicators
Parent process
684reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /fC:\Windows\System32\reg.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
732taskkill /f /pid "9968"C:\Windows\System32\taskkill.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Terminates Processes
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
776sc stop "SecurityHealthService" C:\Windows\System32\sc.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
780C:\WINDOWS\system32\cmd.exe /c "ver"C:\Windows\System32\cmd.exeyCyZ3or.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
856reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /fC:\Windows\System32\reg.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
960reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Windows Defender" /fC:\Windows\System32\reg.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
1052chcp 65001 C:\Windows\SysWOW64\chcp.comcmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ulib.dll
1072NSudoLG -U:T -P:E -UseCurrentConsole C:\Users\admin\AppData\Local\Temp\L5saGkO.bat C:\Users\admin\AppData\Local\Temp\Work\NSudoLG.execmd.exe
User:
admin
Company:
M2-Team
Integrity Level:
HIGH
Description:
NSudo Launcher
Exit code:
0
Version:
9.0.2676.0
Modules
Images
c:\users\admin\appdata\local\temp\work\nsudolg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1128sc config "SecurityHealthService" start= disabled C:\Windows\System32\sc.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1168reg query "HKLM\System\CurrentControlSet\Services\WdNisSvc" C:\Windows\System32\reg.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
75 382
Read events
75 107
Write events
72
Delete events
203

Modification events

(PID) Process:(1696) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1696) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1696) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1696) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:1c5dd6f0d2.exe
Value:
C:\Users\admin\AppData\Local\Temp\10212050101\1c5dd6f0d2.exe
(PID) Process:(7508) nircmd.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\System32\cmd.exe.FriendlyAppName
Value:
Windows Command Processor
(PID) Process:(7508) nircmd.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\System32\cmd.exe.ApplicationCompany
Value:
Microsoft Corporation
(PID) Process:(7816) reg.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize
Operation:writeName:AppsUseLightTheme
Value:
0
(PID) Process:(1696) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:3f17e198c5.exe
Value:
C:\Users\admin\AppData\Local\Temp\10212060101\3f17e198c5.exe
(PID) Process:(8084) reg.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize
Operation:writeName:AppsUseLightTheme
Value:
0
(PID) Process:(4192) reg.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize
Operation:writeName:AppsUseLightTheme
Value:
0
Executable files
167
Suspicious files
30
Text files
38
Unknown types
0

Dropped files

PID
Process
Filename
Type
6132WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1c5dd6f0d2.exe_211958132b5ba644296a4d676e45fc2d471cfa6_5e1a1639_8bfb14e3-64ff-4765-90d1-39df27fa9a04\Report.wer
MD5:
SHA256:
6132WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\1c5dd6f0d2.exe.1764.dmp
MD5:
SHA256:
7748WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1c5dd6f0d2.exe_211958132b5ba644296a4d676e45fc2d471cfa6_5e1a1639_4d49caae-e453-4d58-b30e-349b7ef3b28b\Report.wer
MD5:
SHA256:
7748WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\1c5dd6f0d2.exe.3272.dmp
MD5:
SHA256:
71763f17e198c5.exeC:\Users\admin\AppData\Local\Temp\Work\nircmd.exeexecutable
MD5:4A9DA765FD91E80DECFD2C9FE221E842
SHA256:2E81E048AB419FDC6E5F4336A951BD282ED6B740048DC38D7673678EE3490CDA
6820random.exeC:\Users\admin\AppData\Local\Temp\d610cf342e\ramez.exeexecutable
MD5:D20D9543B2D43F5811061F2BFA40BDAB
SHA256:494DF8DEFF9A9C926534940FC6330B429E672ED64B7A2C2F75A0357ECF0EFF35
1696ramez.exeC:\Users\admin\AppData\Local\Temp\10212050101\1c5dd6f0d2.exeexecutable
MD5:B3FD94F56D5D25ACF6D632E0B2EDCC82
SHA256:1DC2DBB369DCBC06B4CAD0D5AD233D8776FB1AB6764957A87AC56E1E21D0CC57
71763f17e198c5.exeC:\Users\admin\AppData\Local\Temp\Work\DKTolz.zipcompressed
MD5:BEA1D6DF628F4D4C9DB76A0F0AC51F4E
SHA256:7CF8E9A7F8F38406358D479B46EA6EC82EEC6AA7A6C9799CB789770E25BEE551
6132WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER153A.tmp.dmpbinary
MD5:CB70E53BB3BA57867C989A36FB3D835D
SHA256:F9474FDBB370E95157ECB857347B19DF95FA4F4EC0B3D60FBF2BE0E5DD01D1DE
6132WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER1675.tmp.xmlxml
MD5:8D9E3FF9D1D856EE3D7E5465F5A2913C
SHA256:9D353B7E66EB275E7183DB6CE73264ABCE653AAF0B134D7A5EDD4DFFB96F1A33
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
52
TCP/UDP connections
70
DNS requests
25
Threats
67

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
1696
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
unknown
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
1696
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
unknown
1696
ramez.exe
GET
200
185.156.72.2:80
http://185.156.72.2/luma/random.exe
unknown
malicious
1696
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
unknown
1696
ramez.exe
GET
200
185.156.72.2:80
http://185.156.72.2/off/random.exe
unknown
malicious
1764
1c5dd6f0d2.exe
GET
200
185.156.72.2:80
http://185.156.72.2/testmine/random.exe
unknown
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
4
System
192.168.100.255:138
whitelisted
5796
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1696
ramez.exe
185.156.72.96:80
Tov Vaiz Partner
RU
unknown
6544
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.32
  • 23.216.77.27
  • 23.216.77.35
  • 23.216.77.25
  • 23.216.77.41
  • 23.216.77.39
  • 23.216.77.31
  • 23.216.77.24
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
login.live.com
  • 20.190.159.0
  • 40.126.31.2
  • 40.126.31.69
  • 20.190.159.128
  • 40.126.31.131
  • 20.190.159.129
  • 40.126.31.1
  • 40.126.31.129
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
greengwjz.top
  • 104.21.80.1
  • 104.21.16.1
  • 104.21.64.1
  • 104.21.48.1
  • 104.21.112.1
  • 104.21.32.1
  • 104.21.96.1
unknown
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

PID
Process
Class
Message
1696
ramez.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 35
1696
ramez.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
1696
ramez.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
1696
ramez.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
1696
ramez.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
1696
ramez.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 35
1696
ramez.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
1696
ramez.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
1696
ramez.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
No debug info