File name:

random.exe

Full analysis: https://app.any.run/tasks/5f3e544c-5a5c-4598-a35c-fdf33772a577
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: May 26, 2025, 16:24:43
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
amadey
botnet
stealer
loader
lumma
auto-reg
themida
rdp
xmrig
auto-sch
evasion
miner
gcleaner
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

D20D9543B2D43F5811061F2BFA40BDAB

SHA1:

46EF9B100E3DEC32076B070BBD90C916F177DEFD

SHA256:

494DF8DEFF9A9C926534940FC6330B429E672ED64B7A2C2F75A0357ECF0EFF35

SSDEEP:

98304:FnCybWZQH3pYmNlwT5NOls7Cdlt3X/ANIffuMAk4coGOh3MGMwJUTw6G5X9b37GQ:b

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • AMADEY mutex has been found

      • ramez.exe (PID: 1696)
      • random.exe (PID: 6820)
      • ramez.exe (PID: 6940)
    • AMADEY has been detected (SURICATA)

      • ramez.exe (PID: 1696)
      • saren.exe (PID: 10516)
    • Connects to the CnC server

      • ramez.exe (PID: 1696)
      • svchost.exe (PID: 2196)
      • cmd.exe (PID: 8824)
      • saren.exe (PID: 10516)
    • AMADEY has been detected (YARA)

      • ramez.exe (PID: 1696)
    • LUMMA mutex has been found

      • 1c5dd6f0d2.exe (PID: 1764)
      • 1c5dd6f0d2.exe (PID: 3272)
    • Changes the autorun value in the registry

      • ramez.exe (PID: 1696)
    • Actions looks like stealing of personal data

      • 1c5dd6f0d2.exe (PID: 1764)
      • 1c5dd6f0d2.exe (PID: 3272)
    • Steals credentials from Web Browsers

      • 1c5dd6f0d2.exe (PID: 1764)
      • 1c5dd6f0d2.exe (PID: 3272)
    • Adds path to the Windows Defender exclusion list

      • cmd.exe (PID: 7976)
      • NSudoLG.exe (PID: 7624)
      • cmd.exe (PID: 8160)
      • NSudoLG.exe (PID: 7720)
    • Changes Windows Defender settings

      • NSudoLG.exe (PID: 7624)
      • NSudoLG.exe (PID: 7720)
      • WinTemp-v4.exe (PID: 8076)
    • XMRig has been detected

      • oxDU0MW.exe (PID: 7344)
    • Known privilege escalation attack

      • dllhost.exe (PID: 7192)
    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)
      • MSBuild.exe (PID: 4628)
      • MSBuild.exe (PID: 8564)
    • Adds process to the Windows Defender exclusion list

      • WinTemp-v4.exe (PID: 8076)
    • Starts SC.EXE for service management

      • cmd.exe (PID: 8160)
      • cmd.exe (PID: 7976)
      • cmd.exe (PID: 9568)
    • Starts REAGENTC.EXE to disable the Windows Recovery Environment

      • ReAgentc.exe (PID: 2516)
    • MINER has been detected (SURICATA)

      • cmd.exe (PID: 8824)
    • Executing a file with an untrusted certificate

      • 583137f536.exe (PID: 10728)
    • GCLEANER has been detected (SURICATA)

      • 583137f536.exe (PID: 10728)
  • SUSPICIOUS

    • Reads the BIOS version

      • random.exe (PID: 6820)
      • ramez.exe (PID: 1696)
      • ramez.exe (PID: 6940)
      • 1c5dd6f0d2.exe (PID: 1764)
      • 1c5dd6f0d2.exe (PID: 3272)
    • Reads security settings of Internet Explorer

      • random.exe (PID: 6820)
      • ramez.exe (PID: 1696)
      • 3f17e198c5.exe (PID: 7176)
      • nircmd.exe (PID: 7508)
      • 3f17e198c5.exe (PID: 7612)
      • nircmd.exe (PID: 3308)
      • Unlocker.exe (PID: 7748)
      • Unlocker.exe (PID: 7460)
      • Unlocker.exe (PID: 3192)
    • Starts itself from another location

      • random.exe (PID: 6820)
      • XUE1F42RQHVQXV6MR7NVXU9UEU.exe (PID: 10408)
    • Executable content was dropped or overwritten

      • random.exe (PID: 6820)
      • ramez.exe (PID: 1696)
      • 3f17e198c5.exe (PID: 7176)
      • 7z.exe (PID: 7664)
      • 7z.exe (PID: 7572)
      • oxDU0MW.exe (PID: 7344)
      • Unlocker.exe (PID: 3192)
      • cmd.exe (PID: 8160)
      • WinTemp-v4.exe (PID: 8076)
      • yCyZ3or.exe (PID: 7220)
      • 7z.exe (PID: 9304)
      • MSBuild.exe (PID: 8564)
      • XUE1F42RQHVQXV6MR7NVXU9UEU.exe (PID: 10408)
    • Connects to the server without a host name

      • ramez.exe (PID: 1696)
      • 1c5dd6f0d2.exe (PID: 1764)
      • 1c5dd6f0d2.exe (PID: 3272)
      • control.exe (PID: 8316)
      • MSBuild.exe (PID: 8564)
      • saren.exe (PID: 10516)
      • 583137f536.exe (PID: 10728)
    • Contacting a server suspected of hosting an CnC

      • ramez.exe (PID: 1696)
      • svchost.exe (PID: 2196)
      • MSBuild.exe (PID: 4628)
      • MSBuild.exe (PID: 8564)
      • saren.exe (PID: 10516)
    • The process executes via Task Scheduler

      • ramez.exe (PID: 6940)
      • ramez.exe (PID: 10864)
    • There is functionality for enable RDP (YARA)

      • ramez.exe (PID: 1696)
    • Potential Corporate Privacy Violation

      • ramez.exe (PID: 1696)
      • 1c5dd6f0d2.exe (PID: 1764)
      • 1c5dd6f0d2.exe (PID: 3272)
      • cmd.exe (PID: 8824)
      • MSBuild.exe (PID: 8564)
    • Process requests binary or script from the Internet

      • ramez.exe (PID: 1696)
      • 1c5dd6f0d2.exe (PID: 1764)
      • 1c5dd6f0d2.exe (PID: 3272)
      • MSBuild.exe (PID: 8564)
    • Searches for installed software

      • 1c5dd6f0d2.exe (PID: 1764)
      • 1c5dd6f0d2.exe (PID: 3272)
    • Executes application which crashes

      • 1c5dd6f0d2.exe (PID: 1764)
      • 1c5dd6f0d2.exe (PID: 3272)
      • Win-v42.exe (PID: 9012)
      • Win-v41.exe (PID: 9944)
    • Drops 7-zip archiver for unpacking

      • 3f17e198c5.exe (PID: 7176)
    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 7328)
      • 3f17e198c5.exe (PID: 7176)
      • nircmd.exe (PID: 7508)
      • cmd.exe (PID: 7584)
      • NSudoLG.exe (PID: 7836)
      • cmd.exe (PID: 7904)
      • cmd.exe (PID: 7976)
      • 3f17e198c5.exe (PID: 7612)
      • cmd.exe (PID: 7840)
      • nircmd.exe (PID: 3308)
      • NSudoLG.exe (PID: 1072)
      • cmd.exe (PID: 8088)
      • cmd.exe (PID: 8160)
      • cmd.exe (PID: 8136)
      • Unlocker.exe (PID: 7748)
      • Unlocker.exe (PID: 7460)
      • Unlocker.exe (PID: 3192)
      • Unlocker.exe (PID: 7388)
      • Unlocker.exe (PID: 8384)
      • Unlocker.exe (PID: 9132)
      • WinTemp-v4.exe (PID: 8076)
      • yCyZ3or.exe (PID: 5344)
      • d6a045ea1b.exe (PID: 8992)
      • cmd.exe (PID: 2136)
      • nircmd.exe (PID: 2616)
      • cmd.exe (PID: 9284)
      • cmd.exe (PID: 9508)
      • cmd.exe (PID: 9568)
      • NSudoLG.exe (PID: 9492)
      • Unlocker.exe (PID: 9968)
      • Unlocker.exe (PID: 10952)
    • Executing commands from a ".bat" file

      • 3f17e198c5.exe (PID: 7176)
      • cmd.exe (PID: 7328)
      • nircmd.exe (PID: 7508)
      • cmd.exe (PID: 7584)
      • NSudoLG.exe (PID: 7836)
      • cmd.exe (PID: 7904)
      • 3f17e198c5.exe (PID: 7612)
      • cmd.exe (PID: 7840)
      • nircmd.exe (PID: 3308)
      • cmd.exe (PID: 8088)
      • NSudoLG.exe (PID: 1072)
      • cmd.exe (PID: 8136)
      • d6a045ea1b.exe (PID: 8992)
      • cmd.exe (PID: 2136)
      • nircmd.exe (PID: 2616)
      • cmd.exe (PID: 9284)
      • NSudoLG.exe (PID: 9492)
      • cmd.exe (PID: 9508)
    • Application launched itself

      • cmd.exe (PID: 7328)
      • cmd.exe (PID: 7584)
      • cmd.exe (PID: 7904)
      • cmd.exe (PID: 7976)
      • cmd.exe (PID: 7840)
      • cmd.exe (PID: 8088)
      • cmd.exe (PID: 8136)
      • cmd.exe (PID: 8160)
      • yCyZ3or.exe (PID: 7220)
      • cmd.exe (PID: 9284)
      • cmd.exe (PID: 2136)
      • cmd.exe (PID: 9508)
      • cmd.exe (PID: 9568)
    • The process creates files with name similar to system file names

      • 3f17e198c5.exe (PID: 7176)
    • Starts application with an unusual extension

      • cmd.exe (PID: 7392)
      • cmd.exe (PID: 7668)
      • cmd.exe (PID: 7976)
      • cmd.exe (PID: 7920)
      • cmd.exe (PID: 4244)
      • cmd.exe (PID: 8160)
      • cmd.exe (PID: 7648)
      • cmd.exe (PID: 9368)
      • cmd.exe (PID: 9568)
    • The executable file from the user directory is run by the CMD process

      • nircmd.exe (PID: 7508)
      • NSudoLG.exe (PID: 7836)
      • NSudoLG.exe (PID: 7624)
      • nircmd.exe (PID: 3308)
      • NSudoLG.exe (PID: 1072)
      • NSudoLG.exe (PID: 7720)
      • 7z.exe (PID: 7664)
      • Unlocker.exe (PID: 7748)
      • 7z.exe (PID: 7572)
      • Unlocker.exe (PID: 3192)
      • Unlocker.exe (PID: 7460)
      • Unlocker.exe (PID: 7388)
      • Unlocker.exe (PID: 8384)
      • Unlocker.exe (PID: 9132)
      • nircmd.exe (PID: 2616)
      • NSudoLG.exe (PID: 9492)
      • Unlocker.exe (PID: 9968)
      • 7z.exe (PID: 9304)
      • Unlocker.exe (PID: 10952)
    • Reads the date of Windows installation

      • nircmd.exe (PID: 7508)
      • nircmd.exe (PID: 3308)
      • Unlocker.exe (PID: 7748)
      • Unlocker.exe (PID: 7460)
      • Unlocker.exe (PID: 3192)
    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 7668)
      • cmd.exe (PID: 7976)
      • cmd.exe (PID: 4244)
      • cmd.exe (PID: 8160)
      • cmd.exe (PID: 9368)
      • cmd.exe (PID: 9568)
    • Get information on the list of running processes

      • cmd.exe (PID: 7976)
      • cmd.exe (PID: 2392)
      • cmd.exe (PID: 8160)
      • cmd.exe (PID: 1348)
      • cmd.exe (PID: 9568)
      • cmd.exe (PID: 9756)
    • PowerShell delay command usage (probably sleep evasion)

      • powershell.exe (PID: 7404)
      • powershell.exe (PID: 7972)
    • Script adds exclusion path to Windows Defender

      • NSudoLG.exe (PID: 7624)
      • NSudoLG.exe (PID: 7720)
      • WinTemp-v4.exe (PID: 8076)
    • Starts POWERSHELL.EXE for commands execution

      • NSudoLG.exe (PID: 7624)
      • NSudoLG.exe (PID: 7720)
      • WinTemp-v4.exe (PID: 8076)
      • cmd.exe (PID: 8228)
    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 7976)
      • cmd.exe (PID: 8160)
      • cmd.exe (PID: 9568)
    • Windows service management via SC.EXE

      • sc.exe (PID: 6824)
      • sc.exe (PID: 7268)
      • sc.exe (PID: 7536)
      • sc.exe (PID: 7452)
      • sc.exe (PID: 8056)
      • sc.exe (PID: 5452)
      • sc.exe (PID: 7628)
      • sc.exe (PID: 1568)
      • sc.exe (PID: 6564)
      • sc.exe (PID: 8012)
      • sc.exe (PID: 7552)
      • sc.exe (PID: 6840)
      • sc.exe (PID: 8064)
      • sc.exe (PID: 8188)
      • sc.exe (PID: 8176)
      • sc.exe (PID: 7708)
      • sc.exe (PID: 7560)
      • sc.exe (PID: 4404)
      • sc.exe (PID: 8044)
      • sc.exe (PID: 4376)
      • sc.exe (PID: 1128)
      • sc.exe (PID: 7744)
      • sc.exe (PID: 7664)
      • sc.exe (PID: 2908)
      • sc.exe (PID: 5776)
      • sc.exe (PID: 2984)
      • sc.exe (PID: 7464)
      • sc.exe (PID: 8108)
      • sc.exe (PID: 7380)
      • sc.exe (PID: 7480)
      • sc.exe (PID: 6708)
      • sc.exe (PID: 6564)
      • sc.exe (PID: 7912)
      • sc.exe (PID: 7712)
      • sc.exe (PID: 7356)
      • sc.exe (PID: 7204)
      • sc.exe (PID: 8136)
      • sc.exe (PID: 4068)
      • sc.exe (PID: 3132)
      • sc.exe (PID: 7808)
      • sc.exe (PID: 7492)
      • sc.exe (PID: 7444)
      • sc.exe (PID: 7956)
      • sc.exe (PID: 8056)
      • sc.exe (PID: 3848)
      • sc.exe (PID: 7892)
      • sc.exe (PID: 7972)
      • sc.exe (PID: 6816)
      • sc.exe (PID: 3272)
      • sc.exe (PID: 6416)
      • sc.exe (PID: 7260)
      • sc.exe (PID: 7776)
      • sc.exe (PID: 7732)
      • sc.exe (PID: 7180)
      • sc.exe (PID: 1568)
      • sc.exe (PID: 7688)
      • sc.exe (PID: 8208)
      • sc.exe (PID: 7196)
      • sc.exe (PID: 8356)
      • sc.exe (PID: 8276)
      • sc.exe (PID: 8412)
      • sc.exe (PID: 8700)
      • sc.exe (PID: 8608)
      • sc.exe (PID: 8656)
      • sc.exe (PID: 8708)
      • sc.exe (PID: 8752)
      • sc.exe (PID: 8792)
      • sc.exe (PID: 8868)
      • sc.exe (PID: 8916)
      • sc.exe (PID: 8468)
      • sc.exe (PID: 8532)
      • sc.exe (PID: 9064)
      • sc.exe (PID: 9104)
      • sc.exe (PID: 9156)
      • sc.exe (PID: 9196)
      • sc.exe (PID: 8196)
      • sc.exe (PID: 8984)
      • sc.exe (PID: 9028)
      • sc.exe (PID: 9204)
      • sc.exe (PID: 8644)
      • sc.exe (PID: 1616)
      • sc.exe (PID: 8112)
      • sc.exe (PID: 4172)
      • sc.exe (PID: 2244)
      • sc.exe (PID: 9952)
      • sc.exe (PID: 9856)
      • sc.exe (PID: 9684)
      • sc.exe (PID: 9996)
      • sc.exe (PID: 10116)
      • sc.exe (PID: 10256)
      • sc.exe (PID: 10312)
      • sc.exe (PID: 10368)
      • sc.exe (PID: 10708)
      • sc.exe (PID: 10424)
      • sc.exe (PID: 10536)
      • sc.exe (PID: 10596)
      • sc.exe (PID: 10652)
      • sc.exe (PID: 9448)
      • sc.exe (PID: 9672)
      • sc.exe (PID: 10480)
      • sc.exe (PID: 10872)
      • sc.exe (PID: 10928)
      • sc.exe (PID: 11048)
      • sc.exe (PID: 10992)
      • sc.exe (PID: 11164)
      • sc.exe (PID: 11104)
      • sc.exe (PID: 11220)
      • sc.exe (PID: 10412)
      • sc.exe (PID: 4696)
      • sc.exe (PID: 10332)
      • sc.exe (PID: 10764)
      • sc.exe (PID: 10820)
      • sc.exe (PID: 10628)
      • sc.exe (PID: 10364)
      • sc.exe (PID: 10808)
      • sc.exe (PID: 10832)
      • sc.exe (PID: 10504)
      • sc.exe (PID: 10560)
    • Starts SC.EXE for service management

      • cmd.exe (PID: 4424)
      • cmd.exe (PID: 7976)
      • cmd.exe (PID: 7532)
      • cmd.exe (PID: 8160)
      • cmd.exe (PID: 2416)
      • cmd.exe (PID: 7512)
      • cmd.exe (PID: 7408)
      • cmd.exe (PID: 7584)
      • cmd.exe (PID: 8580)
      • cmd.exe (PID: 8416)
      • cmd.exe (PID: 9912)
      • cmd.exe (PID: 9568)
      • cmd.exe (PID: 11224)
    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 5776)
      • cmd.exe (PID: 3884)
      • cmd.exe (PID: 5452)
      • cmd.exe (PID: 7348)
      • cmd.exe (PID: 8820)
      • cmd.exe (PID: 8668)
      • cmd.exe (PID: 9476)
      • cmd.exe (PID: 10464)
    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 7976)
    • Drops a system driver (possible attempt to evade defenses)

      • Unlocker.exe (PID: 3192)
    • Stops a currently running service

      • sc.exe (PID: 7692)
      • sc.exe (PID: 4892)
      • sc.exe (PID: 3896)
      • sc.exe (PID: 3032)
      • sc.exe (PID: 7472)
      • sc.exe (PID: 7616)
      • sc.exe (PID: 5096)
      • sc.exe (PID: 776)
      • sc.exe (PID: 5024)
      • sc.exe (PID: 6384)
      • sc.exe (PID: 7668)
      • sc.exe (PID: 7324)
      • sc.exe (PID: 7248)
      • sc.exe (PID: 7792)
      • sc.exe (PID: 7996)
      • sc.exe (PID: 6652)
      • sc.exe (PID: 7368)
      • sc.exe (PID: 7484)
      • sc.exe (PID: 5720)
      • sc.exe (PID: 6632)
      • sc.exe (PID: 7716)
      • sc.exe (PID: 7424)
      • sc.exe (PID: 7784)
      • sc.exe (PID: 8156)
      • sc.exe (PID: 8300)
      • sc.exe (PID: 3900)
      • sc.exe (PID: 8560)
      • sc.exe (PID: 8680)
      • sc.exe (PID: 8776)
      • sc.exe (PID: 8896)
      • sc.exe (PID: 8444)
      • sc.exe (PID: 9080)
      • sc.exe (PID: 9176)
      • sc.exe (PID: 9008)
      • sc.exe (PID: 9564)
      • sc.exe (PID: 9744)
      • sc.exe (PID: 9588)
      • sc.exe (PID: 10284)
      • sc.exe (PID: 10396)
      • sc.exe (PID: 10624)
      • sc.exe (PID: 10508)
      • sc.exe (PID: 10736)
      • sc.exe (PID: 10176)
      • sc.exe (PID: 10956)
      • sc.exe (PID: 10844)
      • sc.exe (PID: 11076)
      • sc.exe (PID: 11192)
      • sc.exe (PID: 10292)
      • sc.exe (PID: 10612)
      • sc.exe (PID: 10428)
    • Script adds exclusion process to Windows Defender

      • WinTemp-v4.exe (PID: 8076)
    • Process drops legitimate windows executable

      • ramez.exe (PID: 1696)
      • cmd.exe (PID: 8160)
      • yCyZ3or.exe (PID: 7220)
    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 5364)
      • schtasks.exe (PID: 5116)
      • schtasks.exe (PID: 5800)
      • schtasks.exe (PID: 7376)
      • schtasks.exe (PID: 7440)
      • schtasks.exe (PID: 8324)
      • schtasks.exe (PID: 8368)
      • schtasks.exe (PID: 8396)
      • schtasks.exe (PID: 8460)
      • schtasks.exe (PID: 8492)
      • schtasks.exe (PID: 10804)
      • schtasks.exe (PID: 5760)
      • schtasks.exe (PID: 10868)
      • schtasks.exe (PID: 10892)
      • schtasks.exe (PID: 10944)
    • Starts a Microsoft application from unusual location

      • GQoCrEB.exe (PID: 7600)
    • Takes ownership (TAKEOWN.EXE)

      • cmd.exe (PID: 9124)
    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 8256)
      • cmd.exe (PID: 8772)
    • Uses powercfg.exe to modify the power settings

      • WinTemp-v4.exe (PID: 8076)
    • Checks for external IP

      • WinTemp-v4.exe (PID: 8076)
      • svchost.exe (PID: 2196)
    • The process drops C-runtime libraries

      • yCyZ3or.exe (PID: 7220)
    • Connects to unusual port

      • WinTemp-v4.exe (PID: 8076)
      • cmd.exe (PID: 8824)
    • Executes as Windows Service

      • cmd.exe (PID: 8228)
    • Invokes assembly entry point (POWERSHELL)

      • powershell.exe (PID: 7992)
    • Hides command output

      • cmd.exe (PID: 8328)
    • Process drops python dynamic module

      • yCyZ3or.exe (PID: 7220)
    • Probably obfuscated PowerShell command line is found

      • cmd.exe (PID: 8228)
  • INFO

    • Reads the computer name

      • random.exe (PID: 6820)
      • ramez.exe (PID: 1696)
      • 1c5dd6f0d2.exe (PID: 1764)
      • 1c5dd6f0d2.exe (PID: 3272)
      • NSudoLG.exe (PID: 7836)
      • 3f17e198c5.exe (PID: 7176)
      • NSudoLG.exe (PID: 7624)
      • nircmd.exe (PID: 7508)
      • 3f17e198c5.exe (PID: 7612)
      • nircmd.exe (PID: 3308)
      • NSudoLG.exe (PID: 1072)
      • NSudoLG.exe (PID: 7720)
      • 7z.exe (PID: 7664)
      • Unlocker.exe (PID: 7748)
      • 7z.exe (PID: 7572)
      • Unlocker.exe (PID: 3192)
      • Unlocker.exe (PID: 7460)
      • IObitUnlocker.exe (PID: 6760)
      • oxDU0MW.exe (PID: 7344)
    • Checks supported languages

      • random.exe (PID: 6820)
      • ramez.exe (PID: 1696)
      • ramez.exe (PID: 6940)
      • 1c5dd6f0d2.exe (PID: 1764)
      • 1c5dd6f0d2.exe (PID: 3272)
      • 3f17e198c5.exe (PID: 7176)
      • chcp.com (PID: 7464)
      • nircmd.exe (PID: 7508)
      • chcp.com (PID: 7764)
      • NSudoLG.exe (PID: 7836)
      • chcp.com (PID: 8040)
      • mode.com (PID: 8108)
      • NSudoLG.exe (PID: 7624)
      • 3f17e198c5.exe (PID: 7612)
      • chcp.com (PID: 1052)
      • nircmd.exe (PID: 3308)
      • chcp.com (PID: 5984)
      • NSudoLG.exe (PID: 1072)
      • chcp.com (PID: 5164)
      • mode.com (PID: 4272)
      • NSudoLG.exe (PID: 7720)
      • 08IyOOF.exe (PID: 8048)
      • 7z.exe (PID: 7664)
      • Unlocker.exe (PID: 7748)
      • 7z.exe (PID: 7572)
      • Unlocker.exe (PID: 3192)
      • Unlocker.exe (PID: 7460)
      • IObitUnlocker.exe (PID: 6760)
      • oxDU0MW.exe (PID: 7344)
    • Process checks computer location settings

      • random.exe (PID: 6820)
      • ramez.exe (PID: 1696)
      • 3f17e198c5.exe (PID: 7176)
      • nircmd.exe (PID: 7508)
      • 3f17e198c5.exe (PID: 7612)
      • nircmd.exe (PID: 3308)
    • Checks proxy server information

      • ramez.exe (PID: 1696)
    • Create files in a temporary directory

      • random.exe (PID: 6820)
      • ramez.exe (PID: 1696)
      • 3f17e198c5.exe (PID: 7176)
      • 3f17e198c5.exe (PID: 7612)
      • 7z.exe (PID: 7664)
      • 7z.exe (PID: 7572)
      • oxDU0MW.exe (PID: 7344)
    • Creates files or folders in the user directory

      • ramez.exe (PID: 1696)
      • WerFault.exe (PID: 6132)
      • WerFault.exe (PID: 7748)
    • Reads the software policy settings

      • 1c5dd6f0d2.exe (PID: 1764)
      • 1c5dd6f0d2.exe (PID: 3272)
    • Themida protector has been detected

      • ramez.exe (PID: 1696)
    • Launch of the file from Registry key

      • ramez.exe (PID: 1696)
    • Manual execution by a user

      • 1c5dd6f0d2.exe (PID: 3272)
      • 3f17e198c5.exe (PID: 7612)
      • Win-v42.exe (PID: 9012)
    • The sample compiled with english language support

      • 3f17e198c5.exe (PID: 7176)
      • Unlocker.exe (PID: 3192)
      • ramez.exe (PID: 1696)
      • cmd.exe (PID: 8160)
      • yCyZ3or.exe (PID: 7220)
    • Changes the display of characters in the console

      • cmd.exe (PID: 7392)
      • cmd.exe (PID: 7668)
      • cmd.exe (PID: 7976)
      • cmd.exe (PID: 7920)
      • cmd.exe (PID: 4244)
      • cmd.exe (PID: 8160)
      • cmd.exe (PID: 7648)
      • cmd.exe (PID: 9368)
      • cmd.exe (PID: 9568)
    • NirSoft software is detected

      • nircmd.exe (PID: 7508)
      • nircmd.exe (PID: 3308)
      • nircmd.exe (PID: 2616)
    • Starts MODE.COM to configure console settings

      • mode.com (PID: 8108)
      • mode.com (PID: 4272)
      • mode.com (PID: 9680)
    • Checks operating system version

      • cmd.exe (PID: 7976)
      • cmd.exe (PID: 8160)
      • yCyZ3or.exe (PID: 5344)
      • cmd.exe (PID: 9568)
    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7404)
      • powershell.exe (PID: 7972)
    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7404)
      • powershell.exe (PID: 7972)
    • Reads the machine GUID from the registry

      • Unlocker.exe (PID: 7748)
      • Unlocker.exe (PID: 7460)
      • Unlocker.exe (PID: 3192)
      • oxDU0MW.exe (PID: 7344)
    • Checks transactions between databases Windows and Oracle

      • oxDU0MW.exe (PID: 7344)
    • Uses Task Scheduler to autorun other applications (AUTOMATE)

      • WinTemp-v4.exe (PID: 8076)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:01 04:57:19+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 317952
InitializedDataSize: 107520
UninitializedDataSize: -
EntryPoint: 0x317000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
736
Monitored processes
590
Malicious processes
45
Suspicious processes
11

Behavior graph

Click at the process to see the details
start random.exe sppextcomobj.exe no specs slui.exe #AMADEY ramez.exe ramez.exe no specs #LUMMA 1c5dd6f0d2.exe #LUMMA svchost.exe #LUMMA 1c5dd6f0d2.exe werfault.exe no specs 3f17e198c5.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs nircmd.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs werfault.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs nsudolg.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs mode.com no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs tasklist.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs find.exe no specs nsudolg.exe no specs powershell.exe no specs 3f17e198c5.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs nircmd.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs nsudolg.exe no specs cmd.exe conhost.exe no specs cmd.exe conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs mode.com no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs tasklist.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs find.exe no specs nsudolg.exe no specs powershell.exe no specs conhost.exe no specs 08iyoof.exe no specs conhost.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs findstr.exe no specs 7z.exe unlocker.exe no specs msbuild.exe no specs #LUMMA msbuild.exe cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs find.exe no specs sc.exe no specs cmd.exe no specs findstr.exe no specs find.exe no specs 7z.exe sc.exe no specs sc.exe no specs timeout.exe no specs unlocker.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs find.exe no specs sc.exe no specs sc.exe no specs unlocker.exe cmd.exe no specs conhost.exe no specs sc.exe no specs iobitunlocker.exe no specs #XMRIG oxdu0mw.exe CMSTPLUA wintemp-v4.exe powershell.exe no specs conhost.exe no specs unlocker.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs iobitunlocker.exe no specs powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs cmd.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs taskkill.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs powershell.exe no specs conhost.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs schtasks.exe no specs reg.exe no specs schtasks.exe no specs sc.exe no specs sc.exe no specs schtasks.exe no specs sc.exe no specs reg.exe no specs schtasks.exe no specs sc.exe no specs schtasks.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs gqocreb.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs control.exe sc.exe no specs reg.exe no specs unlocker.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs taskkill.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs schtasks.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs unlocker.exe no specs cmd.exe no specs conhost.exe no specs reagentc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs win-v42.exe sc.exe no specs sc.exe no specs werfault.exe no specs cmd.exe no specs conhost.exe no specs takeown.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs ycyz3or.exe ycyz3or.exe cmd.exe no specs conhost.exe no specs fpbjy1q.exe no specs conhost.exe no specs #MINER cmd.exe #LUMMA msbuild.exe svchost.exe no specs cmd.exe no specs powershell.exe no specs conhost.exe no specs d6a045ea1b.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs nircmd.exe no specs slui.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs nsudolg.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs mode.com no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs tasklist.exe no specs win-v41.exe no specs werfault.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs findstr.exe no specs 7z.exe unlocker.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs #GCLEANER 583137f536.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs ramez.exe no specs unlocker.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs sc.exe no specs sc.exe no specs xue1f42rqhvqxv6mr7nvxu9ueu.exe #AMADEY saren.exe

Process information

PID
CMD
Path
Indicators
Parent process
684reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /fC:\Windows\System32\reg.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
732taskkill /f /pid "9968"C:\Windows\System32\taskkill.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Terminates Processes
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
776sc stop "SecurityHealthService" C:\Windows\System32\sc.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
780C:\WINDOWS\system32\cmd.exe /c "ver"C:\Windows\System32\cmd.exeyCyZ3or.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
856reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /fC:\Windows\System32\reg.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
960reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Windows Defender" /fC:\Windows\System32\reg.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
1052chcp 65001 C:\Windows\SysWOW64\chcp.comcmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ulib.dll
1072NSudoLG -U:T -P:E -UseCurrentConsole C:\Users\admin\AppData\Local\Temp\L5saGkO.bat C:\Users\admin\AppData\Local\Temp\Work\NSudoLG.execmd.exe
User:
admin
Company:
M2-Team
Integrity Level:
HIGH
Description:
NSudo Launcher
Exit code:
0
Version:
9.0.2676.0
Modules
Images
c:\users\admin\appdata\local\temp\work\nsudolg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1128sc config "SecurityHealthService" start= disabled C:\Windows\System32\sc.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1168reg query "HKLM\System\CurrentControlSet\Services\WdNisSvc" C:\Windows\System32\reg.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
75 382
Read events
75 107
Write events
72
Delete events
203

Modification events

(PID) Process:(1696) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1696) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1696) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1696) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:1c5dd6f0d2.exe
Value:
C:\Users\admin\AppData\Local\Temp\10212050101\1c5dd6f0d2.exe
(PID) Process:(7508) nircmd.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\System32\cmd.exe.FriendlyAppName
Value:
Windows Command Processor
(PID) Process:(7508) nircmd.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\System32\cmd.exe.ApplicationCompany
Value:
Microsoft Corporation
(PID) Process:(7816) reg.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize
Operation:writeName:AppsUseLightTheme
Value:
0
(PID) Process:(1696) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:3f17e198c5.exe
Value:
C:\Users\admin\AppData\Local\Temp\10212060101\3f17e198c5.exe
(PID) Process:(8084) reg.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize
Operation:writeName:AppsUseLightTheme
Value:
0
(PID) Process:(4192) reg.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize
Operation:writeName:AppsUseLightTheme
Value:
0
Executable files
167
Suspicious files
30
Text files
38
Unknown types
0

Dropped files

PID
Process
Filename
Type
6132WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1c5dd6f0d2.exe_211958132b5ba644296a4d676e45fc2d471cfa6_5e1a1639_8bfb14e3-64ff-4765-90d1-39df27fa9a04\Report.wer
MD5:
SHA256:
6132WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\1c5dd6f0d2.exe.1764.dmp
MD5:
SHA256:
7748WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1c5dd6f0d2.exe_211958132b5ba644296a4d676e45fc2d471cfa6_5e1a1639_4d49caae-e453-4d58-b30e-349b7ef3b28b\Report.wer
MD5:
SHA256:
7748WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\1c5dd6f0d2.exe.3272.dmp
MD5:
SHA256:
6820random.exeC:\Windows\Tasks\ramez.jobbinary
MD5:E77248F4B582C32BA2BA0BFAA6139751
SHA256:08FF3EE89F5E66AD5BB6962DD4881CA64DAD2C25E8FAC0848C0073005BDC5863
6132WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER153A.tmp.dmpbinary
MD5:CB70E53BB3BA57867C989A36FB3D835D
SHA256:F9474FDBB370E95157ECB857347B19DF95FA4F4EC0B3D60FBF2BE0E5DD01D1DE
6132WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER1655.tmp.WERInternalMetadata.xmlxml
MD5:1BDD7453E04051B078F8E9CF4EFA3105
SHA256:4320CAD25984E7CDFCB5E54F1E4EC615717C59D2C7DBB1C98E7D0E6FD8EB3B90
1696ramez.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\random[1].exeexecutable
MD5:B3FD94F56D5D25ACF6D632E0B2EDCC82
SHA256:1DC2DBB369DCBC06B4CAD0D5AD233D8776FB1AB6764957A87AC56E1E21D0CC57
1696ramez.exeC:\Users\admin\AppData\Local\Temp\10212060101\3f17e198c5.exeexecutable
MD5:DB6C7978D0A68AEF793727C95E0F9DB1
SHA256:7ACBE78BDCCF5B566CF20A119CE1A1990E168C28E9E66A39F8DFC4D4646FEFFE
71763f17e198c5.exeC:\Users\admin\AppData\Local\Temp\L5saGkO.battext
MD5:350D172630B12F10564C78EEF37E3F95
SHA256:73BC1BD40DCB68AC6DBF25FFB5E0B708F43FD4CA8A17D08647EEB89641B37062
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
52
TCP/UDP connections
70
DNS requests
25
Threats
67

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6632
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
1696
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
unknown
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
1696
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
unknown
1696
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
unknown
1696
ramez.exe
GET
200
185.156.72.2:80
http://185.156.72.2/files/5561582465/GQoCrEB.exe
unknown
malicious
1696
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
unknown
8316
control.exe
HEAD
404
23.95.245.178:80
http://23.95.245.178/lab1/bn7t4w
unknown
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
4
System
192.168.100.255:138
whitelisted
5796
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1696
ramez.exe
185.156.72.96:80
Tov Vaiz Partner
RU
unknown
6544
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.32
  • 23.216.77.27
  • 23.216.77.35
  • 23.216.77.25
  • 23.216.77.41
  • 23.216.77.39
  • 23.216.77.31
  • 23.216.77.24
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
login.live.com
  • 20.190.159.0
  • 40.126.31.2
  • 40.126.31.69
  • 20.190.159.128
  • 40.126.31.131
  • 20.190.159.129
  • 40.126.31.1
  • 40.126.31.129
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
greengwjz.top
  • 104.21.80.1
  • 104.21.16.1
  • 104.21.64.1
  • 104.21.48.1
  • 104.21.112.1
  • 104.21.32.1
  • 104.21.96.1
unknown
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

PID
Process
Class
Message
1696
ramez.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 35
1696
ramez.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
1696
ramez.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
1696
ramez.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
1696
ramez.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
1696
ramez.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 35
1696
ramez.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
1696
ramez.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
1696
ramez.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
No debug info