File name:

SecuriteInfo.com.Win32.Malware-gen.24050.20684

Full analysis: https://app.any.run/tasks/4ce206a6-d732-4c18-936a-f8a85aa2409f
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: May 19, 2025, 04:04:03
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
generated-doc
rhadamanthys
stealer
purecrypter
amadey
botnet
miner
rat
asyncrat
remote
delphi
shellcode
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Haresfoot, Author: Royal Sago, Keywords: Installer, Comments: This installer database contains the logic and data required to install Haresfoot., Template: Intel;1033, Revision Number: {71B4DCC1-8B49-48FD-91C3-056E1BABEE03}, Create Time/Date: Tue May 13 07:23:28 2025, Last Saved Time/Date: Tue May 13 07:23:28 2025, Number of Pages: 500, Number of Words: 10, Name of Creating Application: WiX Toolset (4.0.0.0), Security: 2
MD5:

E84DB67F8F30CD4BA03A0C9E6952628B

SHA1:

C24C01CC464DB661EC5F5910411B7049793FC1E6

SHA256:

5CA4552216DDC3B276E3CF2684CC5041B31931181A54D5CB62113BF6AABA1575

SSDEEP:

98304:t7KltuUF/1KdhUj+Rt2URMTUOyV59Avpj31mvrBvSSRkYhYYzjOMrdBg5HJKxqi3:tu3aAt6twV7WIps

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Executing a file with an untrusted certificate

      • SF32.exe (PID: 1348)
      • SF32.exe (PID: 6576)
      • SF32.exe (PID: 4188)
      • ISBEW64.exe (PID: 7488)
      • ISBEW64.exe (PID: 7528)
      • ISBEW64.exe (PID: 7564)
      • ISBEW64.exe (PID: 7604)
      • ISBEW64.exe (PID: 7644)
      • ISBEW64.exe (PID: 7840)
      • Hashrate_Vorte.exe (PID: 7876)
      • Hashrate_Vorte.exe (PID: 7984)
      • Hashrate_Vorte.exe (PID: 7948)
      • Hashrate_Vorte.exe (PID: 8020)
      • Hashrate_Vorte.exe (PID: 5744)
      • ByteS.exe (PID: 7192)
      • Hashrate_Vorte.exe (PID: 7552)
    • Known privilege escalation attack

      • dllhost.exe (PID: 2092)
    • RHADAMANTHYS has been detected (YARA)

      • svchost.exe (PID: 4220)
    • RHADAMANTHYS has been detected (SURICATA)

      • svchost.exe (PID: 4220)
    • PURECRYPTER has been detected (SURICATA)

      • ByteS.exe (PID: 7192)
    • AMADEY has been detected (SURICATA)

      • ThrIndex.exe (PID: 6192)
    • Run PowerShell with an invisible window

      • powershell.exe (PID: 7796)
    • Bypass execution policy to execute commands

      • powershell.exe (PID: 7796)
    • Connects to the CnC server

      • ThrIndex.exe (PID: 6192)
      • AddInProcess.exe (PID: 7300)
    • MINER has been detected (SURICATA)

      • AddInProcess.exe (PID: 7300)
    • ASYNCRAT has been detected (SURICATA)

      • SScheduler.exe (PID: 7288)
  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 6964)
    • Connects to unusual port

      • svchost.exe (PID: 1764)
      • svchost.exe (PID: 4220)
      • ByteS.exe (PID: 7192)
      • SScheduler.exe (PID: 7288)
      • AddInProcess.exe (PID: 7300)
    • Starts CMD.EXE for commands execution

      • SF32.exe (PID: 1348)
      • SF32.exe (PID: 6576)
      • Hashrate_Vorte.exe (PID: 8020)
      • Hashrate_Vorte.exe (PID: 7948)
      • Hashrate_Vorte.exe (PID: 7552)
    • Executable content was dropped or overwritten

      • SF32.exe (PID: 1348)
      • SF32.exe (PID: 4188)
      • svchost.exe (PID: 4220)
      • Z163H)I$.exe (PID: 7448)
      • Z163H)I$.exe (PID: 7428)
      • Hashrate_Vorte.exe (PID: 7876)
      • Hashrate_Vorte.exe (PID: 7984)
      • Hashrate_Vorte.exe (PID: 7948)
      • Hashrate_Vorte.exe (PID: 8020)
      • Hashrate_Vorte.exe (PID: 5744)
      • Hashrate_Vorte.exe (PID: 7552)
    • Starts itself from another location

      • SF32.exe (PID: 4188)
      • Z163H)I$.exe (PID: 7428)
      • Hashrate_Vorte.exe (PID: 7876)
      • Hashrate_Vorte.exe (PID: 7984)
      • Hashrate_Vorte.exe (PID: 5744)
    • Multiple wallet extension IDs have been found

      • svchost.exe (PID: 4220)
    • The process drops C-runtime libraries

      • Z163H)I$.exe (PID: 7448)
      • Hashrate_Vorte.exe (PID: 7876)
      • msiexec.exe (PID: 6156)
      • Hashrate_Vorte.exe (PID: 7984)
      • Hashrate_Vorte.exe (PID: 5744)
    • Process drops legitimate windows executable

      • Z163H)I$.exe (PID: 7448)
      • Hashrate_Vorte.exe (PID: 7876)
      • msiexec.exe (PID: 6156)
      • Hashrate_Vorte.exe (PID: 7984)
      • Hashrate_Vorte.exe (PID: 5744)
    • Starts a Microsoft application from unusual location

      • Hashrate_Vorte.exe (PID: 7876)
    • Contacting a server suspected of hosting an CnC

      • ByteS.exe (PID: 7192)
      • ThrIndex.exe (PID: 6192)
      • SScheduler.exe (PID: 7288)
    • The process executes via Task Scheduler

      • powershell.exe (PID: 7796)
    • Connects to the server without a host name

      • ThrIndex.exe (PID: 6192)
    • Potential Corporate Privacy Violation

      • AddInProcess.exe (PID: 7300)
  • INFO

    • The sample compiled with english language support

      • msiexec.exe (PID: 1168)
      • SF32.exe (PID: 1348)
      • SF32.exe (PID: 4188)
      • msiexec.exe (PID: 6156)
      • svchost.exe (PID: 4220)
      • Z163H)I$.exe (PID: 7428)
      • Z163H)I$.exe (PID: 7448)
      • Hashrate_Vorte.exe (PID: 7876)
      • Hashrate_Vorte.exe (PID: 7984)
      • Hashrate_Vorte.exe (PID: 7948)
      • Hashrate_Vorte.exe (PID: 5744)
      • Hashrate_Vorte.exe (PID: 7552)
    • Checks supported languages

      • msiexec.exe (PID: 6156)
    • Manages system restore points

      • SrTasks.exe (PID: 720)
      • SrTasks.exe (PID: 7740)
      • SrTasks.exe (PID: 6300)
    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6156)
    • Reads the computer name

      • msiexec.exe (PID: 6156)
    • Compiled with Borland Delphi (YARA)

      • SF32.exe (PID: 1348)
    • Application launched itself

      • chrome.exe (PID: 5384)
      • msedge.exe (PID: 3676)
      • msedge.exe (PID: 2244)
      • msedge.exe (PID: 4108)
    • Manual execution by a user

      • msedge.exe (PID: 4108)
      • AddInProcess.exe (PID: 7300)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: Haresfoot
Author: Royal Sago
Keywords: Installer
Comments: This installer database contains the logic and data required to install Haresfoot.
Template: Intel;1033
RevisionNumber: {71B4DCC1-8B49-48FD-91C3-056E1BABEE03}
CreateDate: 2025:05:13 07:23:28
ModifyDate: 2025:05:13 07:23:28
Pages: 500
Words: 10
Software: WiX Toolset (4.0.0.0)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
252
Monitored processes
104
Malicious processes
17
Suspicious processes
8

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe vssvc.exe no specs sppextcomobj.exe no specs slui.exe srtasks.exe no specs conhost.exe no specs sf32.exe sf32.exe no specs cmd.exe no specs conhost.exe no specs CMSTPLUA sf32.exe adaptivedisp.exe no specs slui.exe svchost.exe #RHADAMANTHYS svchost.exe cmd.exe no specs conhost.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs setup_wm.exe no specs msiexec.exe no specs msiexec.exe no specs z163h)i$.exe z163h)i$.exe isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs srtasks.exe no specs conhost.exe no specs isbew64.exe no specs hashrate_vorte.exe hashrate_vorte.exe hashrate_vorte.exe hashrate_vorte.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs #PURECRYPTER bytes.exe #AMADEY thrindex.exe srtasks.exe no specs conhost.exe no specs hashrate_vorte.exe hashrate_vorte.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs #ASYNCRAT sscheduler.exe powershell.exe no specs conhost.exe no specs #MINER addinprocess.exe conhost.exe no specs msedge.exe no specs cmd.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
232"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4976 --field-trial-handle=2404,i,14335794611892101356,2445768415356629251,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\identity_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
616"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4164 --field-trial-handle=2404,i,14335794611892101356,2445768415356629251,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
684"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4956 --field-trial-handle=2404,i,14335794611892101356,2445768415356629251,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
720C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exemsiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
856"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3080 --field-trial-handle=1920,i,1447697363265181934,13434643541297374496,262144 --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
856"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4152 --field-trial-handle=2404,i,14335794611892101356,2445768415356629251,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
976"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1912 --field-trial-handle=1920,i,1447697363265181934,13434643541297374496,262144 --variations-seed-version /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1012"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3048 --field-trial-handle=1920,i,1447697363265181934,13434643541297374496,262144 --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1116"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\admin\AppData\Local\Temp\chr826.tmp /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\admin\AppData\Local\Temp\chr826.tmp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=122.0.6261.70 --initial-client-data=0x214,0x218,0x21c,0x1f0,0x220,0x7ffc8947dc40,0x7ffc8947dc4c,0x7ffc8947dc58C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1168"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Malware-gen.24050.20684.msiC:\Windows\System32\msiexec.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
30 100
Read events
29 256
Write events
786
Delete events
58

Modification events

(PID) Process:(6964) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000005E353B1473C8DB01341B0000381A0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6964) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000005E353B1473C8DB01341B000068080000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6964) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000005E353B1473C8DB01341B000010090000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6964) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000005E353B1473C8DB01341B0000EC080000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6964) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:delete keyName:(default)
Value:
(PID) Process:(6964) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:writeName:Element
Value:
0000000000000000000000000000000006000000000000004800000000000000715E5C2FA985EB1190A89A9B763584210000000000000000745E5C2FA985EB1190A89A9B7635842100000000000000000000000000000000
(PID) Process:(6964) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\12000002
Operation:delete keyName:(default)
Value:
(PID) Process:(6964) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\12000002
Operation:writeName:Element
Value:
\EFI\Microsoft\Boot\bootmgfw.efi
(PID) Process:(6964) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\11000001
Operation:delete keyName:(default)
Value:
(PID) Process:(6964) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Leave)
Value:
4800000000000000E35E421473C8DB01341B0000EC080000E80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
64
Suspicious files
364
Text files
105
Unknown types
0

Dropped files

PID
Process
Filename
Type
6156msiexec.exeC:\System Volume Information\SPP\metadata-2
MD5:
SHA256:
6156msiexec.exeC:\Windows\Installer\11028d.msi
MD5:
SHA256:
6156msiexec.exeC:\Windows\Installer\11028f.msi
MD5:
SHA256:
6156msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{d4552304-db25-4977-835c-2f1eb19bcee9}_OnDiskSnapshotPropbinary
MD5:996FFD1B2F480CACB8746419871AFAAE
SHA256:8765C75DCE7CB9736A8F85D06F77EB8904467807A208764E10D0C77A4D4958FC
6156msiexec.exeC:\Windows\Temp\~DF6C7A9AFBEFF85567.TMPbinary
MD5:1A4C22AD3C0571CB6183DC950530FE92
SHA256:C490A5D2BC5AB6534B6F04AAD5DA954EA69A6B9E48AC27E9DAEED0BA90D33DA4
6156msiexec.exeC:\Windows\Installer\MSI368.tmpbinary
MD5:77EBFE8BC26E4386CBF1F449FCF1990A
SHA256:21D1D969C6936E0F73DD2739F78F12553C95DA7712EE1E197CAAB626CBE3F8F5
6156msiexec.exeC:\Users\admin\AppData\Local\Diphtheria\SF32.exeexecutable
MD5:1F166F5C76EB155D44DD1BF160F37A6A
SHA256:2D13424B09BA004135A26CCD60B64CDD6917D80CE43070CBC114569EAE608588
6156msiexec.exeC:\Windows\Temp\~DF683F936E6ED34075.TMPbinary
MD5:1A4C22AD3C0571CB6183DC950530FE92
SHA256:C490A5D2BC5AB6534B6F04AAD5DA954EA69A6B9E48AC27E9DAEED0BA90D33DA4
6156msiexec.exeC:\Config.Msi\11028e.rbsbinary
MD5:B7B7BA2F73F7CE232E6AAD6B81468C0E
SHA256:97B0D079E3563E223F82C20AB2E8F32B91C16BF01D0D14ABE1DA842D3257FF24
6156msiexec.exeC:\Users\admin\AppData\Local\Diphtheria\alcove.flacbinary
MD5:09AF3A8CC16E697FF2271838BC47991D
SHA256:C90717F7CBFAE38F23AA8D366676AB95AF23771815789D24DB03A0F0D7271788
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
39
TCP/UDP connections
98
DNS requests
75
Threats
18

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
8188
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/3aeadfbf-fadd-43ac-a5d9-c143db5f63d8?P1=1747702798&P2=404&P3=2&P4=MlboVeoBl68P%2fZtr6eRC9KSWnWj%2fWmDAHVkub%2f7vs5AQkbI7Tf4pJKtoWhhgztiHwrMbCh%2bqwscyPlU0djxfxw%3d%3d
unknown
whitelisted
3240
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
8188
svchost.exe
HEAD
200
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/3aeadfbf-fadd-43ac-a5d9-c143db5f63d8?P1=1747702798&P2=404&P3=2&P4=MlboVeoBl68P%2fZtr6eRC9KSWnWj%2fWmDAHVkub%2f7vs5AQkbI7Tf4pJKtoWhhgztiHwrMbCh%2bqwscyPlU0djxfxw%3d%3d
unknown
whitelisted
8188
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/3aeadfbf-fadd-43ac-a5d9-c143db5f63d8?P1=1747702798&P2=404&P3=2&P4=MlboVeoBl68P%2fZtr6eRC9KSWnWj%2fWmDAHVkub%2f7vs5AQkbI7Tf4pJKtoWhhgztiHwrMbCh%2bqwscyPlU0djxfxw%3d%3d
unknown
whitelisted
8188
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/3aeadfbf-fadd-43ac-a5d9-c143db5f63d8?P1=1747702798&P2=404&P3=2&P4=MlboVeoBl68P%2fZtr6eRC9KSWnWj%2fWmDAHVkub%2f7vs5AQkbI7Tf4pJKtoWhhgztiHwrMbCh%2bqwscyPlU0djxfxw%3d%3d
unknown
whitelisted
8188
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/3aeadfbf-fadd-43ac-a5d9-c143db5f63d8?P1=1747702798&P2=404&P3=2&P4=MlboVeoBl68P%2fZtr6eRC9KSWnWj%2fWmDAHVkub%2f7vs5AQkbI7Tf4pJKtoWhhgztiHwrMbCh%2bqwscyPlU0djxfxw%3d%3d
unknown
whitelisted
8188
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/3aeadfbf-fadd-43ac-a5d9-c143db5f63d8?P1=1747702798&P2=404&P3=2&P4=MlboVeoBl68P%2fZtr6eRC9KSWnWj%2fWmDAHVkub%2f7vs5AQkbI7Tf4pJKtoWhhgztiHwrMbCh%2bqwscyPlU0djxfxw%3d%3d
unknown
whitelisted
8188
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/3aeadfbf-fadd-43ac-a5d9-c143db5f63d8?P1=1747702798&P2=404&P3=2&P4=MlboVeoBl68P%2fZtr6eRC9KSWnWj%2fWmDAHVkub%2f7vs5AQkbI7Tf4pJKtoWhhgztiHwrMbCh%2bqwscyPlU0djxfxw%3d%3d
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
google.com
  • 142.250.186.46
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.31.71
  • 20.190.159.128
  • 40.126.31.73
  • 20.190.159.75
  • 40.126.31.69
  • 20.190.159.68
  • 20.190.159.23
  • 40.126.31.131
  • 20.190.159.73
  • 20.190.159.0
  • 20.190.159.2
  • 40.126.31.1
  • 20.190.159.129
  • 40.126.31.129
  • 20.190.159.130
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
go.microsoft.com
  • 184.30.18.9
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

PID
Process
Class
Message
1764
svchost.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 19
4220
svchost.exe
A Network Trojan was detected
STEALER [ANY.RUN] Rhadamanthys SSL Certificate and JA3s
4220
svchost.exe
A Network Trojan was detected
STEALER [ANY.RUN] Rhadamanthys SSL Certificate and JA3s
7192
ByteS.exe
Malware Command and Control Activity Detected
LOADER [ANY.RUN] PureLoader Download Attempt (LOAD)
6192
ThrIndex.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 41
6192
ThrIndex.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
6192
ThrIndex.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
7300
AddInProcess.exe
Potential Corporate Privacy Violation
ET INFO Cryptocurrency Miner Checkin
7288
SScheduler.exe
Domain Observed Used for C2 Detected
ET MALWARE Generic AsyncRAT/zgRAT Style SSL Cert
7288
SScheduler.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] AsyncRAT Successful Connection
No debug info