File name:

SecuriteInfo.com.Win32.Malware-gen.24050.20684

Full analysis: https://app.any.run/tasks/6ee52b55-ee2f-4be1-931f-c6ce6d203eb4
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: May 19, 2025, 03:56:28
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
generated-doc
rhadamanthys
stealer
purecrypter
amadey
botnet
miner
rat
asyncrat
remote
delphi
amsi-bypass
shellcode
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Haresfoot, Author: Royal Sago, Keywords: Installer, Comments: This installer database contains the logic and data required to install Haresfoot., Template: Intel;1033, Revision Number: {71B4DCC1-8B49-48FD-91C3-056E1BABEE03}, Create Time/Date: Tue May 13 07:23:28 2025, Last Saved Time/Date: Tue May 13 07:23:28 2025, Number of Pages: 500, Number of Words: 10, Name of Creating Application: WiX Toolset (4.0.0.0), Security: 2
MD5:

E84DB67F8F30CD4BA03A0C9E6952628B

SHA1:

C24C01CC464DB661EC5F5910411B7049793FC1E6

SHA256:

5CA4552216DDC3B276E3CF2684CC5041B31931181A54D5CB62113BF6AABA1575

SSDEEP:

98304:t7KltuUF/1KdhUj+Rt2URMTUOyV59Avpj31mvrBvSSRkYhYYzjOMrdBg5HJKxqi3:tu3aAt6twV7WIps

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Executing a file with an untrusted certificate

      • SF32.exe (PID: 5408)
      • SF32.exe (PID: 5548)
      • SF32.exe (PID: 780)
      • ISBEW64.exe (PID: 2984)
      • ISBEW64.exe (PID: 5400)
      • ISBEW64.exe (PID: 8144)
      • ISBEW64.exe (PID: 2852)
      • ISBEW64.exe (PID: 6032)
      • ISBEW64.exe (PID: 7968)
      • Hashrate_Vorte.exe (PID: 7208)
      • Hashrate_Vorte.exe (PID: 720)
      • Hashrate_Vorte.exe (PID: 4892)
      • Hashrate_Vorte.exe (PID: 3888)
      • ByteS.exe (PID: 7148)
      • Hashrate_Vorte.exe (PID: 8136)
      • Hashrate_Vorte.exe (PID: 668)
    • Known privilege escalation attack

      • dllhost.exe (PID: 7544)
    • RHADAMANTHYS has been detected (YARA)

      • svchost.exe (PID: 8060)
    • RHADAMANTHYS has been detected (SURICATA)

      • svchost.exe (PID: 8060)
    • PURECRYPTER has been detected (SURICATA)

      • ByteS.exe (PID: 7148)
    • Run PowerShell with an invisible window

      • powershell.exe (PID: 7932)
    • Bypass execution policy to execute commands

      • powershell.exe (PID: 7932)
    • AMADEY has been detected (SURICATA)

      • ThrIndex.exe (PID: 7896)
    • Connects to the CnC server

      • ThrIndex.exe (PID: 7896)
      • AddInProcess.exe (PID: 4988)
    • MINER has been detected (SURICATA)

      • AddInProcess.exe (PID: 4988)
    • ASYNCRAT has been detected (SURICATA)

      • SScheduler.exe (PID: 6108)
  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 7448)
    • Executable content was dropped or overwritten

      • SF32.exe (PID: 5408)
      • SF32.exe (PID: 780)
      • svchost.exe (PID: 8060)
      • Of7~.exe (PID: 7192)
      • Of7~.exe (PID: 6072)
      • Hashrate_Vorte.exe (PID: 7208)
      • Hashrate_Vorte.exe (PID: 4892)
      • Hashrate_Vorte.exe (PID: 3888)
      • Hashrate_Vorte.exe (PID: 720)
      • Hashrate_Vorte.exe (PID: 8136)
      • Hashrate_Vorte.exe (PID: 668)
    • Starts itself from another location

      • SF32.exe (PID: 5408)
      • Of7~.exe (PID: 7192)
      • Hashrate_Vorte.exe (PID: 7208)
      • Hashrate_Vorte.exe (PID: 4892)
      • Hashrate_Vorte.exe (PID: 8136)
    • Starts CMD.EXE for commands execution

      • SF32.exe (PID: 5548)
      • SF32.exe (PID: 780)
      • Hashrate_Vorte.exe (PID: 720)
      • Hashrate_Vorte.exe (PID: 3888)
      • Hashrate_Vorte.exe (PID: 668)
    • Possibly patching Antimalware Scan Interface function (YARA)

      • AdaptiveDisp.exe (PID: 7896)
    • There is functionality for taking screenshot (YARA)

      • AdaptiveDisp.exe (PID: 7896)
    • Connects to unusual port

      • svchost.exe (PID: 8060)
      • svchost.exe (PID: 7976)
      • ByteS.exe (PID: 7148)
      • AddInProcess.exe (PID: 4988)
      • SScheduler.exe (PID: 6108)
    • Multiple wallet extension IDs have been found

      • svchost.exe (PID: 8060)
    • Process drops legitimate windows executable

      • Of7~.exe (PID: 6072)
      • msiexec.exe (PID: 7388)
      • Hashrate_Vorte.exe (PID: 7208)
      • Hashrate_Vorte.exe (PID: 4892)
      • Hashrate_Vorte.exe (PID: 8136)
    • The process drops C-runtime libraries

      • Of7~.exe (PID: 6072)
      • Hashrate_Vorte.exe (PID: 7208)
      • msiexec.exe (PID: 7388)
      • Hashrate_Vorte.exe (PID: 4892)
      • Hashrate_Vorte.exe (PID: 8136)
    • Starts a Microsoft application from unusual location

      • Hashrate_Vorte.exe (PID: 7208)
    • Contacting a server suspected of hosting an CnC

      • ByteS.exe (PID: 7148)
      • ThrIndex.exe (PID: 7896)
      • SScheduler.exe (PID: 6108)
    • The process executes via Task Scheduler

      • powershell.exe (PID: 7932)
    • Connects to the server without a host name

      • ThrIndex.exe (PID: 7896)
    • Potential Corporate Privacy Violation

      • AddInProcess.exe (PID: 4988)
  • INFO

    • Reads the computer name

      • msiexec.exe (PID: 7388)
    • Checks supported languages

      • msiexec.exe (PID: 7388)
    • The sample compiled with english language support

      • msiexec.exe (PID: 7312)
      • msiexec.exe (PID: 7388)
      • SF32.exe (PID: 5408)
      • SF32.exe (PID: 780)
      • svchost.exe (PID: 8060)
      • Of7~.exe (PID: 7192)
      • Of7~.exe (PID: 6072)
      • Hashrate_Vorte.exe (PID: 7208)
      • Hashrate_Vorte.exe (PID: 4892)
      • Hashrate_Vorte.exe (PID: 720)
      • Hashrate_Vorte.exe (PID: 8136)
      • Hashrate_Vorte.exe (PID: 668)
    • Manages system restore points

      • SrTasks.exe (PID: 720)
      • SrTasks.exe (PID: 456)
      • SrTasks.exe (PID: 7788)
    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7388)
    • Compiled with Borland Delphi (YARA)

      • SF32.exe (PID: 780)
    • Application launched itself

      • chrome.exe (PID: 5384)
      • msedge.exe (PID: 7788)
      • msedge.exe (PID: 5744)
      • msedge.exe (PID: 7364)
    • Manual execution by a user

      • msedge.exe (PID: 7788)
      • AddInProcess.exe (PID: 4988)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: Haresfoot
Author: Royal Sago
Keywords: Installer
Comments: This installer database contains the logic and data required to install Haresfoot.
Template: Intel;1033
RevisionNumber: {71B4DCC1-8B49-48FD-91C3-056E1BABEE03}
CreateDate: 2025:05:13 07:23:28
ModifyDate: 2025:05:13 07:23:28
Pages: 500
Words: 10
Software: WiX Toolset (4.0.0.0)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
251
Monitored processes
106
Malicious processes
18
Suspicious processes
8

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe vssvc.exe no specs sppextcomobj.exe no specs slui.exe srtasks.exe no specs conhost.exe no specs sf32.exe sf32.exe no specs cmd.exe no specs conhost.exe no specs CMSTPLUA sf32.exe adaptivedisp.exe no specs slui.exe svchost.exe #RHADAMANTHYS svchost.exe cmd.exe no specs conhost.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs wmplayer.exe no specs msiexec.exe no specs msiexec.exe no specs of7~.exe of7~.exe isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs srtasks.exe no specs isbew64.exe no specs conhost.exe no specs hashrate_vorte.exe hashrate_vorte.exe hashrate_vorte.exe hashrate_vorte.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs #PURECRYPTER bytes.exe #AMADEY thrindex.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs #MINER addinprocess.exe srtasks.exe no specs conhost.exe no specs conhost.exe no specs hashrate_vorte.exe hashrate_vorte.exe msedge.exe no specs #ASYNCRAT sscheduler.exe msedge.exe no specs cmd.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
132\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exeAddInProcess.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
208"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1932 --field-trial-handle=1936,i,7426012092182709016,2149350859689924339,262144 --variations-seed-version /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
456C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:12C:\Windows\System32\SrTasks.exemsiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
616"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5464 --field-trial-handle=2260,i,252249367225011317,15916974228722587920,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
668C:\ProgramData\WBFSystem_test\Hashrate_Vorte.exeC:\ProgramData\WBFSystem_test\Hashrate_Vorte.exe
Hashrate_Vorte.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft OneNote
Exit code:
0
Version:
14.0.4763.1000
Modules
Images
c:\programdata\wbfsystem_test\hashrate_vorte.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
680C:\WINDOWS\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exeSF32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
720C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exemsiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
720"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x290,0x294,0x298,0x288,0x2a0,0x7ffc897e5fd8,0x7ffc897e5fe4,0x7ffc897e5ff0C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
720C:\ProgramData\uploadpluginid\Hashrate_Vorte.exeC:\ProgramData\uploadpluginid\Hashrate_Vorte.exe
Hashrate_Vorte.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft OneNote
Exit code:
0
Version:
14.0.4763.1000
Modules
Images
c:\programdata\uploadpluginid\hashrate_vorte.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
736"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5388 --field-trial-handle=2260,i,252249367225011317,15916974228722587920,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
30 088
Read events
29 242
Write events
788
Delete events
58

Modification events

(PID) Process:(7388) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
48000000000000007830F20372C8DB01DC1C0000081D0000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7388) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
48000000000000007830F20372C8DB01DC1C0000081D0000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7388) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
48000000000000005BB7390472C8DB01DC1C0000081D0000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7388) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
48000000000000005BB7390472C8DB01DC1C0000081D0000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7388) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
4800000000000000601B3C0472C8DB01DC1C0000081D0000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7388) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
480000000000000024E2400472C8DB01DC1C0000081D0000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7388) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(7388) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000ADFAE20472C8DB01DC1C0000081D0000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7388) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000695EE50472C8DB01DC1C0000A81D0000E803000001000000000000000000000044B3C1F6959A91488246422737B29E6400000000000000000000000000000000
(PID) Process:(7448) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
480000000000000081A1F30472C8DB01181D0000381D0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
67
Suspicious files
362
Text files
115
Unknown types
0

Dropped files

PID
Process
Filename
Type
7388msiexec.exeC:\System Volume Information\SPP\metadata-2
MD5:
SHA256:
7388msiexec.exeC:\Windows\Installer\10fd2e.msi
MD5:
SHA256:
7388msiexec.exeC:\Windows\Installer\10fd30.msi
MD5:
SHA256:
7388msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:D7E1A2F6C0695D5738DD6DA2DA88DAB4
SHA256:B9FA003C0E53F6FB05222014EC162D89D3062655BC603D6C7154D4E92C85608A
7388msiexec.exeC:\Windows\Installer\MSIFE09.tmpbinary
MD5:CC62C7EA522DB4BBC1E875E88592CDBA
SHA256:8D6FF039687DB80B397C651CC8FA77C5D7162C8FBE3E8D23704FBE3BCFF38312
7388msiexec.exeC:\Users\admin\AppData\Local\Diphtheria\sqlite3.dllexecutable
MD5:90ED24DFD07D01E63F0E78F2B3F5AB54
SHA256:38042B5C4CD510F35E5D619FC8DE11B687C5ED935FFA209426937F47CD84E7D4
7388msiexec.exeC:\Users\admin\AppData\Local\Diphtheria\alcove.flacbinary
MD5:09AF3A8CC16E697FF2271838BC47991D
SHA256:C90717F7CBFAE38F23AA8D366676AB95AF23771815789D24DB03A0F0D7271788
7388msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{f6c1b344-9a95-4891-8246-422737b29e64}_OnDiskSnapshotPropbinary
MD5:D7E1A2F6C0695D5738DD6DA2DA88DAB4
SHA256:B9FA003C0E53F6FB05222014EC162D89D3062655BC603D6C7154D4E92C85608A
7388msiexec.exeC:\Windows\Installer\inprogressinstallinfo.ipibinary
MD5:DA9EFCEE4943245BDDA330748C47E9D7
SHA256:9027200374B6304276132049B384877F6CB40C799370938034E18FEAE8F3E108
7388msiexec.exeC:\Windows\Temp\~DFB3B895B6CC9573A3.TMPbinary
MD5:DA9EFCEE4943245BDDA330748C47E9D7
SHA256:9027200374B6304276132049B384877F6CB40C799370938034E18FEAE8F3E108
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
41
TCP/UDP connections
92
DNS requests
72
Threats
19

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2800
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/68591036-2289-4858-9f7f-9149e89c8a08?P1=1747702796&P2=404&P3=2&P4=HDwEu4f1OV0%2fZiz1vKKh0JIDd6hqDzATO9iQQ3g6dgZlQTakPYePzYLHP50xFpA8n9%2bukQdyFZO4mEEsF9GXkw%3d%3d
unknown
whitelisted
2800
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/68591036-2289-4858-9f7f-9149e89c8a08?P1=1747702796&P2=404&P3=2&P4=HDwEu4f1OV0%2fZiz1vKKh0JIDd6hqDzATO9iQQ3g6dgZlQTakPYePzYLHP50xFpA8n9%2bukQdyFZO4mEEsF9GXkw%3d%3d
unknown
whitelisted
2800
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/68591036-2289-4858-9f7f-9149e89c8a08?P1=1747702796&P2=404&P3=2&P4=HDwEu4f1OV0%2fZiz1vKKh0JIDd6hqDzATO9iQQ3g6dgZlQTakPYePzYLHP50xFpA8n9%2bukQdyFZO4mEEsF9GXkw%3d%3d
unknown
whitelisted
2800
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/68591036-2289-4858-9f7f-9149e89c8a08?P1=1747702796&P2=404&P3=2&P4=HDwEu4f1OV0%2fZiz1vKKh0JIDd6hqDzATO9iQQ3g6dgZlQTakPYePzYLHP50xFpA8n9%2bukQdyFZO4mEEsF9GXkw%3d%3d
unknown
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
4696
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
4
System
192.168.100.255:138
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
google.com
  • 142.250.186.142
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.31.73
  • 20.190.159.75
  • 20.190.159.0
  • 20.190.159.129
  • 40.126.31.71
  • 40.126.31.1
  • 40.126.31.67
  • 20.190.159.71
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
go.microsoft.com
  • 2.19.106.8
  • 23.35.238.131
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

PID
Process
Class
Message
7976
svchost.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 19
8060
svchost.exe
A Network Trojan was detected
STEALER [ANY.RUN] Rhadamanthys SSL Certificate and JA3s
8060
svchost.exe
A Network Trojan was detected
STEALER [ANY.RUN] Rhadamanthys SSL Certificate and JA3s
8060
svchost.exe
A Network Trojan was detected
STEALER [ANY.RUN] Rhadamanthys SSL Certificate and JA3s
8060
svchost.exe
A Network Trojan was detected
STEALER [ANY.RUN] Rhadamanthys SSL Certificate and JA3s
7148
ByteS.exe
Malware Command and Control Activity Detected
LOADER [ANY.RUN] PureLoader Download Attempt (LOAD)
7896
ThrIndex.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 41
7896
ThrIndex.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
4988
AddInProcess.exe
Potential Corporate Privacy Violation
ET INFO Cryptocurrency Miner Checkin
7896
ThrIndex.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
No debug info