File name:

7af72d60902f6d9bd4ddb565cd4b0946.exe

Full analysis: https://app.any.run/tasks/0e0997a1-c5e6-4bbb-a98e-167d427b3772
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 05:35:11
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
amadey
botnet
stealer
opendir
loader
rdp
themida
auto
payload
generic
gcleaner
lumma
rhadamanthys
evasion
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

7AF72D60902F6D9BD4DDB565CD4B0946

SHA1:

9A81B3D5D58E5F5AD4719DCF4FF3F5C59AEBBEBC

SHA256:

5E597A1B3B27FC614676BC331E7134BDA14805AD4458D8649195AAB33A102AE5

SSDEEP:

98304:jw4Hk7p7NJUEWtf8LokyGjZi4VpcbL/vgJfiDmdBtqeJdrt7JpgtTF0FsM4QS5zs:U1E

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AMADEY mutex has been found

      • 7af72d60902f6d9bd4ddb565cd4b0946.exe (PID: 4300)
      • Temp4PBIA6XYBAYJZMTAPHZ4H6PRQDGVUHPW.EXE (PID: 8024)
      • 483d2fa8a0d53818306efeb32d3.exe (PID: 7664)
      • rapes.exe (PID: 3180)

    • AMADEY has been detected (SURICATA)

      • rapes.exe (PID: 5576)

    • Connects to the CnC server

      • rapes.exe (PID: 5576)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 7560)
      • cmd.exe (PID: 7936)
      • 01.exe (PID: 7576)
      • download_807fb6fd5024da68.exe (PID: 7480)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 7728)
      • powershell.exe (PID: 7312)

    • AMADEY has been found (auto)

      • rapes.exe (PID: 5576)

    • Request from PowerShell that ran from MSHTA.EXE

      • powershell.exe (PID: 7728)
      • powershell.exe (PID: 7312)

    • Script downloads file (POWERSHELL)

      • powershell.exe (PID: 7728)
      • powershell.exe (PID: 7312)

    • AMADEY has been detected (YARA)

      • rapes.exe (PID: 5576)

    • Changes the autorun value in the registry

      • rapes.exe (PID: 5576)
      • svchost.exe (PID: 7984)

    • Executing a file with an untrusted certificate

      • iqvtNlb.exe (PID: 1912)

    • GENERIC has been found (auto)

      • 04c7ad2842.exe (PID: 7800)
      • rapes.exe (PID: 5576)
      • svchost015.exe (PID: 7808)
      • svchost015.exe (PID: 5116)

    • GCLEANER has been detected (SURICATA)

      • svchost015.exe (PID: 7808)
      • svchost015.exe (PID: 5116)

    • LUMMA mutex has been found

      • MSBuild.exe (PID: 8152)
      • MSBuild.exe (PID: 7292)
      • MSBuild.exe (PID: 7516)

    • Steals credentials from Web Browsers

      • MSBuild.exe (PID: 8152)
      • MSBuild.exe (PID: 7292)
      • MSBuild.exe (PID: 7516)

    • Actions looks like stealing of personal data

      • MSBuild.exe (PID: 8152)
      • MSBuild.exe (PID: 7292)
      • MSBuild.exe (PID: 7516)

    • Adds path to the Windows Defender exclusion list

      • mmc.exe (PID: 7312)

    • Changes Windows Defender settings

      • mmc.exe (PID: 7312)

  • SUSPICIOUS

    • Reads the BIOS version

      • 7af72d60902f6d9bd4ddb565cd4b0946.exe (PID: 4300)
      • Temp4PBIA6XYBAYJZMTAPHZ4H6PRQDGVUHPW.EXE (PID: 8024)
      • 04c7ad2842.exe (PID: 7800)
      • 483d2fa8a0d53818306efeb32d3.exe (PID: 7664)
      • 549f352d3b.exe (PID: 7640)
      • rapes.exe (PID: 3180)

    • Executable content was dropped or overwritten

      • 7af72d60902f6d9bd4ddb565cd4b0946.exe (PID: 4300)
      • powershell.exe (PID: 7728)
      • rapes.exe (PID: 5576)
      • powershell.exe (PID: 7312)
      • 04c7ad2842.exe (PID: 7800)
      • svchost015.exe (PID: 7808)
      • svchost.exe (PID: 7984)
      • mmc.exe (PID: 7312)
      • 01.exe (PID: 7576)
      • busdrv.exe (PID: 1180)
      • download_807fb6fd5024da68.exe (PID: 7480)
      • svchost015.exe (PID: 5116)

    • Reads security settings of Internet Explorer

      • 7af72d60902f6d9bd4ddb565cd4b0946.exe (PID: 4300)
      • rapes.exe (PID: 5576)
      • svchost015.exe (PID: 7808)
      • svchost015.exe (PID: 5116)

    • Starts itself from another location

      • 7af72d60902f6d9bd4ddb565cd4b0946.exe (PID: 4300)

    • Contacting a server suspected of hosting an CnC

      • rapes.exe (PID: 5576)

    • Potential Corporate Privacy Violation

      • rapes.exe (PID: 5576)
      • powershell.exe (PID: 7728)
      • powershell.exe (PID: 7312)
      • svchost015.exe (PID: 7808)
      • svchost.exe (PID: 7984)
      • busdrv.exe (PID: 1180)
      • svchost015.exe (PID: 5116)

    • Connects to the server without a host name

      • rapes.exe (PID: 5576)
      • powershell.exe (PID: 7728)
      • powershell.exe (PID: 7312)
      • svchost015.exe (PID: 7808)
      • svchost015.exe (PID: 5116)
      • Rr9IH1lm2.exe (PID: 8056)
      • svchost.exe (PID: 7984)
      • mmc.exe (PID: 7312)

    • Starts CMD.EXE for commands execution

      • 4ae9cb1c69.exe (PID: 7540)
      • rapes.exe (PID: 5576)
      • cmd.exe (PID: 7936)
      • svchost.exe (PID: 7984)

    • Probably download files using WebClient

      • mshta.exe (PID: 7600)
      • mshta.exe (PID: 7252)

    • Manipulates environment variables

      • powershell.exe (PID: 7728)
      • powershell.exe (PID: 7312)

    • Found IP address in command line

      • powershell.exe (PID: 7728)
      • powershell.exe (PID: 7312)

    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 7600)
      • cmd.exe (PID: 2384)
      • cmd.exe (PID: 7472)
      • cmd.exe (PID: 7916)
      • mshta.exe (PID: 7252)
      • mmc.exe (PID: 7312)

    • Starts process via Powershell

      • powershell.exe (PID: 7728)
      • powershell.exe (PID: 7312)

    • There is functionality for enable RDP (YARA)

      • rapes.exe (PID: 5576)

    • Executing commands from ".cmd" file

      • rapes.exe (PID: 5576)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 7936)

    • Process requests binary or script from the Internet

      • powershell.exe (PID: 7728)
      • rapes.exe (PID: 5576)
      • powershell.exe (PID: 7312)
      • busdrv.exe (PID: 1180)

    • Application launched itself

      • cmd.exe (PID: 7936)

    • Probably obfuscated PowerShell command line is found

      • cmd.exe (PID: 2384)
      • cmd.exe (PID: 7472)
      • cmd.exe (PID: 7916)

    • Process drops legitimate windows executable

      • rapes.exe (PID: 5576)

    • Starts a Microsoft application from unusual location

      • xu5e1_003.exe (PID: 7244)

    • The process executes via Task Scheduler

      • rapes.exe (PID: 3180)
      • PLUGScheduler.exe (PID: 1092)

    • Searches for installed software

      • MSBuild.exe (PID: 8152)
      • MSBuild.exe (PID: 7292)
      • MSBuild.exe (PID: 7516)

    • Executing commands from a ".bat" file

      • svchost.exe (PID: 7984)

    • Script adds exclusion path to Windows Defender

      • mmc.exe (PID: 7312)

    • Drops a system driver (possible attempt to evade defenses)

      • mmc.exe (PID: 7312)

    • Creates or modifies Windows services

      • mmc.exe (PID: 7312)

    • Uses TASKKILL.EXE to kill process

      • 01.exe (PID: 7576)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • busdrv.exe (PID: 1180)
      • pcidrv.exe (PID: 4200)

    • Get information on the list of running processes

      • download_807fb6fd5024da68.exe (PID: 7480)

    • Connects to unusual port

      • pcidrv.exe (PID: 4200)

  • INFO

    • Checks supported languages

      • 7af72d60902f6d9bd4ddb565cd4b0946.exe (PID: 4300)
      • 4ae9cb1c69.exe (PID: 7540)
      • Temp4PBIA6XYBAYJZMTAPHZ4H6PRQDGVUHPW.EXE (PID: 8024)
      • 04c7ad2842.exe (PID: 7800)
      • rapes.exe (PID: 5576)
      • 483d2fa8a0d53818306efeb32d3.exe (PID: 7664)
      • 549f352d3b.exe (PID: 7640)
      • svchost015.exe (PID: 7808)
      • tK0oYx3.exe (PID: 8064)
      • MSBuild.exe (PID: 8152)
      • svchost015.exe (PID: 5116)
      • Rr9IH1lm2.exe (PID: 8056)
      • xu5e1_003.exe (PID: 7244)
      • RTH4oNP.exe (PID: 4040)
      • MSBuild.exe (PID: 7292)
      • rapes.exe (PID: 3180)
      • tzutil.exe (PID: 6032)
      • w32tm.exe (PID: 7492)
      • 01.exe (PID: 7576)
      • busdrv.exe (PID: 1180)
      • OkH8IPF.exe (PID: 7280)
      • download_807fb6fd5024da68.exe (PID: 7480)
      • pcidrv.exe (PID: 4200)
      • MSBuild.exe (PID: 7516)
      • PLUGScheduler.exe (PID: 1092)

    • Reads the computer name

      • 7af72d60902f6d9bd4ddb565cd4b0946.exe (PID: 4300)
      • 4ae9cb1c69.exe (PID: 7540)
      • 04c7ad2842.exe (PID: 7800)
      • 549f352d3b.exe (PID: 7640)
      • MSBuild.exe (PID: 8152)
      • svchost015.exe (PID: 7808)
      • svchost015.exe (PID: 5116)
      • Rr9IH1lm2.exe (PID: 8056)
      • xu5e1_003.exe (PID: 7244)
      • MSBuild.exe (PID: 7292)
      • tzutil.exe (PID: 6032)
      • w32tm.exe (PID: 7492)
      • busdrv.exe (PID: 1180)
      • MSBuild.exe (PID: 7516)
      • pcidrv.exe (PID: 4200)

    • Process checks computer location settings

      • 7af72d60902f6d9bd4ddb565cd4b0946.exe (PID: 4300)
      • rapes.exe (PID: 5576)

    • Create files in a temporary directory

      • 7af72d60902f6d9bd4ddb565cd4b0946.exe (PID: 4300)
      • rapes.exe (PID: 5576)
      • 4ae9cb1c69.exe (PID: 7540)
      • 04c7ad2842.exe (PID: 7800)
      • svchost.exe (PID: 7984)
      • w32tm.exe (PID: 7492)
      • svchost015.exe (PID: 7808)
      • busdrv.exe (PID: 1180)

    • Checks proxy server information

      • rapes.exe (PID: 5576)
      • powershell.exe (PID: 7728)
      • BackgroundTransferHost.exe (PID: 6108)
      • powershell.exe (PID: 7312)
      • svchost015.exe (PID: 7808)
      • svchost015.exe (PID: 5116)
      • busdrv.exe (PID: 1180)
      • pcidrv.exe (PID: 4200)

    • Reads mouse settings

      • 4ae9cb1c69.exe (PID: 7540)

    • Autorun file from Task Scheduler

      • cmd.exe (PID: 7560)
      • cmd.exe (PID: 7936)
      • 01.exe (PID: 7576)
      • download_807fb6fd5024da68.exe (PID: 7480)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 7600)
      • mshta.exe (PID: 7816)
      • mshta.exe (PID: 7252)

    • Manual execution by a user

      • mshta.exe (PID: 7816)
      • OpenWith.exe (PID: 4996)
      • busdrv.exe (PID: 1180)
      • pcidrv.exe (PID: 4200)

    • Themida protector has been detected

      • rapes.exe (PID: 5576)

    • Disables trace logs

      • powershell.exe (PID: 7728)
      • powershell.exe (PID: 7312)

    • The executable file from the user directory is run by the Powershell process

      • Temp4PBIA6XYBAYJZMTAPHZ4H6PRQDGVUHPW.EXE (PID: 8024)
      • 483d2fa8a0d53818306efeb32d3.exe (PID: 7664)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 8068)
      • BackgroundTransferHost.exe (PID: 6108)
      • BackgroundTransferHost.exe (PID: 7652)
      • BackgroundTransferHost.exe (PID: 3008)
      • BackgroundTransferHost.exe (PID: 8148)
      • svchost.exe (PID: 7984)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 6108)
      • rapes.exe (PID: 5576)
      • svchost015.exe (PID: 7808)
      • svchost015.exe (PID: 5116)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 6108)
      • MSBuild.exe (PID: 8152)
      • MSBuild.exe (PID: 7292)
      • MSBuild.exe (PID: 7516)
      • slui.exe (PID: 5728)

    • The sample compiled with english language support

      • 04c7ad2842.exe (PID: 7800)
      • rapes.exe (PID: 5576)
      • svchost.exe (PID: 7984)

    • Reads the machine GUID from the registry

      • svchost015.exe (PID: 7808)
      • svchost015.exe (PID: 5116)
      • w32tm.exe (PID: 7492)

    • Creates files in the program directory

      • xu5e1_003.exe (PID: 7244)
      • svchost.exe (PID: 7984)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7624)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7624)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:02:23 11:06:11+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 324096
InitializedDataSize: 115200
UninitializedDataSize: -
EntryPoint: 0x4bc000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
327
Monitored processes
80
Malicious processes
24
Suspicious processes
4

Behavior graph

Click at the process to see the details
start 7af72d60902f6d9bd4ddb565cd4b0946.exe #AMADEY rapes.exe sppextcomobj.exe no specs slui.exe 4ae9cb1c69.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs schtasks.exe no specs powershell.exe conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs timeout.exe no specs temp4pbia6xybayjzmtaphz4h6prqdgvuhpw.exe no specs backgroundtransferhost.exe no specs cmd.exe no specs powershell.exe no specs backgroundtransferhost.exe cmd.exe no specs powershell.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs #GENERIC 04c7ad2842.exe cmd.exe no specs powershell.exe no specs backgroundtransferhost.exe no specs schtasks.exe no specs mshta.exe no specs powershell.exe conhost.exe no specs openwith.exe no specs 483d2fa8a0d53818306efeb32d3.exe no specs 549f352d3b.exe no specs #GCLEANER svchost015.exe iqvtnlb.exe no specs #GCLEANER svchost015.exe tk0oyx3.exe no specs conhost.exe no specs msbuild.exe no specs #LUMMA msbuild.exe svchost.exe rr9ih1lm2.exe xu5e1_003.exe no specs svchost.exe rth4onp.exe no specs conhost.exe no specs #LUMMA msbuild.exe tzutil.exe no specs rapes.exe no specs cmd.exe no specs w32tm.exe conhost.exe no specs wuauclt.exe no specs wusa.exe mmc.exe powershell.exe no specs conhost.exe no specs 01.exe taskkill.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs busdrv.exe okh8ipf.exe no specs conhost.exe no specs #LUMMA msbuild.exe download_807fb6fd5024da68.exe tasklist.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs pcidrv.exe slui.exe no specs plugscheduler.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1092"C:\Program Files\RUXIM\PLUGscheduler.exe"C:\Program Files\RUXIM\PLUGScheduler.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Update LifeCycle Component Scheduler
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\plugscheduler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
1180"C:\Users\admin\Drivers\busdrv.exe" C:\Users\admin\Drivers\busdrv.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\drivers\busdrv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1328\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1328"tasklist"C:\Windows\System32\tasklist.exe—download_807fb6fd5024da68.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1348\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1912"C:\Users\admin\AppData\Local\Temp\10328510101\iqvtNlb.exe" C:\Users\admin\AppData\Local\Temp\10328510101\iqvtNlb.exe—rapes.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\10328510101\iqvtnlb.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2384C:\WINDOWS\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3008"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
3180"C:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exe"C:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\bb556cff4a\rapes.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
Total events
38 778
Read events
38 717
Write events
61
Delete events
0

Modification events

(PID) Process:(5576) rapes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5576) rapes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5576) rapes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7600) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7600) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7600) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5576) rapes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:4ae9cb1c69.exe
Value:
C:\Users\admin\AppData\Local\Temp\10328010101\4ae9cb1c69.exe
(PID) Process:(7728) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7728) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7728) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
38
Suspicious files
61
Text files
19
Unknown types
0

Dropped files

PID
Process
Filename
Type
6108BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\9f3f76b5-3034-4492-9d86-5546ddd575f5.down_data —
MD5:—
SHA256:—
5576rapes.exeC:\Users\admin\AppData\Local\Temp\10328010101\4ae9cb1c69.exeexecutable
MD5:12B5862A18C8D6C5AD42EAC8B8B25983
SHA256:F7A170F384FB2C2D8296C8D6047C31B832D4502F3AED7E0718CFA34A9459DB27
75404ae9cb1c69.exeC:\Users\admin\AppData\Local\Temp\smiBM3P37.htahtml
MD5:49FAB77A51F8710D2FD4CB44A27DBAC1
SHA256:8CBA0AE46080D68C046422C9A68EE2939814049BF8F2EDAF9E14235F1BD925B7
5576rapes.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\random[1].exeexecutable
MD5:12B5862A18C8D6C5AD42EAC8B8B25983
SHA256:F7A170F384FB2C2D8296C8D6047C31B832D4502F3AED7E0718CFA34A9459DB27
43007af72d60902f6d9bd4ddb565cd4b0946.exeC:\Windows\Tasks\rapes.jobbinary
MD5:1A7A521524263008A5410E7B7B2C0000
SHA256:762409B144EDD1E602E46C4915580701089EF2E8CC6C6C44F139447597BB2D7E
43007af72d60902f6d9bd4ddb565cd4b0946.exeC:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exeexecutable
MD5:7AF72D60902F6D9BD4DDB565CD4B0946
SHA256:5E597A1B3B27FC614676BC331E7134BDA14805AD4458D8649195AAB33A102AE5
4448powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ytu5hh33.twl.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7728powershell.exeC:\Users\admin\AppData\Local\Temp4PBIA6XYBAYJZMTAPHZ4H6PRQDGVUHPW.EXEexecutable
MD5:B828F5C23A7C962210EEDBE6CFE4BB45
SHA256:0C8AA4068BD3A2D60F309549EFEC0BF66227723FF876A69E7B39B1873C6A447F
4448powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_4m0qq040.hyd.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6108BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\9f3f76b5-3034-4492-9d86-5546ddd575f5.9202c688-d605-427c-af8b-64825fafc927.down_metabinary
MD5:6826134585B04540995670747CC20938
SHA256:EBB309D71DD12F5214B8549C6B9A3D1BD82805B450DEBD5284769B96288D9C92
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
148
TCP/UDP connections
104
DNS requests
32
Threats
97

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.20:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5576
rapes.exe
POST
200
176.113.115.6:80
http://176.113.115.6/Ni9kiput/index.php
unknown
—
—
malicious
5576
rapes.exe
POST
200
176.113.115.6:80
http://176.113.115.6/Ni9kiput/index.php
unknown
—
—
malicious
5576
rapes.exe
POST
200
176.113.115.6:80
http://176.113.115.6/Ni9kiput/index.php
unknown
—
—
malicious
5576
rapes.exe
GET
200
176.113.115.7:80
http://176.113.115.7/test/exe/random.exe
unknown
—
—
malicious
4736
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5576
rapes.exe
GET
200
176.113.115.7:80
http://176.113.115.7/files/unique2/random.exe
unknown
—
—
malicious
5576
rapes.exe
GET
200
176.113.115.7:80
http://176.113.115.7/test/am_no.bat
unknown
—
—
malicious
7728
powershell.exe
GET
200
176.113.115.7:80
http://176.113.115.7/mine/random.exe
unknown
—
—
malicious
5576
rapes.exe
POST
200
176.113.115.6:80
http://176.113.115.6/Ni9kiput/index.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.20:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.20:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
40.126.32.72:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.212.174
whitelisted
crl.microsoft.com
  • 23.216.77.20
  • 23.216.77.6
  • 23.216.77.42
whitelisted
client.wns.windows.com
  • 40.113.110.67
  • 40.113.103.199
whitelisted
login.live.com
  • 40.126.32.72
  • 40.126.32.136
  • 20.190.160.130
  • 20.190.160.20
  • 20.190.160.2
  • 40.126.32.68
  • 40.126.32.138
  • 20.190.160.17
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
www.bing.com
  • 2.23.227.215
  • 2.23.227.208
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
www.microsoft.com
  • 2.23.181.156
whitelisted

Threats

PID
Process
Class
Message
5576
rapes.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 29
5576
rapes.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
5576
rapes.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
5576
rapes.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
5576
rapes.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 29
5576
rapes.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
5576
rapes.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
5576
rapes.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
7728
powershell.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7728
powershell.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
7af72d60902f6d9bd4ddb565cd4b0946.exe