File name:

2025-05-17_e7d50fc380ca6151a37ef17e9c7591c7_elex_mafia_rhadamanthys_stealc_tofsee

Full analysis: https://app.any.run/tasks/c8342000-d5eb-4e45-9b36-2580b2a5de60
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Analysis date: May 17, 2025, 02:18:16
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
adware
solimba
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

E7D50FC380CA6151A37EF17E9C7591C7

SHA1:

41DC6DB7406FC12CD0E9EBB5D6B0E5EC4316A0CA

SHA256:

61559F558301A0A4F88909A9CDBFB2C8282DBCD8A25B387E58B7264E15AE1740

SSDEEP:

24576:oKBTXptOj12UHxQgT/ebhxpc8QH7uOufSRQ0W:oKBT5tOjIURQgT/ebhxpc8y7uO5R4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 2025-05-17_e7d50fc380ca6151a37ef17e9c7591c7_elex_mafia_rhadamanthys_stealc_tofsee.exe (PID: 5124)
    • ADWARE has been detected (SURICATA)

      • s4793.exe (PID: 4880)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 2025-05-17_e7d50fc380ca6151a37ef17e9c7591c7_elex_mafia_rhadamanthys_stealc_tofsee.exe (PID: 2152)
    • Write to the desktop.ini file (may be used to cloak folders)

      • s4793.exe (PID: 4880)
    • Reads security settings of Internet Explorer

      • s4793.exe (PID: 4880)
      • 2025-05-17_e7d50fc380ca6151a37ef17e9c7591c7_elex_mafia_rhadamanthys_stealc_tofsee.exe (PID: 2152)
    • Access to an unwanted program domain was detected

      • s4793.exe (PID: 4880)
  • INFO

    • Create files in a temporary directory

      • 2025-05-17_e7d50fc380ca6151a37ef17e9c7591c7_elex_mafia_rhadamanthys_stealc_tofsee.exe (PID: 2152)
    • Reads the computer name

      • 2025-05-17_e7d50fc380ca6151a37ef17e9c7591c7_elex_mafia_rhadamanthys_stealc_tofsee.exe (PID: 2152)
      • s4793.exe (PID: 4880)
    • Process checks computer location settings

      • 2025-05-17_e7d50fc380ca6151a37ef17e9c7591c7_elex_mafia_rhadamanthys_stealc_tofsee.exe (PID: 2152)
    • Checks supported languages

      • s4793.exe (PID: 4880)
      • 2025-05-17_e7d50fc380ca6151a37ef17e9c7591c7_elex_mafia_rhadamanthys_stealc_tofsee.exe (PID: 2152)
    • Reads the machine GUID from the registry

      • s4793.exe (PID: 4880)
    • Reads Environment values

      • s4793.exe (PID: 4880)
    • Checks proxy server information

      • slui.exe (PID: 2616)
    • Reads the software policy settings

      • slui.exe (PID: 2616)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2014:05:28 22:19:04+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 118272
InitializedDataSize: 375808
UninitializedDataSize: -
EntryPoint: 0xe7ea
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 3.1.11.18
ProductVersionNumber: 3.1.15.0
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: AppsInstall
FileDescription: setupmanager
FileVersion: 3.1.11.18
InternalName: installapps.exe
LegalCopyright: copyright·©·2014
ProductVersion: 3.1.15
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
125
Monitored processes
4
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 2025-05-17_e7d50fc380ca6151a37ef17e9c7591c7_elex_mafia_rhadamanthys_stealc_tofsee.exe #ADWARE s4793.exe slui.exe 2025-05-17_e7d50fc380ca6151a37ef17e9c7591c7_elex_mafia_rhadamanthys_stealc_tofsee.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2152"C:\Users\admin\Desktop\2025-05-17_e7d50fc380ca6151a37ef17e9c7591c7_elex_mafia_rhadamanthys_stealc_tofsee.exe" C:\Users\admin\Desktop\2025-05-17_e7d50fc380ca6151a37ef17e9c7591c7_elex_mafia_rhadamanthys_stealc_tofsee.exe
explorer.exe
User:
admin
Company:
AppsInstall
Integrity Level:
HIGH
Description:
setupmanager
Exit code:
0
Version:
3.1.11.18
Modules
Images
c:\users\admin\desktop\2025-05-17_e7d50fc380ca6151a37ef17e9c7591c7_elex_mafia_rhadamanthys_stealc_tofsee.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2616C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4880"C:\Users\admin\AppData\Local\Temp\n4793\s4793.exe" ins.exe /e 12637913 /u 52f4f61d-8190-4589-86fc-69420a000013 /v "C:\Users\admin\Desktop\2025-05-17_e7d50fc380ca6151a37ef17e9c7591c7_elex_mafia_rhadamanthys_stealc_tofsee.exe"C:\Users\admin\AppData\Local\Temp\n4793\s4793.exe
2025-05-17_e7d50fc380ca6151a37ef17e9c7591c7_elex_mafia_rhadamanthys_stealc_tofsee.exe
User:
admin
Company:
Setup Aplications
Integrity Level:
HIGH
Description:
Setup Aplications
Exit code:
23
Version:
3.1.15
Modules
Images
c:\users\admin\appdata\local\temp\n4793\s4793.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
5124"C:\Users\admin\Desktop\2025-05-17_e7d50fc380ca6151a37ef17e9c7591c7_elex_mafia_rhadamanthys_stealc_tofsee.exe" C:\Users\admin\Desktop\2025-05-17_e7d50fc380ca6151a37ef17e9c7591c7_elex_mafia_rhadamanthys_stealc_tofsee.exeexplorer.exe
User:
admin
Company:
AppsInstall
Integrity Level:
MEDIUM
Description:
setupmanager
Exit code:
3221226540
Version:
3.1.11.18
Modules
Images
c:\users\admin\desktop\2025-05-17_e7d50fc380ca6151a37ef17e9c7591c7_elex_mafia_rhadamanthys_stealc_tofsee.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
4 526
Read events
4 526
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
21522025-05-17_e7d50fc380ca6151a37ef17e9c7591c7_elex_mafia_rhadamanthys_stealc_tofsee.exeC:\Users\admin\AppData\Local\Temp\n4793\s4793.exeexecutable
MD5:9E24FE7DCE5A39EC33319909E3E2E9DE
SHA256:05CDD536227AC4EBAB76770ED3B2BBC364DEB8CFDC1F6A6F598ECB86AA3D268F
4880s4793.exeC:\Windows\assembly\Desktop.inibinary
MD5:F7F759A5CD40BC52172E83486B6DE404
SHA256:A709C2551B8818D7849D31A65446DC2F8C4CCA2DCBBC5385604286F49CFDAF1C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
31
DNS requests
6
Threats
20

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4880
s4793.exe
GET
13.248.148.254:80
http://api.socdn.com/installer/52f4f61d-8190-4589-86fc-69420a000013/12637913/config
unknown
malicious
4880
s4793.exe
GET
13.248.148.254:80
http://api.socdn.com/installer/52f4f61d-8190-4589-86fc-69420a000013/12637913/config
unknown
malicious
4880
s4793.exe
GET
13.248.148.254:80
http://api.socdn.com/installer/52f4f61d-8190-4589-86fc-69420a000013/12637913/config
unknown
malicious
4880
s4793.exe
GET
13.248.148.254:80
http://api.socdn.com/installer/52f4f61d-8190-4589-86fc-69420a000013/12637913/config
unknown
malicious
4880
s4793.exe
GET
13.248.148.254:80
http://api.socdn.com/installer/52f4f61d-8190-4589-86fc-69420a000013/12637913/config
unknown
malicious
4880
s4793.exe
GET
13.248.148.254:80
http://api.socdn.com/installer/52f4f61d-8190-4589-86fc-69420a000013/12637913/config
unknown
malicious
4880
s4793.exe
GET
13.248.148.254:80
http://api.socdn.com/installer/52f4f61d-8190-4589-86fc-69420a000013/12637913/config
unknown
malicious
4880
s4793.exe
GET
13.248.148.254:80
http://api.socdn.com/installer/52f4f61d-8190-4589-86fc-69420a000013/12637913/config
unknown
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
4880
s4793.exe
13.248.148.254:80
api.socdn.com
AMAZON-02
US
malicious
4844
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2616
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 216.58.206.46
whitelisted
api.socdn.com
  • 13.248.148.254
  • 76.223.26.96
malicious
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
4880
s4793.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Solimba installer
4880
s4793.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Solimba installer
4880
s4793.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent (DownloadMR)
4880
s4793.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent (DownloadMR)
4880
s4793.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Solimba installer
4880
s4793.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Solimba installer
4880
s4793.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent (DownloadMR)
4880
s4793.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent (DownloadMR)
4880
s4793.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Solimba installer
4880
s4793.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent (DownloadMR)
No debug info