analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

dom4

Full analysis: https://app.any.run/tasks/bb819cb5-efe5-405b-85ca-a74554a6dff2
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: April 25, 2019, 17:07:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exe-to-msi
trojan
amadey
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Last Printed: Fri Sep 21 10:56:09 2012, Create Time/Date: Fri Sep 21 10:56:09 2012, Name of Creating Application: Windows Installer, Title: Exe to msi converter free, Author: www.exetomsi.com, Template: ;0, Last Saved By: devuser, Revision Number: {C35CF0AA-9B3F-4903-9F05-EBF606D58D3E}, Last Saved Time/Date: Tue May 21 12:56:44 2013, Number of Pages: 100, Number of Words: 0, Security: 0
MD5:

78985160BDA86130570CAFEB6F7FCDDA

SHA1:

90EC8426103CBF918D1D8B74C6286BC0E071BC74

SHA256:

6389E82E1674E56D006C2C58E36641DB661C35EBA3A7A418E5577C71497459DC

SSDEEP:

1536:/EaOLJltadvIDSrAAnE6H3sJ6qMFM7zDkWKeeGL20kBkEFusfTY9jcTZH5TcxjzW:/EaOLyvVkAnEb0FM7nmp0kSEFP7T3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the Startup folder

      • REG.exe (PID: 2860)

    • Application was dropped or rewritten from another process

      • cmualrc.exe (PID: 3752)

    • Connects to CnC server

      • cmualrc.exe (PID: 3752)

    • AMADEY was detected

      • cmualrc.exe (PID: 3752)

  • SUSPICIOUS

    • Drop ExeToMSI Application

      • msiexec.exe (PID: 3792)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3792)
      • MSIBE1D.tmp (PID: 3588)

    • Uses REG.EXE to modify Windows registry

      • cmualrc.exe (PID: 3752)

    • Creates files in the program directory

      • MSIBE1D.tmp (PID: 3588)

  • INFO

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 3836)

    • Changes settings of System certificates

      • DrvInst.exe (PID: 3324)

    • Adds / modifies Windows certificates

      • DrvInst.exe (PID: 3324)

    • Searches for installed software

      • msiexec.exe (PID: 3792)

    • Starts application with an unusual extension

      • msiexec.exe (PID: 3792)

    • Application was dropped or rewritten from another process

      • MSIBE1D.tmp (PID: 3588)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
LastPrinted: 2012:09:21 09:56:09
CreateDate: 2012:09:21 09:56:09
Software: Windows Installer
Title: Exe to msi converter free
Subject: -
Author: www.exetomsi.com
Keywords: -
Comments: -
Template: ;0
LastModifiedBy: devuser
RevisionNumber: {C35CF0AA-9B3F-4903-9F05-EBF606D58D3E}
ModifyDate: 2013:05:21 11:56:44
Pages: 100
Words: -
Security: None
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
7
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start msiexec.exe no specs msiexec.exe vssvc.exe no specs drvinst.exe no specs msibe1d.tmp #AMADEY cmualrc.exe reg.exe

Process information

PID
CMD
Path
Indicators
Parent process
2512"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\dom4.msi"C:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3792C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3836C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3324DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot18" "" "" "6792c44eb" "00000000" "00000334" "000005A0"C:\Windows\system32\DrvInst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3588"C:\Windows\Installer\MSIBE1D.tmp"C:\Windows\Installer\MSIBE1D.tmp
msiexec.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3752c:\programdata\f64a428dfd\cmualrc.exec:\programdata\f64a428dfd\cmualrc.exe
MSIBE1D.tmp
User:
SYSTEM
Integrity Level:
SYSTEM
2860REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\f64a428dfdC:\Windows\system32\REG.exe
cmualrc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
487
Read events
310
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
6
Text files
103
Unknown types
0

Dropped files

PID
Process
Filename
Type
3792msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
3792msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:7CAC7B75B067AAEB56B816AC5B378D00
SHA256:2AB1BFC20858F09D38459EAFBD28EC5677E80101CB3CBDBE75F1931B0203A91A
3324DrvInst.exeC:\Windows\INF\setupapi.ev3binary
MD5:76DCC60F78B3DFF1AE3627619074F465
SHA256:18541AC1875315C4F9EFF75050C574FAFF83717C029DAE6B366F9C6C3F0C19E0
3324DrvInst.exeC:\Windows\INF\setupapi.ev1binary
MD5:FEBA6FB1A6A903C4F62686CD5D5243A3
SHA256:817F4A4F74926F7FF3CE6BCBAF45333DB55605649026C898A329BFF94CDC7488
3792msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{6b566f60-2c49-450c-92a2-6856d6aa51b3}_OnDiskSnapshotPropbinary
MD5:7CAC7B75B067AAEB56B816AC5B378D00
SHA256:2AB1BFC20858F09D38459EAFBD28EC5677E80101CB3CBDBE75F1931B0203A91A
3324DrvInst.exeC:\Windows\INF\setupapi.dev.logini
MD5:77FFFCAB2BE029051E1A1B0BEB4B74D6
SHA256:1198384FC42A43DF312C9620294FCF009DED2F482C94A876A93C7DA092E4EC14
3792msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF909FDFA1EF621A61.TMP —
MD5:—
SHA256:—
3588MSIBE1D.tmpC:\ProgramData\0 —
MD5:—
SHA256:—
3588MSIBE1D.tmpC:\programdata\f64a428dfd\cmualrc.exe:Zone.Identifier —
MD5:—
SHA256:—
3792msiexec.exeC:\Config.Msi\eb6bc.rbs —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3752
cmualrc.exe
POST
200
89.47.94.113:80
http://gohaiendo.com/ppk/index.php
RO
text
6 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3752
cmualrc.exe
89.47.94.113:80
gohaiendo.com
Sc Tradeads Interactive Srl
RO
malicious

DNS requests

Domain
IP
Reputation
gohaiendo.com
  • 89.47.94.113
  • 188.208.134.201
  • 95.140.195.178
  • 80.80.165.93
  • 66.181.168.248
  • 86.101.230.109
  • 37.34.176.37
  • 91.201.175.46
  • 197.255.246.6
  • 78.40.46.135
malicious

Threats

PID
Process
Class
Message
3752
cmualrc.exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan.Win32.Amadey
3752
cmualrc.exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan.Win32.Amadey
3752
cmualrc.exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan.Win32.Amadey
3752
cmualrc.exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan.Win32.Amadey
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
dom4