File name:

dom4

Full analysis: https://app.any.run/tasks/bb819cb5-efe5-405b-85ca-a74554a6dff2
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: April 25, 2019, 17:07:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exe-to-msi
trojan
amadey
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Last Printed: Fri Sep 21 10:56:09 2012, Create Time/Date: Fri Sep 21 10:56:09 2012, Name of Creating Application: Windows Installer, Title: Exe to msi converter free, Author: www.exetomsi.com, Template: ;0, Last Saved By: devuser, Revision Number: {C35CF0AA-9B3F-4903-9F05-EBF606D58D3E}, Last Saved Time/Date: Tue May 21 12:56:44 2013, Number of Pages: 100, Number of Words: 0, Security: 0
MD5:

78985160BDA86130570CAFEB6F7FCDDA

SHA1:

90EC8426103CBF918D1D8B74C6286BC0E071BC74

SHA256:

6389E82E1674E56D006C2C58E36641DB661C35EBA3A7A418E5577C71497459DC

SSDEEP:

1536:/EaOLJltadvIDSrAAnE6H3sJ6qMFM7zDkWKeeGL20kBkEFusfTY9jcTZH5TcxjzW:/EaOLyvVkAnEb0FM7nmp0kSEFP7T3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the Startup folder

      • REG.exe (PID: 2860)

    • Connects to CnC server

      • cmualrc.exe (PID: 3752)

    • Application was dropped or rewritten from another process

      • cmualrc.exe (PID: 3752)

    • AMADEY was detected

      • cmualrc.exe (PID: 3752)

  • SUSPICIOUS

    • Drop ExeToMSI Application

      • msiexec.exe (PID: 3792)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3792)
      • MSIBE1D.tmp (PID: 3588)

    • Uses REG.EXE to modify Windows registry

      • cmualrc.exe (PID: 3752)

    • Creates files in the program directory

      • MSIBE1D.tmp (PID: 3588)

  • INFO

    • Searches for installed software

      • msiexec.exe (PID: 3792)

    • Adds / modifies Windows certificates

      • DrvInst.exe (PID: 3324)

    • Application was dropped or rewritten from another process

      • MSIBE1D.tmp (PID: 3588)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 3836)

    • Changes settings of System certificates

      • DrvInst.exe (PID: 3324)

    • Starts application with an unusual extension

      • msiexec.exe (PID: 3792)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
LastPrinted: 2012:09:21 09:56:09
CreateDate: 2012:09:21 09:56:09
Software: Windows Installer
Title: Exe to msi converter free
Subject: -
Author: www.exetomsi.com
Keywords: -
Comments: -
Template: ;0
LastModifiedBy: devuser
RevisionNumber: {C35CF0AA-9B3F-4903-9F05-EBF606D58D3E}
ModifyDate: 2013:05:21 11:56:44
Pages: 100
Words: -
Security: None
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
7
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start msiexec.exe no specs msiexec.exe vssvc.exe no specs drvinst.exe no specs msibe1d.tmp #AMADEY cmualrc.exe reg.exe

Process information

PID
CMD
Path
Indicators
Parent process
2512"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\dom4.msi"C:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2860REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\f64a428dfdC:\Windows\system32\REG.exe
cmualrc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3324DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot18" "" "" "6792c44eb" "00000000" "00000334" "000005A0"C:\Windows\system32\DrvInst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
3588"C:\Windows\Installer\MSIBE1D.tmp"C:\Windows\Installer\MSIBE1D.tmp
msiexec.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\installer\msibe1d.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
3752c:\programdata\f64a428dfd\cmualrc.exec:\programdata\f64a428dfd\cmualrc.exe
MSIBE1D.tmp
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\programdata\f64a428dfd\cmualrc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3792C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3836C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
487
Read events
310
Write events
165
Delete events
12

Modification events

(PID) Process:(3792) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
40000000000000006016216789FBD401D00E00004C090000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3792) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
40000000000000006016216789FBD401D00E00004C090000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3792) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
20
(PID) Process:(3792) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
40000000000000007E9B876789FBD401D00E00004C090000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3792) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000D8FD896789FBD401D00E0000600C0000E8030000010000000000000000000000606F566B492C0C4592A26856D6AA51B30000000000000000
(PID) Process:(3836) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000004EAE9A6789FBD401FC0E000088080000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3836) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000004EAE9A6789FBD401FC0E0000F0030000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3836) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000004EAE9A6789FBD401FC0E0000E4040000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3836) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000004EAE9A6789FBD401FC0E0000FC040000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3836) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Leave)
Value:
4000000000000000B637A46789FBD401FC0E0000FC040000E8030000000000000100000000000000000000000000000000000000000000000000000000000000
Executable files
3
Suspicious files
6
Text files
103
Unknown types
0

Dropped files

PID
Process
Filename
Type
3792msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
3792msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF909FDFA1EF621A61.TMP —
MD5:—
SHA256:—
3588MSIBE1D.tmpC:\ProgramData\0 —
MD5:—
SHA256:—
3588MSIBE1D.tmpC:\programdata\f64a428dfd\cmualrc.exe:Zone.Identifier —
MD5:—
SHA256:—
3792msiexec.exeC:\Config.Msi\eb6bc.rbs —
MD5:—
SHA256:—
3752cmualrc.exeC:\ProgramData\0 —
MD5:—
SHA256:—
3792msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF130F1BAA5E82ECCA.TMP —
MD5:—
SHA256:—
3836vssvc.exeC: —
MD5:—
SHA256:—
3792msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{6b566f60-2c49-450c-92a2-6856d6aa51b3}_OnDiskSnapshotPropbinary
MD5:—
SHA256:—
3324DrvInst.exeC:\Windows\INF\setupapi.ev1binary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
1
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3752
cmualrc.exe
POST
200
89.47.94.113:80
http://gohaiendo.com/ppk/index.php
RO
text
6 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3752
cmualrc.exe
89.47.94.113:80
gohaiendo.com
Sc Tradeads Interactive Srl
RO
malicious

DNS requests

Domain
IP
Reputation
gohaiendo.com
  • 89.47.94.113
  • 188.208.134.201
  • 95.140.195.178
  • 80.80.165.93
  • 66.181.168.248
  • 86.101.230.109
  • 37.34.176.37
  • 91.201.175.46
  • 197.255.246.6
  • 78.40.46.135
malicious

Threats

PID
Process
Class
Message
3752
cmualrc.exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan.Win32.Amadey
3752
cmualrc.exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan.Win32.Amadey
3752
cmualrc.exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan.Win32.Amadey
3752
cmualrc.exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan.Win32.Amadey
2 ETPRO signatures available at the full report
No debug info