File name:

AND64.exe

Full analysis: https://app.any.run/tasks/ae11c8b8-cfb7-4e22-928b-2c5053b47ab7
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: January 06, 2024, 03:03:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
amadey
botnet
stealer
risepro
loader
kelihos
trojan
evasion
redline
lumma
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

9A0B7EE713610B8395C8F0580A3B1E3D

SHA1:

E44A9E7EC6FE06AE6BA1B9518DB78E95AD451942

SHA256:

6B8E428CFF996C49AA52E017213C7016880A2BC1583D051240C74992BF83C357

SSDEEP:

6144:JO+8qkRrtd3yX13t39boWEtaXNUYViUMzkfjDyV4i78+4Bkq:+qkRrtVyX13DoJYViUMzknWI+O

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • explorhe.exe (PID: 2072)

    • Uses Task Scheduler to run other applications

      • explorhe.exe (PID: 2072)
      • cmd.exe (PID: 2304)

    • Risepro uses scheduled tasks to run itself

      • cmd.exe (PID: 2304)
      • cmd.exe (PID: 2248)

    • Uses Task Scheduler to autorun other applications

      • cmd.exe (PID: 2248)

    • Steals credentials from Web Browsers

      • RegAsm.exe (PID: 984)

    • LUMMA has been detected (YARA)

      • ev.exe (PID: 1592)

    • Actions looks like stealing of personal data

      • RegAsm.exe (PID: 984)

  • SUSPICIOUS

    • Reads settings of System Certificates

      • explorhe.exe (PID: 2072)
      • ev.exe (PID: 1592)
      • ev.exe (PID: 2424)
      • rise.exe (PID: 848)

    • Checks Windows Trust Settings

      • explorhe.exe (PID: 2072)

    • Reads security settings of Internet Explorer

      • explorhe.exe (PID: 2072)

    • Reads the Internet Settings

      • AND64.exe (PID: 1356)
      • explorhe.exe (PID: 2072)
      • ev.exe (PID: 1592)
      • rise.exe (PID: 848)
      • ev.exe (PID: 2424)

    • Adds/modifies Windows certificates

      • ev.exe (PID: 1592)
      • ev.exe (PID: 2424)

    • Starts CMD.EXE for commands execution

      • rise.exe (PID: 848)

    • Searches for installed software

      • RegAsm.exe (PID: 984)

    • Reads browser cookies

      • RegAsm.exe (PID: 984)

    • Uses RUNDLL32.EXE to load library

      • explorhe.exe (PID: 2072)

  • INFO

    • Checks supported languages

      • AND64.exe (PID: 1356)
      • explorhe.exe (PID: 2072)
      • ev.exe (PID: 1592)
      • rise.exe (PID: 848)
      • ev.exe (PID: 2424)
      • bakhtiar.exe (PID: 664)
      • golden.exe (PID: 552)
      • RegAsm.exe (PID: 984)
      • InstallUtil.exe (PID: 2488)
      • AddInProcess32.exe (PID: 2888)
      • AddInProcess32.exe (PID: 2960)
      • explorhe.exe (PID: 908)
      • explorhe.exe (PID: 3068)
      • explorhe.exe (PID: 3028)
      • explorhe.exe (PID: 3016)
      • explorhe.exe (PID: 3220)

    • Reads the computer name

      • AND64.exe (PID: 1356)
      • explorhe.exe (PID: 2072)
      • ev.exe (PID: 1592)
      • rise.exe (PID: 848)
      • ev.exe (PID: 2424)
      • golden.exe (PID: 552)
      • RegAsm.exe (PID: 984)
      • bakhtiar.exe (PID: 664)

    • Checks proxy server information

      • explorhe.exe (PID: 2072)

    • Drops the executable file immediately after the start

      • AND64.exe (PID: 1356)
      • explorhe.exe (PID: 2072)
      • rise.exe (PID: 848)
      • bakhtiar.exe (PID: 664)

    • Create files in a temporary directory

      • AND64.exe (PID: 1356)
      • explorhe.exe (PID: 2072)
      • ev.exe (PID: 1592)
      • rise.exe (PID: 848)
      • bakhtiar.exe (PID: 664)

    • Reads the machine GUID from the registry

      • AND64.exe (PID: 1356)
      • explorhe.exe (PID: 2072)
      • ev.exe (PID: 1592)
      • rise.exe (PID: 848)
      • ev.exe (PID: 2424)
      • RegAsm.exe (PID: 984)
      • bakhtiar.exe (PID: 664)

    • Starts itself from another location

      • AND64.exe (PID: 1356)

    • Creates files or folders in the user directory

      • explorhe.exe (PID: 2072)
      • rise.exe (PID: 848)

    • Reads Environment values

      • ev.exe (PID: 1592)
      • rise.exe (PID: 848)
      • ev.exe (PID: 2424)
      • RegAsm.exe (PID: 984)

    • Creates files in the program directory

      • rise.exe (PID: 848)
      • bakhtiar.exe (PID: 664)

    • KELIHOS has been detected (SURICATA)

      • explorhe.exe (PID: 2072)

    • Connects to unusual port

      • rise.exe (PID: 848)
      • RegAsm.exe (PID: 984)

    • Process requests binary or script from the Internet

      • explorhe.exe (PID: 2072)

    • RISEPRO has been detected (SURICATA)

      • rise.exe (PID: 848)

    • AMADEY has been detected (SURICATA)

      • explorhe.exe (PID: 2072)

    • Connects to the CnC server

      • rise.exe (PID: 848)
      • RegAsm.exe (PID: 984)

    • Connects to the server without a host name

      • explorhe.exe (PID: 2072)

    • Checks for external IP

      • rise.exe (PID: 848)

    • Reads product name

      • RegAsm.exe (PID: 984)

    • REDLINE has been detected (SURICATA)

      • RegAsm.exe (PID: 984)

    • The process executes via Task Scheduler

      • explorhe.exe (PID: 908)
      • explorhe.exe (PID: 3028)
      • explorhe.exe (PID: 3068)
      • explorhe.exe (PID: 3016)
      • explorhe.exe (PID: 3220)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Lumma

(PID) Process(1592) ev.exe
C2 (7)netovrema.pw
opposesicknessopw.pw
carstirgapcheatdeposwte.pw
playerweighmailydailew.pw
politefrightenpowoa.pw
recessionconceptjetwe.pw
blastechohackopeower.pw
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:01:04 17:01:48+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.24
CodeSize: 330240
InitializedDataSize: 110592
UninitializedDataSize: -
EntryPoint: 0x1f6a9
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
59
Monitored processes
22
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start and64.exe no specs #AMADEY explorhe.exe schtasks.exe no specs #LUMMA ev.exe #RISEPRO rise.exe cmd.exe schtasks.exe no specs cmd.exe schtasks.exe no specs ev.exe bakhtiar.exe no specs golden.exe no specs #REDLINE regasm.exe addinprocess32.exe no specs addinprocess32.exe no specs installutil.exe no specs explorhe.exe no specs rundll32.exe no specs explorhe.exe no specs explorhe.exe no specs explorhe.exe no specs explorhe.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1356"C:\Users\admin\Desktop\AND64.exe" C:\Users\admin\Desktop\AND64.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\and64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
2072"C:\Users\admin\AppData\Local\Temp\d887ceb89d\explorhe.exe" C:\Users\admin\AppData\Local\Temp\d887ceb89d\explorhe.exe
AND64.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\d887ceb89d\explorhe.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
2268"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explorhe.exe /TR "C:\Users\admin\AppData\Local\Temp\d887ceb89d\explorhe.exe" /FC:\Windows\System32\schtasks.exe—explorhe.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1592"C:\Users\admin\AppData\Local\Temp\1000032001\ev.exe" C:\Users\admin\AppData\Local\Temp\1000032001\ev.exe
explorhe.exe
User:
admin
Company:
ArtVibes Innovations
Integrity Level:
MEDIUM
Description:
InkCraft Master
Exit code:
0
Version:
1.0.3
Modules
Images
c:\users\admin\appdata\local\temp\1000032001\ev.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Lumma
(PID) Process(1592) ev.exe
C2 (7)netovrema.pw
opposesicknessopw.pw
carstirgapcheatdeposwte.pw
playerweighmailydailew.pw
politefrightenpowoa.pw
recessionconceptjetwe.pw
blastechohackopeower.pw
848"C:\Users\admin\AppData\Local\Temp\1000040001\rise.exe" C:\Users\admin\AppData\Local\Temp\1000040001\rise.exe
explorhe.exe
User:
admin
Company:
Polymod Inc.
Integrity Level:
MEDIUM
Description:
PolymodXT v1.3
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\1000040001\rise.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2304"cmd.exe" /c schtasks /create /f /RU "admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHESTC:\Windows\System32\cmd.exe
rise.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2348schtasks /create /f /RU "admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHESTC:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2248"cmd.exe" /c schtasks /create /f /RU "admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHESTC:\Windows\System32\cmd.exe
rise.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1560schtasks /create /f /RU "admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHESTC:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2424"C:\Users\admin\AppData\Local\Temp\1000043001\ev.exe" C:\Users\admin\AppData\Local\Temp\1000043001\ev.exe
explorhe.exe
User:
admin
Company:
ArtVibes Innovations
Integrity Level:
MEDIUM
Description:
InkCraft Master
Exit code:
0
Version:
1.0.3
Modules
Images
c:\users\admin\appdata\local\temp\1000043001\ev.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
17 739
Read events
17 614
Write events
102
Delete events
23

Modification events

(PID) Process:(1356) AND64.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1356) AND64.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1356) AND64.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1356) AND64.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2072) explorhe.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Operation:writeName:Startup
Value:
%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
(PID) Process:(2072) explorhe.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2072) explorhe.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2072) explorhe.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2072) explorhe.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2072) explorhe.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
19
Suspicious files
9
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
2072explorhe.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
848rise.exeC:\Users\admin\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exeexecutable
MD5:E33B43AC05FDDF2791D1312F67E921A5
SHA256:B6BC62948875B3B8F74A1726BCBCE53E74F1C918B0676D20E6BBF76F9F069AE2
2072explorhe.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:3D2A2AAB8F3DA96E7BF80B00AB156721
SHA256:54026822CBAD99B5B974B3E04367614226731DC899522945FF75F12909810F90
2072explorhe.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\ev[1].exeexecutable
MD5:5D7EA462FC3F943663C9A2C4B3AF3EDC
SHA256:BD7A5EC85EB43127E57033AD64FC8527481F4139A343F86C48BB3EA2C4537052
1592ev.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:AC05D27423A85ADC1622C714F2CB6184
SHA256:C6456E12E5E53287A547AF4103E0397CB9697E466CF75844312DC296D43D144D
848rise.exeC:\Users\admin\AppData\Local\Temp\d887ceb89d\FANBooster131.lnkbinary
MD5:EE254AFF1DD270D13497CD23D9FF2143
SHA256:BF3F5768E1D6443F818355DB0E553A023EFC9724627FFC982C5E60AA020666DC
1592ev.exeC:\Users\admin\AppData\Local\Temp\CabFDE8.tmpcompressed
MD5:AC05D27423A85ADC1622C714F2CB6184
SHA256:C6456E12E5E53287A547AF4103E0397CB9697E466CF75844312DC296D43D144D
1592ev.exeC:\Users\admin\AppData\Local\Temp\TarFDE9.tmpbinary
MD5:9C0C641C06238516F27941AA1166D427
SHA256:4276AF3669A141A59388BC56A87F6614D9A9BDDDF560636C264219A7EB11256F
848rise.exeC:\Users\admin\AppData\Local\Temp\FANBooster131\FANBooster131.exeexecutable
MD5:E33B43AC05FDDF2791D1312F67E921A5
SHA256:B6BC62948875B3B8F74A1726BCBCE53E74F1C918B0676D20E6BBF76F9F069AE2
2072explorhe.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:A7419B9A48190E72B48FADC5688F4043
SHA256:46D3C9B45A09F5F3C75F407736D26DCEBD07297C9E7EBEFDC633840A05D91939
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
19
DNS requests
6
Threats
74

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2072
explorhe.exe
GET
200
77.91.68.21:80
http://77.91.68.21/lend/YT.exe
unknown
executable
2.21 Mb
—
2072
explorhe.exe
POST
200
185.215.113.68:80
http://185.215.113.68/theme/index.php
unknown
text
2 b
—
2072
explorhe.exe
POST
200
185.215.113.68:80
http://185.215.113.68/theme/index.php
unknown
text
697 b
—
2072
explorhe.exe
GET
200
77.91.68.21:80
http://77.91.68.21/mine/rise.exe
unknown
executable
856 Kb
—
2072
explorhe.exe
POST
200
185.215.113.68:80
http://185.215.113.68/theme/index.php
unknown
text
4 b
—
2072
explorhe.exe
GET
—
185.215.113.68:80
http://185.215.113.68/theme/Plugins/clip.dll
unknown
—
—
—
2072
explorhe.exe
POST
200
185.215.113.68:80
http://185.215.113.68/theme/index.php
unknown
text
4 b
—
2072
explorhe.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8744af06b0e0ce08
unknown
compressed
4.66 Kb
—
2072
explorhe.exe
POST
200
185.215.113.68:80
http://185.215.113.68/theme/index.php
unknown
text
4 b
—
2072
explorhe.exe
POST
200
185.215.113.68:80
http://185.215.113.68/theme/index.php
unknown
text
4 b
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
unknown
2072
explorhe.exe
185.215.113.68:80
—
1337team Limited
SC
unknown
4
System
192.168.100.255:138
—
—
—
unknown
2072
explorhe.exe
162.159.129.233:443
cdn.discordapp.com
CLOUDFLARENET
—
unknown
2072
explorhe.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
unknown
2072
explorhe.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1592
ev.exe
162.19.58.156:443
i.ibb.co
OVH SAS
FR
unknown
1592
ev.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
unknown

DNS requests

Domain
IP
Reputation
cdn.discordapp.com
  • 162.159.129.233
  • 162.159.134.233
  • 162.159.133.233
  • 162.159.130.233
  • 162.159.135.233
unknown
ctldl.windowsupdate.com
  • 93.184.221.240
unknown
ocsp.digicert.com
  • 192.229.221.95
unknown
i.ibb.co
  • 162.19.58.156
  • 162.19.58.160
  • 162.19.58.157
  • 162.19.58.161
  • 162.19.58.159
  • 162.19.58.158
unknown
ipinfo.io
  • 34.117.186.192
unknown
dns.msftncsi.com
  • 131.107.255.255
unknown

Threats

PID
Process
Class
Message
—
—
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 22
—
—
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey
—
—
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discordapp .com)
—
—
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Image hosting service ImgBB
—
—
A Network Trojan was detected
ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2
—
—
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
—
—
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
AND64.exe