File name:

Setup.exe

Full analysis: https://app.any.run/tasks/7c9f8ca8-c60a-407a-b278-3172a194a8d2
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: July 23, 2024, 02:18:45
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
crypto-regex
amadey
botnet
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

1D3BA94F6E0D1B6638AC611BB08C4111

SHA1:

236F48538BD7BD1946F05A1A27828DDC4CA4536E

SHA256:

7143A5A1BE6622001A7FDC52367A92155125504715DD96B38DF6E67A6D48BD0C

SSDEEP:

98304:Trq3BdwAEp9IRvV83NVfAzHAqUBCT/vPz5hg4zs3l7sffaKzm4Mjte6FsFSgHSkP:DwZ7NVNKcX2oc96C+8iSNB6UOpHTRq7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Setup.exe (PID: 6920)
      • Setup.exe (PID: 4196)
      • Setup.tmp (PID: 364)
      • DuetUpdater.exe (PID: 2196)
      • IDRBackup.exe (PID: 2340)
      • Setup.tmp (PID: 5540)
      • IDRBackup.exe (PID: 4364)
      • Setup.exe (PID: 1488)
      • Setup.tmp (PID: 2140)
      • more.com (PID: 3992)
      • Setup.exe (PID: 3140)
      • Setup.tmp (PID: 6192)
      • Setup.exe (PID: 2628)
      • Setup.tmp (PID: 1508)
      • Setup.exe (PID: 6776)
      • Setup.tmp (PID: 2476)
      • Setup.exe (PID: 2432)
      • Setup.exe (PID: 880)
      • Setup.tmp (PID: 4176)
      • Setup.tmp (PID: 5200)
      • SputterPork.pif (PID: 5304)
      • cmd.exe (PID: 7036)
      • Bush.pif (PID: 1716)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6288)
      • powershell.exe (PID: 6856)

    • Changes powershell execution policy (Bypass)

      • SputterPork.pif (PID: 5304)

    • Adds path to the Windows Defender exclusion list

      • powershell.exe (PID: 6288)

    • Antivirus name has been found in the command line (generic signature)

      • findstr.exe (PID: 4360)
      • findstr.exe (PID: 7136)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 6736)

    • Actions looks like stealing of personal data

      • SputterPork.pif (PID: 5304)

    • Create files in the Startup directory

      • cmd.exe (PID: 2248)

    • Probably downloads file via BitsAdmin (POWERSHELL)

      • powershell.exe (PID: 6856)

    • Connects to the CnC server

      • explorer.exe (PID: 1728)

    • AMADEY has been detected (YARA)

      • explorer.exe (PID: 1728)

    • AMADEY has been detected (SURICATA)

      • explorer.exe (PID: 1728)

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • Setup.tmp (PID: 364)
      • Setup.tmp (PID: 5540)
      • Setup.tmp (PID: 2140)
      • Setup.tmp (PID: 6192)
      • Setup.tmp (PID: 1508)
      • Setup.tmp (PID: 2476)
      • Setup.tmp (PID: 4176)
      • Setup.tmp (PID: 5200)

    • Executable content was dropped or overwritten

      • Setup.exe (PID: 6920)
      • Setup.tmp (PID: 364)
      • Setup.exe (PID: 4196)
      • DuetUpdater.exe (PID: 2196)
      • IDRBackup.exe (PID: 2340)
      • Setup.tmp (PID: 5540)
      • IDRBackup.exe (PID: 4364)
      • Setup.exe (PID: 1488)
      • Setup.tmp (PID: 2140)
      • Setup.exe (PID: 3140)
      • Setup.tmp (PID: 6192)
      • more.com (PID: 3992)
      • Setup.exe (PID: 2628)
      • Setup.tmp (PID: 1508)
      • Setup.exe (PID: 6776)
      • Setup.tmp (PID: 2476)
      • Setup.exe (PID: 880)
      • Setup.exe (PID: 2432)
      • Setup.tmp (PID: 4176)
      • Setup.tmp (PID: 5200)
      • SputterPork.pif (PID: 5304)
      • cmd.exe (PID: 7036)
      • Bush.pif (PID: 1716)
      • netsh.exe (PID: 7072)

    • Reads security settings of Internet Explorer

      • Setup.tmp (PID: 364)
      • Setup.tmp (PID: 5540)
      • Setup.tmp (PID: 2140)
      • Setup.tmp (PID: 1508)
      • Setup.tmp (PID: 4176)
      • H1IL05CXVOKCMHJTSVQ9FP.exe (PID: 2544)

    • Reads the date of Windows installation

      • Setup.tmp (PID: 364)
      • Setup.tmp (PID: 5540)
      • Setup.tmp (PID: 2140)
      • Setup.tmp (PID: 1508)
      • Setup.tmp (PID: 4176)
      • H1IL05CXVOKCMHJTSVQ9FP.exe (PID: 2544)

    • Creates file in the systems drive root

      • Setup.tmp (PID: 364)
      • Setup.tmp (PID: 2140)
      • Setup.tmp (PID: 1508)
      • Setup.tmp (PID: 4176)

    • Process drops SQLite DLL files

      • DuetUpdater.exe (PID: 2196)
      • IDRBackup.exe (PID: 2340)

    • Starts itself from another location

      • IDRBackup.exe (PID: 2340)
      • IDRBackup.exe (PID: 6432)

    • Starts application with an unusual extension

      • IDRBackup.exe (PID: 4364)
      • more.com (PID: 3992)
      • cmd.exe (PID: 7036)
      • IDRBackup.exe (PID: 1028)

    • Drops a file with a rarely used extension (PIF)

      • more.com (PID: 3992)
      • cmd.exe (PID: 7036)
      • Bush.pif (PID: 1716)

    • Searches for installed software

      • SputterPork.pif (PID: 5304)

    • The process executes Powershell scripts

      • SputterPork.pif (PID: 5304)

    • Starts POWERSHELL.EXE for commands execution

      • SputterPork.pif (PID: 5304)
      • powershell.exe (PID: 6288)

    • Executing commands from ".cmd" file

      • H1IL05CXVOKCMHJTSVQ9FP.exe (PID: 2544)

    • Script adds exclusion path to Windows Defender

      • powershell.exe (PID: 6288)

    • Application launched itself

      • powershell.exe (PID: 6288)
      • cmd.exe (PID: 7036)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 6288)

    • Starts a new process with hidden mode (POWERSHELL)

      • powershell.exe (PID: 6288)

    • Uses sleep to delay execution (POWERSHELL)

      • powershell.exe (PID: 6288)

    • Starts CMD.EXE for commands execution

      • H1IL05CXVOKCMHJTSVQ9FP.exe (PID: 2544)
      • cmd.exe (PID: 7036)

    • Get information on the list of running processes

      • cmd.exe (PID: 7036)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 7036)

    • Suspicious use of NETSH.EXE

      • O1YKXZCPWEH54WAWOGY1.exe (PID: 4228)

    • Suspicious file concatenation

      • cmd.exe (PID: 4296)

    • The executable file from the user directory is run by the CMD process

      • Bush.pif (PID: 1716)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 7036)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 6856)

    • Extracts files to a directory (POWERSHELL)

      • powershell.exe (PID: 6856)

    • Found regular expressions for crypto-addresses (YARA)

      • Bush.pif (PID: 1716)

    • Contacting a server suspected of hosting an CnC

      • explorer.exe (PID: 1728)

  • INFO

    • Checks supported languages

      • Setup.exe (PID: 6920)
      • Setup.tmp (PID: 364)
      • Setup.exe (PID: 4196)
      • DuetUpdater.exe (PID: 2196)
      • IDRBackup.exe (PID: 2340)
      • Setup.tmp (PID: 5540)
      • IDRBackup.exe (PID: 4364)
      • more.com (PID: 3992)
      • Bt.exe (PID: 4780)
      • Setup.exe (PID: 1488)
      • Setup.exe (PID: 3140)
      • Setup.tmp (PID: 2140)
      • DuetUpdater.exe (PID: 2864)
      • SputterPork.pif (PID: 5304)
      • Setup.tmp (PID: 6192)
      • Setup.tmp (PID: 1508)
      • Setup.exe (PID: 2628)
      • Setup.tmp (PID: 2476)
      • Setup.exe (PID: 6776)
      • Setup.exe (PID: 880)
      • Setup.exe (PID: 2432)
      • Setup.tmp (PID: 5200)
      • Setup.tmp (PID: 4176)
      • H1IL05CXVOKCMHJTSVQ9FP.exe (PID: 2544)
      • O1YKXZCPWEH54WAWOGY1.exe (PID: 4228)
      • DuetUpdater.exe (PID: 2204)
      • TextInputHost.exe (PID: 6780)
      • Bush.pif (PID: 1716)
      • IDRBackup.exe (PID: 6432)
      • IDRBackup.exe (PID: 1028)
      • Bt.exe (PID: 6748)
      • more.com (PID: 5576)

    • Create files in a temporary directory

      • Setup.tmp (PID: 364)
      • Setup.exe (PID: 6920)
      • Setup.exe (PID: 4196)
      • Setup.tmp (PID: 5540)
      • IDRBackup.exe (PID: 4364)
      • Setup.exe (PID: 1488)
      • Setup.tmp (PID: 2140)
      • Setup.exe (PID: 3140)
      • Setup.tmp (PID: 6192)
      • more.com (PID: 3992)
      • Setup.exe (PID: 2628)
      • Setup.exe (PID: 6776)
      • Setup.tmp (PID: 2476)
      • Setup.tmp (PID: 1508)
      • Setup.exe (PID: 880)
      • Setup.tmp (PID: 4176)
      • Setup.exe (PID: 2432)
      • Setup.tmp (PID: 5200)
      • SputterPork.pif (PID: 5304)
      • H1IL05CXVOKCMHJTSVQ9FP.exe (PID: 2544)
      • O1YKXZCPWEH54WAWOGY1.exe (PID: 4228)
      • netsh.exe (PID: 7072)
      • IDRBackup.exe (PID: 1028)
      • more.com (PID: 5576)

    • Reads Environment values

      • Setup.tmp (PID: 364)
      • Setup.exe (PID: 6920)
      • Setup.exe (PID: 4196)
      • Setup.tmp (PID: 5540)
      • Setup.exe (PID: 1488)
      • Setup.tmp (PID: 2140)
      • Setup.exe (PID: 3140)
      • Setup.tmp (PID: 6192)
      • Setup.tmp (PID: 1508)
      • Setup.exe (PID: 2628)
      • Setup.exe (PID: 6776)
      • Setup.tmp (PID: 2476)
      • Setup.exe (PID: 880)
      • Setup.tmp (PID: 5200)
      • Setup.tmp (PID: 4176)
      • Setup.exe (PID: 2432)

    • Reads the computer name

      • Setup.tmp (PID: 364)
      • IDRBackup.exe (PID: 2340)
      • Setup.tmp (PID: 5540)
      • IDRBackup.exe (PID: 4364)
      • Bt.exe (PID: 4780)
      • more.com (PID: 3992)
      • Setup.tmp (PID: 2140)
      • SputterPork.pif (PID: 5304)
      • Setup.tmp (PID: 6192)
      • Setup.tmp (PID: 1508)
      • Setup.tmp (PID: 2476)
      • Setup.tmp (PID: 5200)
      • Setup.tmp (PID: 4176)
      • H1IL05CXVOKCMHJTSVQ9FP.exe (PID: 2544)
      • O1YKXZCPWEH54WAWOGY1.exe (PID: 4228)
      • Bush.pif (PID: 1716)
      • TextInputHost.exe (PID: 6780)
      • Bt.exe (PID: 6748)
      • more.com (PID: 5576)
      • IDRBackup.exe (PID: 6432)
      • IDRBackup.exe (PID: 1028)

    • Process checks computer location settings

      • Setup.tmp (PID: 364)
      • Setup.tmp (PID: 5540)
      • Setup.tmp (PID: 2140)
      • Setup.tmp (PID: 1508)
      • Setup.tmp (PID: 4176)
      • H1IL05CXVOKCMHJTSVQ9FP.exe (PID: 2544)

    • Creates files or folders in the user directory

      • Setup.tmp (PID: 5540)
      • DuetUpdater.exe (PID: 2196)
      • IDRBackup.exe (PID: 2340)
      • IDRBackup.exe (PID: 4364)
      • Setup.tmp (PID: 6192)
      • Setup.tmp (PID: 2476)
      • Setup.tmp (PID: 5200)
      • Bush.pif (PID: 1716)
      • netsh.exe (PID: 7072)

    • Manual execution by a user

      • Setup.exe (PID: 1488)
      • Setup.exe (PID: 2628)
      • Setup.exe (PID: 880)
      • cmd.exe (PID: 6736)
      • cmd.exe (PID: 2248)
      • Taskmgr.exe (PID: 3384)
      • WinRAR.exe (PID: 5564)
      • IDRBackup.exe (PID: 6432)
      • Taskmgr.exe (PID: 1160)

    • Reads the software policy settings

      • SputterPork.pif (PID: 5304)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 6288)

    • Gets a random number, or selects objects randomly from a collection (POWERSHELL)

      • powershell.exe (PID: 6288)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6288)
      • powershell.exe (PID: 4468)
      • powershell.exe (PID: 6856)

    • Reads mouse settings

      • Bush.pif (PID: 1716)

    • Creates files in the program directory

      • Bush.pif (PID: 1716)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 1160)
      • explorer.exe (PID: 1728)

    • Drops the executable file immediately after the start

      • netsh.exe (PID: 7072)

    • Checks proxy server information

      • explorer.exe (PID: 1728)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(1728) explorer.exe
C2brasseriehub.com
Strings (123)<c>
.jpg
" && timeout 1 && del
&unit=
VideoID
-executionpolicy remotesigned -File "
id:
?scr=1
2016
DefaultSettings.YResolution
Kaspersky Lab
Doctor Web
Bitdefender
Main
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
wb
/k
zip
\
shell32.dll
|
ar:
av:
SOFTWARE\Microsoft\Windows NT\CurrentVersion
Comodo
brasseriehub.com
bi:
shutdown -s -t 0
Rem
d1
+++
pc:
ComputerName
Panda Security
rundll32.exe
WinDefender
DefaultSettings.XResolution
clip.dll
cmd
e0
e2
cmd /C RMDIR /s/q
Programs
st=s
cred.dll
------
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
msi
ProgramData\
360TotalSecurity
GetNativeSystemInfo
=
abcdefghijklmnopqrstuvwxyz0123456789-_
&& Exit"
-%lu
sd:
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
CurrentBuild
Startup
0123456789
/h9fmdW6/index.php
Content-Type: application/x-www-form-urlencoded
ProductName
&&
/h9fmdW5/index.php
" && ren
" Content-Type: application/octet-stream
<d>
\0000
/quiet
/Plugins/
exe
Hkbsse.exe
#
rb
2022
fa94c59947
:::
Avira
ps1
dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Sophos
http://
--
"taskkill /f /im "
Content-Type: multipart/form-data; boundary=----
SYSTEM\ControlSet001\Services\BasicDisplay\Video
https://
Norton
AVAST Software
/h9fmdW7/index.php
og:
ESET
%USERPROFILE%
un:
Powershell.exe
4.41
AVG
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
lv:
"
\App
brasseriehub.com3
dm:
kernel32.dll
brasseriehub2.com
POST
os:
cred.dll|clip.dll|
GET
-unicode-
S-%lu-
rundll32
random
2019
%-lu
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
r=
e1
------
vs:
Content-Disposition: form-data; name="data"; filename="
No Malware configuration.

TRiD

.exe | Inno Setup installer (65.1)
.exe | Win32 EXE PECompact compressed (generic) (24.6)
.dll | Win32 Dynamic Link Library (generic) (3.9)
.exe | Win32 Executable (generic) (2.6)
.exe | Win16/32 Executable Delphi generic (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:06:10 14:47:11+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 2.25
CodeSize: 685056
InitializedDataSize: 56832
UninitializedDataSize: -
EntryPoint: 0xa83bc
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 3.4030.15.3
ProductVersionNumber: 3.4030.15.3
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: armory Setup
FileVersion: 3.4030.15.3
LegalCopyright:
OriginalFileName:
ProductName: armory
ProductVersion: 3.4030.15.3
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
212
Monitored processes
65
Malicious processes
25
Suspicious processes
1

Behavior graph

Click at the process to see the details
start setup.exe setup.tmp setup.exe setup.tmp duetupdater.exe conhost.exe no specs idrbackup.exe idrbackup.exe bt.exe no specs more.com conhost.exe no specs rundll32.exe no specs setup.exe setup.tmp setup.exe setup.tmp duetupdater.exe no specs conhost.exe no specs sputterpork.pif setup.exe setup.tmp setup.exe setup.tmp setup.exe setup.tmp setup.exe setup.tmp powershell.exe no specs conhost.exe no specs h1il05cxvokcmhjtsvq9fp.exe no specs cmd.exe conhost.exe no specs powershell.exe conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs o1ykxzcpweh54wawogy1.exe no specs powershell.exe no specs conhost.exe no specs netsh.exe conhost.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs duetupdater.exe no specs conhost.exe no specs THREAT bush.pif timeout.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe conhost.exe no specs textinputhost.exe no specs taskmgr.exe no specs taskmgr.exe #AMADEY explorer.exe winrar.exe no specs idrbackup.exe no specs idrbackup.exe no specs bt.exe no specs more.com no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
364"C:\Users\admin\AppData\Local\Temp\is-31S17.tmp\Setup.tmp" /SL5="$301DC,4605518,742912,C:\Users\admin\Downloads\Setup.exe" C:\Users\admin\AppData\Local\Temp\is-31S17.tmp\Setup.tmp
Setup.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\is-31s17.tmp\setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
700\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
880"C:\Users\admin\Downloads\Setup.exe" C:\Users\admin\Downloads\Setup.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
armory Setup
Exit code:
1
Version:
3.4030.15.3
Modules
Images
c:\users\admin\downloads\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
1028C:\Users\admin\AppData\Roaming\Gnr\IDRBackup.exeC:\Users\admin\AppData\Roaming\Gnr\IDRBackup.exe—IDRBackup.exe
User:
admin
Company:
iTop Inc.
Integrity Level:
MEDIUM
Description:
iTop Data Recovery Backup
Exit code:
1
Version:
1.0.0.418
Modules
Images
c:\users\admin\appdata\roaming\gnr\idrbackup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1096\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—DuetUpdater.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1128C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1160"C:\WINDOWS\system32\taskmgr.exe" /7C:\Windows\System32\Taskmgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Manager
Exit code:
1073807364
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\combase.dll
1476\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—more.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1488"C:\Users\admin\Downloads\Setup.exe" C:\Users\admin\Downloads\Setup.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
armory Setup
Exit code:
1
Version:
3.4030.15.3
Modules
Images
c:\users\admin\downloads\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
1508"C:\Users\admin\AppData\Local\Temp\is-UVVNJ.tmp\Setup.tmp" /SL5="$5004E,4605518,742912,C:\Users\admin\Downloads\Setup.exe" C:\Users\admin\AppData\Local\Temp\is-UVVNJ.tmp\Setup.tmp
Setup.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
1
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-uvvnj.tmp\setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\comdlg32.dll
c:\windows\syswow64\msvcrt.dll
Total events
50 582
Read events
50 411
Write events
142
Delete events
29

Modification events

(PID) Process:(364) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
6C010000B5A1D2A9A6DCDA01
(PID) Process:(364) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
9C44795E43C46D1EB7AC96FFD793761141C7FD58BC99801578BB16AFFD72E8A6
(PID) Process:(364) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(364) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(364) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(364) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(364) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(364) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:delete valueName:Sequence
Value:

(PID) Process:(364) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:delete valueName:SessionHash
Value:
䒜幹쑃ṭ겷ﾖ鏗ᅶ읁壽馼ᖀ뭸꼖狽ꛨ
(PID) Process:(364) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:delete valueName:Owner
Value:
Ŭ
Executable files
53
Suspicious files
51
Text files
25
Unknown types
0

Dropped files

PID
Process
Filename
Type
5540Setup.tmpC:\Users\admin\AppData\Local\Temp\is-OA6U9.tmp\_isetup\_iscrypt.dllexecutable
MD5:47CFD05FDE4BABE79530C7EA730F6DC0
SHA256:4BB34FE74F86AB389763863EE395A93D73E2D9548C224819EC9055D7C8C4B480
364Setup.tmpC:\Users\admin\AppData\Local\Temp\is-FL3T9.tmp\_isetup\_iscrypt.dllexecutable
MD5:47CFD05FDE4BABE79530C7EA730F6DC0
SHA256:4BB34FE74F86AB389763863EE395A93D73E2D9548C224819EC9055D7C8C4B480
6920Setup.exeC:\Users\admin\AppData\Local\Temp\is-31S17.tmp\Setup.tmpexecutable
MD5:8F5B7030ACFF469053674E18C2A98FAE
SHA256:8C5377E5B6DD221E61EBB70F5788EF5410291AE691BE5E75AB1A182AFDFA7B76
364Setup.tmpC:\Users\admin\AppData\Local\Temp\is-FL3T9.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
2196DuetUpdater.exeC:\Users\admin\AppData\Local\armory\madbasic_.bplexecutable
MD5:DC6655A38FFDC3C349F13828FC8EC36E
SHA256:16126FF5DAA3787A159CF4A39AA040B8050EBB66AB90DBB97C503110EF72824A
2196DuetUpdater.exeC:\Users\admin\AppData\Local\armory\datastate.dllexecutable
MD5:28F0CCF746F952F94FF434CA989B7814
SHA256:6010E2147A0F51A7BFA2F942A5A9EAAD9A294F463F717963B486ED3F53D305C2
5540Setup.tmpC:\Users\admin\AppData\Local\Temp\is-OA6U9.tmp\DuetUpdater.exeexecutable
MD5:E84B92F608DB288AFCC12C5FE341B6C7
SHA256:F6C80D7C6AB6BA91CC24E12AA71C5290CA095E0842AE59A460AD71522039DEB3
5540Setup.tmpC:\Users\admin\AppData\Local\armory\is-8UCGQ.tmpcompressed
MD5:28990BBF95718C51EA909A659FBDA61B
SHA256:871B73751A7B2AB7A3F7FDBEEB456FAD499D5EEBCB1641F6C45F3E5307253869
4196Setup.exeC:\Users\admin\AppData\Local\Temp\is-JGJQ3.tmp\Setup.tmpexecutable
MD5:8F5B7030ACFF469053674E18C2A98FAE
SHA256:8C5377E5B6DD221E61EBB70F5788EF5410291AE691BE5E75AB1A182AFDFA7B76
5540Setup.tmpC:\Users\admin\AppData\Local\Temp\is-OA6U9.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
68
DNS requests
34
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1728
explorer.exe
POST
404
104.21.31.79:80
http://brasseriehub2.com/h9fmdW6/index.php
unknown
—
—
unknown
1728
explorer.exe
POST
200
45.140.19.240:80
http://brasseriehub.com/h9fmdW5/index.php
unknown
—
—
unknown
1728
explorer.exe
POST
200
45.140.19.240:80
http://brasseriehub.com/h9fmdW5/index.php
unknown
—
—
unknown
3148
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
1728
explorer.exe
POST
404
104.21.31.79:80
http://brasseriehub2.com/h9fmdW6/index.php
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
3560
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6012
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3076
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3952
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
4.208.221.206:443
licensing.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
—
—
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1432
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5368
SearchApp.exe
184.86.251.27:443
www.bing.com
Akamai International B.V.
DE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.206
whitelisted
licensing.mp.microsoft.com
  • 4.208.221.206
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
www.bing.com
  • 184.86.251.27
  • 184.86.251.22
  • 184.86.251.7
whitelisted
login.live.com
  • 20.190.159.68
  • 40.126.31.73
  • 20.190.159.75
  • 40.126.31.69
  • 20.190.159.71
  • 20.190.159.23
  • 20.190.159.2
  • 20.190.159.73
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
go.microsoft.com
  • 184.30.17.189
whitelisted
arc.msn.com
  • 20.105.99.58
whitelisted
fd.api.iris.microsoft.com
  • 20.86.201.138
whitelisted

Threats

PID
Process
Class
Message
5304
SputterPork.pif
Misc activity
ET INFO Observed Pastebin Service Domain (rentry .co in TLS SNI)
2284
svchost.exe
Misc activity
ET INFO Pastebin Service Domain in DNS Lookup (rentry .co)
1728
explorer.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
1728
explorer.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Setup.exe