File name:

Setup.exe

Full analysis: https://app.any.run/tasks/7c9f8ca8-c60a-407a-b278-3172a194a8d2
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: July 23, 2024, 02:18:45
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
crypto-regex
amadey
botnet
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

1D3BA94F6E0D1B6638AC611BB08C4111

SHA1:

236F48538BD7BD1946F05A1A27828DDC4CA4536E

SHA256:

7143A5A1BE6622001A7FDC52367A92155125504715DD96B38DF6E67A6D48BD0C

SSDEEP:

98304:Trq3BdwAEp9IRvV83NVfAzHAqUBCT/vPz5hg4zs3l7sffaKzm4Mjte6FsFSgHSkP:DwZ7NVNKcX2oc96C+8iSNB6UOpHTRq7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Setup.exe (PID: 6920)
      • Setup.tmp (PID: 364)
      • Setup.exe (PID: 4196)
      • Setup.tmp (PID: 5540)
      • DuetUpdater.exe (PID: 2196)
      • IDRBackup.exe (PID: 4364)
      • IDRBackup.exe (PID: 2340)
      • Setup.exe (PID: 1488)
      • Setup.tmp (PID: 2140)
      • Setup.tmp (PID: 6192)
      • more.com (PID: 3992)
      • Setup.exe (PID: 3140)
      • Setup.exe (PID: 2628)
      • Setup.tmp (PID: 1508)
      • Setup.exe (PID: 6776)
      • Setup.tmp (PID: 2476)
      • Setup.exe (PID: 880)
      • Setup.tmp (PID: 4176)
      • Setup.exe (PID: 2432)
      • Setup.tmp (PID: 5200)
      • SputterPork.pif (PID: 5304)
      • cmd.exe (PID: 7036)
      • Bush.pif (PID: 1716)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6288)
      • powershell.exe (PID: 6856)

    • Adds path to the Windows Defender exclusion list

      • powershell.exe (PID: 6288)

    • Actions looks like stealing of personal data

      • SputterPork.pif (PID: 5304)

    • Changes powershell execution policy (Bypass)

      • SputterPork.pif (PID: 5304)

    • Antivirus name has been found in the command line (generic signature)

      • findstr.exe (PID: 4360)
      • findstr.exe (PID: 7136)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 6736)

    • Create files in the Startup directory

      • cmd.exe (PID: 2248)

    • Probably downloads file via BitsAdmin (POWERSHELL)

      • powershell.exe (PID: 6856)

    • AMADEY has been detected (YARA)

      • explorer.exe (PID: 1728)

    • AMADEY has been detected (SURICATA)

      • explorer.exe (PID: 1728)

    • Connects to the CnC server

      • explorer.exe (PID: 1728)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Setup.exe (PID: 6920)
      • Setup.tmp (PID: 364)
      • Setup.exe (PID: 4196)
      • Setup.tmp (PID: 5540)
      • DuetUpdater.exe (PID: 2196)
      • IDRBackup.exe (PID: 4364)
      • IDRBackup.exe (PID: 2340)
      • Setup.exe (PID: 1488)
      • Setup.tmp (PID: 2140)
      • more.com (PID: 3992)
      • Setup.exe (PID: 3140)
      • Setup.tmp (PID: 6192)
      • Setup.exe (PID: 2628)
      • Setup.tmp (PID: 1508)
      • Setup.exe (PID: 6776)
      • Setup.tmp (PID: 2476)
      • Setup.exe (PID: 880)
      • Setup.tmp (PID: 4176)
      • Setup.exe (PID: 2432)
      • Setup.tmp (PID: 5200)
      • SputterPork.pif (PID: 5304)
      • cmd.exe (PID: 7036)
      • Bush.pif (PID: 1716)
      • netsh.exe (PID: 7072)

    • Reads security settings of Internet Explorer

      • Setup.tmp (PID: 364)
      • Setup.tmp (PID: 5540)
      • Setup.tmp (PID: 2140)
      • Setup.tmp (PID: 1508)
      • Setup.tmp (PID: 4176)
      • H1IL05CXVOKCMHJTSVQ9FP.exe (PID: 2544)

    • Reads the Windows owner or organization settings

      • Setup.tmp (PID: 364)
      • Setup.tmp (PID: 5540)
      • Setup.tmp (PID: 2140)
      • Setup.tmp (PID: 6192)
      • Setup.tmp (PID: 1508)
      • Setup.tmp (PID: 2476)
      • Setup.tmp (PID: 4176)
      • Setup.tmp (PID: 5200)

    • Reads the date of Windows installation

      • Setup.tmp (PID: 364)
      • Setup.tmp (PID: 5540)
      • Setup.tmp (PID: 2140)
      • Setup.tmp (PID: 1508)
      • Setup.tmp (PID: 4176)
      • H1IL05CXVOKCMHJTSVQ9FP.exe (PID: 2544)

    • Creates file in the systems drive root

      • Setup.tmp (PID: 364)
      • Setup.tmp (PID: 2140)
      • Setup.tmp (PID: 1508)
      • Setup.tmp (PID: 4176)

    • Process drops SQLite DLL files

      • DuetUpdater.exe (PID: 2196)
      • IDRBackup.exe (PID: 2340)

    • Starts itself from another location

      • IDRBackup.exe (PID: 2340)
      • IDRBackup.exe (PID: 6432)

    • Starts application with an unusual extension

      • IDRBackup.exe (PID: 4364)
      • more.com (PID: 3992)
      • cmd.exe (PID: 7036)
      • IDRBackup.exe (PID: 1028)

    • Drops a file with a rarely used extension (PIF)

      • more.com (PID: 3992)
      • cmd.exe (PID: 7036)
      • Bush.pif (PID: 1716)

    • Starts POWERSHELL.EXE for commands execution

      • SputterPork.pif (PID: 5304)
      • powershell.exe (PID: 6288)

    • Searches for installed software

      • SputterPork.pif (PID: 5304)

    • The process executes Powershell scripts

      • SputterPork.pif (PID: 5304)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 6288)

    • Starts a new process with hidden mode (POWERSHELL)

      • powershell.exe (PID: 6288)

    • Script adds exclusion path to Windows Defender

      • powershell.exe (PID: 6288)

    • Uses sleep to delay execution (POWERSHELL)

      • powershell.exe (PID: 6288)

    • Executing commands from ".cmd" file

      • H1IL05CXVOKCMHJTSVQ9FP.exe (PID: 2544)

    • Starts CMD.EXE for commands execution

      • H1IL05CXVOKCMHJTSVQ9FP.exe (PID: 2544)
      • cmd.exe (PID: 7036)

    • Suspicious use of NETSH.EXE

      • O1YKXZCPWEH54WAWOGY1.exe (PID: 4228)

    • Get information on the list of running processes

      • cmd.exe (PID: 7036)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 7036)

    • Application launched itself

      • cmd.exe (PID: 7036)
      • powershell.exe (PID: 6288)

    • Suspicious file concatenation

      • cmd.exe (PID: 4296)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 7036)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 6856)

    • Extracts files to a directory (POWERSHELL)

      • powershell.exe (PID: 6856)

    • The executable file from the user directory is run by the CMD process

      • Bush.pif (PID: 1716)

    • Found regular expressions for crypto-addresses (YARA)

      • Bush.pif (PID: 1716)

    • Contacting a server suspected of hosting an CnC

      • explorer.exe (PID: 1728)

  • INFO

    • Create files in a temporary directory

      • Setup.exe (PID: 6920)
      • Setup.tmp (PID: 364)
      • Setup.exe (PID: 4196)
      • Setup.tmp (PID: 5540)
      • IDRBackup.exe (PID: 4364)
      • Setup.exe (PID: 1488)
      • Setup.tmp (PID: 2140)
      • Setup.exe (PID: 3140)
      • Setup.tmp (PID: 6192)
      • more.com (PID: 3992)
      • Setup.exe (PID: 2628)
      • Setup.tmp (PID: 1508)
      • Setup.exe (PID: 6776)
      • Setup.tmp (PID: 2476)
      • Setup.exe (PID: 880)
      • Setup.tmp (PID: 4176)
      • Setup.exe (PID: 2432)
      • Setup.tmp (PID: 5200)
      • SputterPork.pif (PID: 5304)
      • H1IL05CXVOKCMHJTSVQ9FP.exe (PID: 2544)
      • O1YKXZCPWEH54WAWOGY1.exe (PID: 4228)
      • netsh.exe (PID: 7072)
      • IDRBackup.exe (PID: 1028)
      • more.com (PID: 5576)

    • Checks supported languages

      • Setup.exe (PID: 6920)
      • Setup.tmp (PID: 364)
      • Setup.exe (PID: 4196)
      • Setup.tmp (PID: 5540)
      • DuetUpdater.exe (PID: 2196)
      • Bt.exe (PID: 4780)
      • more.com (PID: 3992)
      • IDRBackup.exe (PID: 2340)
      • IDRBackup.exe (PID: 4364)
      • Setup.exe (PID: 1488)
      • Setup.tmp (PID: 2140)
      • DuetUpdater.exe (PID: 2864)
      • Setup.exe (PID: 3140)
      • Setup.tmp (PID: 6192)
      • Setup.exe (PID: 2628)
      • Setup.tmp (PID: 1508)
      • SputterPork.pif (PID: 5304)
      • Setup.exe (PID: 6776)
      • Setup.tmp (PID: 2476)
      • Setup.exe (PID: 880)
      • Setup.tmp (PID: 4176)
      • Setup.exe (PID: 2432)
      • Setup.tmp (PID: 5200)
      • H1IL05CXVOKCMHJTSVQ9FP.exe (PID: 2544)
      • O1YKXZCPWEH54WAWOGY1.exe (PID: 4228)
      • Bush.pif (PID: 1716)
      • DuetUpdater.exe (PID: 2204)
      • TextInputHost.exe (PID: 6780)
      • more.com (PID: 5576)
      • IDRBackup.exe (PID: 6432)
      • IDRBackup.exe (PID: 1028)
      • Bt.exe (PID: 6748)

    • Reads the computer name

      • Setup.tmp (PID: 364)
      • Setup.tmp (PID: 5540)
      • IDRBackup.exe (PID: 4364)
      • Bt.exe (PID: 4780)
      • more.com (PID: 3992)
      • IDRBackup.exe (PID: 2340)
      • Setup.tmp (PID: 2140)
      • Setup.tmp (PID: 6192)
      • SputterPork.pif (PID: 5304)
      • Setup.tmp (PID: 1508)
      • Setup.tmp (PID: 2476)
      • Setup.tmp (PID: 4176)
      • Setup.tmp (PID: 5200)
      • H1IL05CXVOKCMHJTSVQ9FP.exe (PID: 2544)
      • O1YKXZCPWEH54WAWOGY1.exe (PID: 4228)
      • Bush.pif (PID: 1716)
      • TextInputHost.exe (PID: 6780)
      • IDRBackup.exe (PID: 1028)
      • more.com (PID: 5576)
      • Bt.exe (PID: 6748)
      • IDRBackup.exe (PID: 6432)

    • Reads Environment values

      • Setup.exe (PID: 6920)
      • Setup.tmp (PID: 364)
      • Setup.exe (PID: 4196)
      • Setup.tmp (PID: 5540)
      • Setup.exe (PID: 3140)
      • Setup.exe (PID: 1488)
      • Setup.tmp (PID: 2140)
      • Setup.tmp (PID: 6192)
      • Setup.exe (PID: 2628)
      • Setup.tmp (PID: 1508)
      • Setup.exe (PID: 6776)
      • Setup.tmp (PID: 2476)
      • Setup.exe (PID: 880)
      • Setup.tmp (PID: 4176)
      • Setup.tmp (PID: 5200)
      • Setup.exe (PID: 2432)

    • Process checks computer location settings

      • Setup.tmp (PID: 364)
      • Setup.tmp (PID: 5540)
      • Setup.tmp (PID: 2140)
      • Setup.tmp (PID: 1508)
      • Setup.tmp (PID: 4176)
      • H1IL05CXVOKCMHJTSVQ9FP.exe (PID: 2544)

    • Creates files or folders in the user directory

      • Setup.tmp (PID: 5540)
      • DuetUpdater.exe (PID: 2196)
      • IDRBackup.exe (PID: 2340)
      • IDRBackup.exe (PID: 4364)
      • Setup.tmp (PID: 6192)
      • Setup.tmp (PID: 2476)
      • Setup.tmp (PID: 5200)
      • Bush.pif (PID: 1716)
      • netsh.exe (PID: 7072)

    • Manual execution by a user

      • Setup.exe (PID: 1488)
      • Setup.exe (PID: 2628)
      • Setup.exe (PID: 880)
      • cmd.exe (PID: 6736)
      • cmd.exe (PID: 2248)
      • Taskmgr.exe (PID: 3384)
      • Taskmgr.exe (PID: 1160)
      • WinRAR.exe (PID: 5564)
      • IDRBackup.exe (PID: 6432)

    • Reads the software policy settings

      • SputterPork.pif (PID: 5304)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 6288)

    • Gets a random number, or selects objects randomly from a collection (POWERSHELL)

      • powershell.exe (PID: 6288)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6288)
      • powershell.exe (PID: 4468)
      • powershell.exe (PID: 6856)

    • Reads mouse settings

      • Bush.pif (PID: 1716)

    • Drops the executable file immediately after the start

      • netsh.exe (PID: 7072)

    • Creates files in the program directory

      • Bush.pif (PID: 1716)

    • Checks proxy server information

      • explorer.exe (PID: 1728)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 1728)
      • Taskmgr.exe (PID: 1160)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(1728) explorer.exe
C2brasseriehub.com
Strings (123)<c>
.jpg
" && timeout 1 && del
&unit=
VideoID
-executionpolicy remotesigned -File "
id:
?scr=1
2016
DefaultSettings.YResolution
Kaspersky Lab
Doctor Web
Bitdefender
Main
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
wb
/k
zip
\
shell32.dll
|
ar:
av:
SOFTWARE\Microsoft\Windows NT\CurrentVersion
Comodo
brasseriehub.com
bi:
shutdown -s -t 0
Rem
d1
+++
pc:
ComputerName
Panda Security
rundll32.exe
WinDefender
DefaultSettings.XResolution
clip.dll
cmd
e0
e2
cmd /C RMDIR /s/q
Programs
st=s
cred.dll
------
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
msi
ProgramData\
360TotalSecurity
GetNativeSystemInfo
=
abcdefghijklmnopqrstuvwxyz0123456789-_
&& Exit"
-%lu
sd:
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
CurrentBuild
Startup
0123456789
/h9fmdW6/index.php
Content-Type: application/x-www-form-urlencoded
ProductName
&&
/h9fmdW5/index.php
" && ren
" Content-Type: application/octet-stream
<d>
\0000
/quiet
/Plugins/
exe
Hkbsse.exe
#
rb
2022
fa94c59947
:::
Avira
ps1
dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Sophos
http://
--
"taskkill /f /im "
Content-Type: multipart/form-data; boundary=----
SYSTEM\ControlSet001\Services\BasicDisplay\Video
https://
Norton
AVAST Software
/h9fmdW7/index.php
og:
ESET
%USERPROFILE%
un:
Powershell.exe
4.41
AVG
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
lv:
"
\App
brasseriehub.com3
dm:
kernel32.dll
brasseriehub2.com
POST
os:
cred.dll|clip.dll|
GET
-unicode-
S-%lu-
rundll32
random
2019
%-lu
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
r=
e1
------
vs:
Content-Disposition: form-data; name="data"; filename="
No Malware configuration.

TRiD

.exe | Inno Setup installer (65.1)
.exe | Win32 EXE PECompact compressed (generic) (24.6)
.dll | Win32 Dynamic Link Library (generic) (3.9)
.exe | Win32 Executable (generic) (2.6)
.exe | Win16/32 Executable Delphi generic (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:06:10 14:47:11+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 2.25
CodeSize: 685056
InitializedDataSize: 56832
UninitializedDataSize: -
EntryPoint: 0xa83bc
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 3.4030.15.3
ProductVersionNumber: 3.4030.15.3
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: armory Setup
FileVersion: 3.4030.15.3
LegalCopyright:
OriginalFileName:
ProductName: armory
ProductVersion: 3.4030.15.3
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
212
Monitored processes
65
Malicious processes
25
Suspicious processes
1

Behavior graph

Click at the process to see the details
start setup.exe setup.tmp setup.exe setup.tmp duetupdater.exe conhost.exe no specs idrbackup.exe idrbackup.exe bt.exe no specs more.com conhost.exe no specs rundll32.exe no specs setup.exe setup.tmp setup.exe setup.tmp duetupdater.exe no specs conhost.exe no specs sputterpork.pif setup.exe setup.tmp setup.exe setup.tmp setup.exe setup.tmp setup.exe setup.tmp powershell.exe no specs conhost.exe no specs h1il05cxvokcmhjtsvq9fp.exe no specs cmd.exe conhost.exe no specs powershell.exe conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs o1ykxzcpweh54wawogy1.exe no specs powershell.exe no specs conhost.exe no specs netsh.exe conhost.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs duetupdater.exe no specs conhost.exe no specs THREAT bush.pif timeout.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe conhost.exe no specs textinputhost.exe no specs taskmgr.exe no specs taskmgr.exe #AMADEY explorer.exe winrar.exe no specs idrbackup.exe no specs idrbackup.exe no specs bt.exe no specs more.com no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
364"C:\Users\admin\AppData\Local\Temp\is-31S17.tmp\Setup.tmp" /SL5="$301DC,4605518,742912,C:\Users\admin\Downloads\Setup.exe" C:\Users\admin\AppData\Local\Temp\is-31S17.tmp\Setup.tmp
Setup.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\is-31s17.tmp\setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
700\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
880"C:\Users\admin\Downloads\Setup.exe" C:\Users\admin\Downloads\Setup.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
armory Setup
Exit code:
1
Version:
3.4030.15.3
Modules
Images
c:\users\admin\downloads\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
1028C:\Users\admin\AppData\Roaming\Gnr\IDRBackup.exeC:\Users\admin\AppData\Roaming\Gnr\IDRBackup.exe—IDRBackup.exe
User:
admin
Company:
iTop Inc.
Integrity Level:
MEDIUM
Description:
iTop Data Recovery Backup
Exit code:
1
Version:
1.0.0.418
Modules
Images
c:\users\admin\appdata\roaming\gnr\idrbackup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1096\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—DuetUpdater.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1128C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1160"C:\WINDOWS\system32\taskmgr.exe" /7C:\Windows\System32\Taskmgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Manager
Exit code:
1073807364
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\combase.dll
1476\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—more.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1488"C:\Users\admin\Downloads\Setup.exe" C:\Users\admin\Downloads\Setup.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
armory Setup
Exit code:
1
Version:
3.4030.15.3
Modules
Images
c:\users\admin\downloads\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
1508"C:\Users\admin\AppData\Local\Temp\is-UVVNJ.tmp\Setup.tmp" /SL5="$5004E,4605518,742912,C:\Users\admin\Downloads\Setup.exe" C:\Users\admin\AppData\Local\Temp\is-UVVNJ.tmp\Setup.tmp
Setup.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
1
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-uvvnj.tmp\setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\comdlg32.dll
c:\windows\syswow64\msvcrt.dll
Total events
50 582
Read events
50 411
Write events
142
Delete events
29

Modification events

(PID) Process:(364) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
6C010000B5A1D2A9A6DCDA01
(PID) Process:(364) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
9C44795E43C46D1EB7AC96FFD793761141C7FD58BC99801578BB16AFFD72E8A6
(PID) Process:(364) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(364) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(364) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(364) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(364) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(364) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:delete valueName:Sequence
Value:

(PID) Process:(364) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:delete valueName:SessionHash
Value:
䒜幹쑃ṭ겷ﾖ鏗ᅶ읁壽馼ᖀ뭸꼖狽ꛨ
(PID) Process:(364) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:delete valueName:Owner
Value:
Ŭ
Executable files
53
Suspicious files
51
Text files
25
Unknown types
0

Dropped files

PID
Process
Filename
Type
6920Setup.exeC:\Users\admin\AppData\Local\Temp\is-31S17.tmp\Setup.tmpexecutable
MD5:8F5B7030ACFF469053674E18C2A98FAE
SHA256:8C5377E5B6DD221E61EBB70F5788EF5410291AE691BE5E75AB1A182AFDFA7B76
5540Setup.tmpC:\Users\admin\AppData\Local\Temp\is-OA6U9.tmp\DuetUpdater.exeexecutable
MD5:E84B92F608DB288AFCC12C5FE341B6C7
SHA256:F6C80D7C6AB6BA91CC24E12AA71C5290CA095E0842AE59A460AD71522039DEB3
5540Setup.tmpC:\Users\admin\AppData\Local\armory\madbasic_.rarcompressed
MD5:28990BBF95718C51EA909A659FBDA61B
SHA256:871B73751A7B2AB7A3F7FDBEEB456FAD499D5EEBCB1641F6C45F3E5307253869
2196DuetUpdater.exeC:\Users\admin\AppData\Local\armory\butterscotch.vhdbinary
MD5:78808DB0F927AE0A61DD73E0984A5750
SHA256:9208195FF51910EEA710B3B2A915CEDC5E28A2E0C794718A216386DFD18C62A2
2196DuetUpdater.exeC:\Users\admin\AppData\Local\armory\maddisAsm_.bplexecutable
MD5:84BC072F8EA30746F0982AFBDA3C638F
SHA256:52019F47F96CA868FA4E747C3B99CBA1B7AA57317BF8EBF9FCBF09AA576FE006
5540Setup.tmpC:\Users\admin\AppData\Local\Temp\is-OA6U9.tmp\_isetup\_iscrypt.dllexecutable
MD5:47CFD05FDE4BABE79530C7EA730F6DC0
SHA256:4BB34FE74F86AB389763863EE395A93D73E2D9548C224819EC9055D7C8C4B480
2196DuetUpdater.exeC:\Users\admin\AppData\Local\armory\IDRBackup.exeexecutable
MD5:371C165E3E3C1A000051B78D7B0E7E79
SHA256:5AE3838D77C2102766538F783D0A4B4205E7D2CDBA4E0AD2AB332DC8AB32FEA9
2196DuetUpdater.exeC:\Users\admin\AppData\Local\armory\madexcept_.bplexecutable
MD5:21068DFD733435C866312D35B9432733
SHA256:835F1141ECE59C36B18E76927572D229136AEB12EFF44CB4BA98D7808257C299
2196DuetUpdater.exeC:\Users\admin\AppData\Local\armory\vclx120.bplexecutable
MD5:7DAA2B7FE529B45101A399B5EBF0A416
SHA256:2BDF023C439010CE0A786EC75D943A80A8F01363712BBF69AFC29D3E2B5306ED
2196DuetUpdater.exeC:\Users\admin\AppData\Local\armory\vcl120.bplbinary
MD5:19A0010A7767C2D5BD343F780823ADF0
SHA256:A10EEE0457BD631ACAF7D5BD30FB363FAA9F6E9FA0BF6AFC67AA5A2C3599E279
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
68
DNS requests
34
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1728
explorer.exe
POST
404
104.21.31.79:80
http://brasseriehub2.com/h9fmdW6/index.php
unknown
—
—
unknown
1728
explorer.exe
POST
200
45.140.19.240:80
http://brasseriehub.com/h9fmdW5/index.php
unknown
—
—
unknown
1728
explorer.exe
POST
200
45.140.19.240:80
http://brasseriehub.com/h9fmdW5/index.php
unknown
—
—
unknown
3148
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
1728
explorer.exe
POST
404
104.21.31.79:80
http://brasseriehub2.com/h9fmdW6/index.php
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
3560
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6012
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3076
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3952
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
4.208.221.206:443
licensing.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
—
—
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1432
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5368
SearchApp.exe
184.86.251.27:443
www.bing.com
Akamai International B.V.
DE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.206
whitelisted
licensing.mp.microsoft.com
  • 4.208.221.206
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
www.bing.com
  • 184.86.251.27
  • 184.86.251.22
  • 184.86.251.7
whitelisted
login.live.com
  • 20.190.159.68
  • 40.126.31.73
  • 20.190.159.75
  • 40.126.31.69
  • 20.190.159.71
  • 20.190.159.23
  • 20.190.159.2
  • 20.190.159.73
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
go.microsoft.com
  • 184.30.17.189
whitelisted
arc.msn.com
  • 20.105.99.58
whitelisted
fd.api.iris.microsoft.com
  • 20.86.201.138
whitelisted

Threats

PID
Process
Class
Message
5304
SputterPork.pif
Misc activity
ET INFO Observed Pastebin Service Domain (rentry .co in TLS SNI)
2284
svchost.exe
Misc activity
ET INFO Pastebin Service Domain in DNS Lookup (rentry .co)
1728
explorer.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
1728
explorer.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Setup.exe