File name:

Setup.exe

Full analysis: https://app.any.run/tasks/be8886d9-dad6-4f7d-b684-7dfb2a506ac3
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: July 22, 2024, 12:18:38
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
hijackloader
loader
lumma
amadey
botnet
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

1D3BA94F6E0D1B6638AC611BB08C4111

SHA1:

236F48538BD7BD1946F05A1A27828DDC4CA4536E

SHA256:

7143A5A1BE6622001A7FDC52367A92155125504715DD96B38DF6E67A6D48BD0C

SSDEEP:

98304:Trq3BdwAEp9IRvV83NVfAzHAqUBCT/vPz5hg4zs3l7sffaKzm4Mjte6FsFSgHSkP:DwZ7NVNKcX2oc96C+8iSNB6UOpHTRq7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Setup.exe (PID: 2112)
      • Setup.tmp (PID: 7204)
      • Setup.exe (PID: 6348)
      • Setup.tmp (PID: 1540)
      • DuetUpdater.exe (PID: 5400)
      • IDRBackup.exe (PID: 7636)
      • IDRBackup.exe (PID: 6484)
      • more.com (PID: 380)
      • SputterPork.pif (PID: 852)
      • Bush.pif (PID: 4956)
      • cmd.exe (PID: 6952)

    • HIJACKLOADER has been detected (YARA)

      • more.com (PID: 380)
      • SputterPork.pif (PID: 852)
      • netsh.exe (PID: 4568)
      • explorer.exe (PID: 2720)

    • LUMMA has been detected (YARA)

      • more.com (PID: 380)
      • SputterPork.pif (PID: 852)

    • Antivirus name has been found in the command line (generic signature)

      • findstr.exe (PID: 5272)
      • findstr.exe (PID: 2996)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 7604)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 7464)
      • powershell.exe (PID: 5400)

    • Changes powershell execution policy (Bypass)

      • SputterPork.pif (PID: 852)

    • Adds path to the Windows Defender exclusion list

      • powershell.exe (PID: 5400)

    • AMADEY has been detected (YARA)

      • explorer.exe (PID: 2720)
      • netsh.exe (PID: 4568)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Setup.exe (PID: 2112)
      • Setup.tmp (PID: 7204)
      • Setup.exe (PID: 6348)
      • DuetUpdater.exe (PID: 5400)
      • Setup.tmp (PID: 1540)
      • IDRBackup.exe (PID: 6484)
      • IDRBackup.exe (PID: 7636)
      • SputterPork.pif (PID: 852)
      • more.com (PID: 380)
      • cmd.exe (PID: 6952)
      • Bush.pif (PID: 4956)
      • netsh.exe (PID: 4568)

    • Reads security settings of Internet Explorer

      • Setup.tmp (PID: 7204)
      • Setup.tmp (PID: 1540)

    • Reads the Windows owner or organization settings

      • Setup.tmp (PID: 7204)
      • Setup.tmp (PID: 1540)

    • Reads the date of Windows installation

      • Setup.tmp (PID: 7204)
      • Setup.tmp (PID: 1540)

    • Process drops SQLite DLL files

      • DuetUpdater.exe (PID: 5400)
      • IDRBackup.exe (PID: 7636)

    • Starts itself from another location

      • IDRBackup.exe (PID: 7636)

    • Get information on the list of running processes

      • cmd.exe (PID: 6952)

    • Executing commands from ".cmd" file

      • W1S9MNQ9VI0VC3T1.exe (PID: 8160)

    • Starts CMD.EXE for commands execution

      • W1S9MNQ9VI0VC3T1.exe (PID: 8160)
      • cmd.exe (PID: 6952)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 6952)

    • Starts application with an unusual extension

      • IDRBackup.exe (PID: 6484)
      • more.com (PID: 380)
      • cmd.exe (PID: 6952)

    • Application launched itself

      • cmd.exe (PID: 6952)
      • powershell.exe (PID: 5400)

    • Suspicious file concatenation

      • cmd.exe (PID: 6304)

    • The executable file from the user directory is run by the CMD process

      • Bush.pif (PID: 4956)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 6952)

    • Starts POWERSHELL.EXE for commands execution

      • SputterPork.pif (PID: 852)
      • powershell.exe (PID: 5400)

    • The process executes Powershell scripts

      • SputterPork.pif (PID: 852)

    • Suspicious use of NETSH.EXE

      • 7HWPG83MJZ3TS6MJALG.exe (PID: 7092)

    • Script adds exclusion path to Windows Defender

      • powershell.exe (PID: 5400)

  • INFO

    • Reads Environment values

      • Setup.exe (PID: 2112)
      • Setup.tmp (PID: 7204)
      • Setup.exe (PID: 6348)
      • Setup.tmp (PID: 1540)

    • Create files in a temporary directory

      • Setup.exe (PID: 2112)
      • Setup.tmp (PID: 7204)
      • Setup.exe (PID: 6348)
      • Setup.tmp (PID: 1540)
      • more.com (PID: 380)
      • IDRBackup.exe (PID: 6484)

    • Reads the computer name

      • Setup.tmp (PID: 7204)
      • Setup.tmp (PID: 1540)
      • IDRBackup.exe (PID: 6484)
      • Bt.exe (PID: 2632)
      • IDRBackup.exe (PID: 7636)
      • more.com (PID: 380)

    • Checks supported languages

      • Setup.exe (PID: 2112)
      • Setup.tmp (PID: 7204)
      • Setup.exe (PID: 6348)
      • Setup.tmp (PID: 1540)
      • DuetUpdater.exe (PID: 5400)
      • IDRBackup.exe (PID: 6484)
      • Bt.exe (PID: 2632)
      • IDRBackup.exe (PID: 7636)
      • more.com (PID: 380)

    • Process checks computer location settings

      • Setup.tmp (PID: 7204)
      • Setup.tmp (PID: 1540)

    • Creates files or folders in the user directory

      • Setup.tmp (PID: 1540)
      • DuetUpdater.exe (PID: 5400)
      • IDRBackup.exe (PID: 6484)
      • IDRBackup.exe (PID: 7636)

    • Manual execution by a user

      • cmd.exe (PID: 7604)
      • cmd.exe (PID: 1328)

    • Drops the executable file immediately after the start

      • netsh.exe (PID: 4568)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Lumma

(PID) Process(380) more.com
C2 (9)upknittsoappz.shop
callosallsaospz.shop
outpointsozp.shop
shepherdlyopzc.shop
unseaffarignsk.shop
indexterityszcoxp.shop
liernessfornicsa.shop
lariatedzugspd.shop
enormousseop.shop
(PID) Process(852) SputterPork.pif
C2 (9)upknittsoappz.shop
callosallsaospz.shop
outpointsozp.shop
shepherdlyopzc.shop
unseaffarignsk.shop
indexterityszcoxp.shop
liernessfornicsa.shop
lariatedzugspd.shop
enormousseop.shop

Amadey

(PID) Process(2720) explorer.exe
C2brasseriehub.com
Strings (123)/h9fmdW6/index.php
AVAST Software
ar:
|
av:
Bitdefender
2016
Content-Type: multipart/form-data; boundary=----
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Hkbsse.exe
2022
Rem
WinDefender
cred.dll
Programs
SYSTEM\ControlSet001\Services\BasicDisplay\Video
Norton
msi
os:
=
ComputerName
Sophos
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
clip.dll
DefaultSettings.XResolution
un:
Panda Security
lv:
rundll32.exe
2019
GET
Startup
ps1
kernel32.dll
&& Exit"
Avira
rb
/k
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
r=
d1
e0
/Plugins/
%-lu
360TotalSecurity
" && ren
cmd
-unicode-
4.41
Main
-executionpolicy remotesigned -File "
"taskkill /f /im "
brasseriehub2.com
VideoID
random
:::
GetNativeSystemInfo
pc:
sd:
&&
<c>
0123456789
zip
ESET
AVG
Powershell.exe
shell32.dll
%USERPROFILE%
------
CurrentBuild
-%lu
e2
e1
cmd /C RMDIR /s/q
Content-Disposition: form-data; name="data"; filename="
<d>
POST
" Content-Type: application/octet-stream
id:
fa94c59947
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
.jpg
--
\
st=s
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
ProgramData\
"
Content-Type: application/x-www-form-urlencoded
vs:
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
bi:
og:
rundll32
#
+++
/h9fmdW5/index.php
brasseriehub.com3
shutdown -s -t 0
/quiet
https://
SOFTWARE\Microsoft\Windows NT\CurrentVersion
DefaultSettings.YResolution
------
ProductName
\App
dll
S-%lu-
&unit=
dm:
abcdefghijklmnopqrstuvwxyz0123456789-_
/h9fmdW7/index.php
" && timeout 1 && del
\0000
cred.dll|clip.dll|
Kaspersky Lab
?scr=1
http://
brasseriehub.com
wb
Comodo
Doctor Web
exe
No Malware configuration.

TRiD

.exe | Inno Setup installer (65.1)
.exe | Win32 EXE PECompact compressed (generic) (24.6)
.dll | Win32 Dynamic Link Library (generic) (3.9)
.exe | Win32 Executable (generic) (2.6)
.exe | Win16/32 Executable Delphi generic (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:06:10 14:47:11+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 2.25
CodeSize: 685056
InitializedDataSize: 56832
UninitializedDataSize: -
EntryPoint: 0xa83bc
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 3.4030.15.3
ProductVersionNumber: 3.4030.15.3
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: armory Setup
FileVersion: 3.4030.15.3
LegalCopyright:
OriginalFileName:
ProductName: armory
ProductVersion: 3.4030.15.3
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
184
Monitored processes
41
Malicious processes
14
Suspicious processes
2

Behavior graph

Click at the process to see the details
start setup.exe setup.tmp setup.exe setup.tmp duetupdater.exe conhost.exe no specs idrbackup.exe idrbackup.exe bt.exe no specs slui.exe no specs #LUMMA more.com conhost.exe no specs #LUMMA sputterpork.pif w1s9mnq9vi0vc3t1.exe no specs cmd.exe conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs bush.pif timeout.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs 7hwpg83mjz3ts6mjalg.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs #HIJACKLOADER netsh.exe conhost.exe no specs powershell.exe conhost.exe no specs #AMADEY explorer.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
380C:\WINDOWS\SysWOW64\more.comC:\Windows\SysWOW64\more.com
IDRBackup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
More Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\more.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Lumma
(PID) Process(380) more.com
C2 (9)upknittsoappz.shop
callosallsaospz.shop
outpointsozp.shop
shepherdlyopzc.shop
unseaffarignsk.shop
indexterityszcoxp.shop
liernessfornicsa.shop
lariatedzugspd.shop
enormousseop.shop
620\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
636\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
852C:\Users\admin\AppData\Local\Temp\SputterPork.pifC:\Users\admin\AppData\Local\Temp\SputterPork.pif
more.com
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Lumma
(PID) Process(852) SputterPork.pif
C2 (9)upknittsoappz.shop
callosallsaospz.shop
outpointsozp.shop
shepherdlyopzc.shop
unseaffarignsk.shop
indexterityszcoxp.shop
liernessfornicsa.shop
lariatedzugspd.shop
enormousseop.shop
1328cmd /k echo [InternetShortcut] > "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TradeTokenElite.url" & echo URL="C:\Users\admin\AppData\Local\TradeToken Elite Innovations Inc\TradeTokenElite.js" >> "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TradeTokenElite.url" & exitC:\Windows\SysWOW64\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
1540"C:\Users\admin\AppData\Local\Temp\is-3K01N.tmp\Setup.tmp" /SL5="$A0262,4605518,742912,C:\Users\admin\AppData\Local\Temp\Setup.exe" /VERYSILENTC:\Users\admin\AppData\Local\Temp\is-3K01N.tmp\Setup.tmp
Setup.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-3k01n.tmp\setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\mpr.dll
1596findstr /V "DEUTSCHCOMEDYCONDITIONSMINDS" Clips C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
1668\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
2112"C:\Users\admin\AppData\Local\Temp\Setup.exe" C:\Users\admin\AppData\Local\Temp\Setup.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
armory Setup
Exit code:
1
Version:
3.4030.15.3
Modules
Images
c:\users\admin\appdata\local\temp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
2632C:\Users\admin\AppData\Roaming\Gnr\STPZTGKNGEBVJKUPQMW\Bt.exeC:\Users\admin\AppData\Roaming\Gnr\STPZTGKNGEBVJKUPQMW\Bt.exe—IDRBackup.exe
User:
admin
Company:
aaa
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00
Modules
Images
c:\users\admin\appdata\roaming\gnr\stpztgkngebvjkupqmw\bt.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
Total events
8 150
Read events
8 116
Write events
24
Delete events
10

Modification events

(PID) Process:(7204) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
241C0000FE37124E31DCDA01
(PID) Process:(7204) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
7CEBF7E5C6920EF8FAFAB0E74B8EEA513A105ECACCF4F7CC2BEF55A39F493E75
(PID) Process:(7204) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(7204) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(7204) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(7204) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(7204) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(7204) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:delete valueName:Sequence
Value:

(PID) Process:(7204) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:delete valueName:SessionHash
Value:
鋆﫺蹋凪်쩞쳷ꍕ䦟甾
(PID) Process:(7204) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:delete valueName:Owner
Value:
ᰤ
Executable files
31
Suspicious files
44
Text files
19
Unknown types
2

Dropped files

PID
Process
Filename
Type
7204Setup.tmpC:\Users\admin\AppData\Local\Temp\is-Q0JMD.tmp\_isetup\_iscrypt.dllexecutable
MD5:47CFD05FDE4BABE79530C7EA730F6DC0
SHA256:4BB34FE74F86AB389763863EE395A93D73E2D9548C224819EC9055D7C8C4B480
7204Setup.tmpC:\Users\admin\AppData\Local\Temp\is-Q0JMD.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
1540Setup.tmpC:\Users\admin\AppData\Local\armory\is-SE2F4.tmpcompressed
MD5:28990BBF95718C51EA909A659FBDA61B
SHA256:871B73751A7B2AB7A3F7FDBEEB456FAD499D5EEBCB1641F6C45F3E5307253869
1540Setup.tmpC:\Users\admin\AppData\Local\Temp\is-HP7LH.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
2112Setup.exeC:\Users\admin\AppData\Local\Temp\is-C06JU.tmp\Setup.tmpexecutable
MD5:8F5B7030ACFF469053674E18C2A98FAE
SHA256:8C5377E5B6DD221E61EBB70F5788EF5410291AE691BE5E75AB1A182AFDFA7B76
1540Setup.tmpC:\Users\admin\AppData\Local\Temp\is-HP7LH.tmp\is-O9D58.tmpexecutable
MD5:E84B92F608DB288AFCC12C5FE341B6C7
SHA256:F6C80D7C6AB6BA91CC24E12AA71C5290CA095E0842AE59A460AD71522039DEB3
5400DuetUpdater.exeC:\Users\admin\AppData\Local\armory\sqlite3.dllexecutable
MD5:9D255E04106BA7DCBD0BCB549E9A5A4E
SHA256:02F37A8E3D1790AC90C04BC50DE73CD1A93E27CAF833A1E1211B9CC6294ECEE5
1540Setup.tmpC:\Users\admin\AppData\Local\Temp\is-HP7LH.tmp\_isetup\_iscrypt.dllexecutable
MD5:47CFD05FDE4BABE79530C7EA730F6DC0
SHA256:4BB34FE74F86AB389763863EE395A93D73E2D9548C224819EC9055D7C8C4B480
1540Setup.tmpC:\Users\admin\AppData\Local\Temp\is-HP7LH.tmp\DuetUpdater.exeexecutable
MD5:E84B92F608DB288AFCC12C5FE341B6C7
SHA256:F6C80D7C6AB6BA91CC24E12AA71C5290CA095E0842AE59A460AD71522039DEB3
5400DuetUpdater.exeC:\Users\admin\AppData\Local\armory\madexcept_.bplexecutable
MD5:21068DFD733435C866312D35B9432733
SHA256:835F1141ECE59C36B18E76927572D229136AEB12EFF44CB4BA98D7808257C299
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
46
DNS requests
23
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
502
104.21.31.79:80
http://brasseriehub2.com/h9fmdW6/index.php
unknown
—
—
—
—
—
POST
502
45.140.19.240:80
http://brasseriehub.com/h9fmdW5/index.php
unknown
—
—
—
—
—
POST
502
104.21.31.79:80
http://brasseriehub2.com/h9fmdW6/index.php
unknown
—
—
—
—
—
POST
502
45.140.19.240:80
http://brasseriehub.com/h9fmdW5/index.php
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4716
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5620
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
7856
svchost.exe
4.208.221.206:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
—
—
40.113.103.199:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2760
svchost.exe
40.113.103.199:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2992
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4716
svchost.exe
20.190.159.23:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown

DNS requests

Domain
IP
Reputation
login.live.com
  • 20.190.159.75
  • 20.190.159.23
  • 20.190.159.4
  • 40.126.31.73
  • 20.190.159.2
  • 40.126.31.69
  • 40.126.31.67
  • 20.190.159.73
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.142
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
fd.api.iris.microsoft.com
  • 20.103.156.88
whitelisted
www.bing.com
  • 104.126.37.145
  • 104.126.37.137
  • 104.126.37.131
  • 104.126.37.146
  • 104.126.37.155
  • 104.126.37.153
  • 104.126.37.147
  • 104.126.37.152
  • 104.126.37.161
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
  • 52.165.165.26
whitelisted
enormousseop.shop
  • 172.67.138.215
  • 104.21.89.80
unknown
pwarticles.xyz
  • 188.114.97.3
  • 188.114.96.3
unknown

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO Pastebin Service Domain in DNS Lookup (rentry .co)
—
—
Misc activity
ET INFO Observed Pastebin Service Domain (rentry .co in TLS SNI)
—
—
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
—
—
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Setup.exe