File name:

2025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader

Full analysis: https://app.any.run/tasks/287579ed-b083-489c-8ba6-1b81e5e710ea
Verdict: Malicious activity
Analysis date: March 24, 2025, 16:34:45
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

74C6898C2ACCE96AE1D5B60EEF73AD40

SHA1:

F0A5A1F1FC312BE967E860810D325EC088A0B63E

SHA256:

73A91A3655261570A28F89E1364438D6FCEF3A078FCD3FDACEBD1E3AB025EAA8

SSDEEP:

98304:iefUuZuKAuf5jTF9kOefUuZuKAuf5jTFrkHVrGDYwOwjefUuZuKAuf5jTFPkOef4:y

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Starts a Microsoft application from unusual location

      • 2025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe (PID: 1164)
      • 2025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe (PID: 644)

    • Process drops legitimate windows executable

      • 2025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe (PID: 644)
      • UpdatAuto.exe (PID: 920)

    • Executing commands from a ".bat" file

      • 2025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe (PID: 644)
      • UpdatAuto.exe (PID: 920)

    • Starts CMD.EXE for commands execution

      • 2025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe (PID: 644)
      • UpdatAuto.exe (PID: 920)

    • Executable content was dropped or overwritten

      • 2025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe (PID: 644)
      • UpdatAuto.exe (PID: 920)

    • Starts itself from another location

      • 2025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe (PID: 644)

    • Creates file in the systems drive root

      • UpdatAuto.exe (PID: 920)

    • Drops 7-zip archiver for unpacking

      • 2025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe (PID: 644)

  • INFO

    • Checks supported languages

      • 2025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe (PID: 644)
      • UpdatAuto.exe (PID: 920)
      • 2025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader~4.exe (PID: 5972)

    • The sample compiled with chinese language support

      • 2025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe (PID: 644)
      • UpdatAuto.exe (PID: 920)

    • Create files in a temporary directory

      • 2025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe (PID: 644)
      • UpdatAuto.exe (PID: 920)

    • The sample compiled with english language support

      • 2025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe (PID: 644)

    • Reads the computer name

      • 2025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader~4.exe (PID: 5972)

    • Creates files in the program directory

      • UpdatAuto.exe (PID: 920)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Microsoft Visual Basic 6 (63.9)
.exe | Win32 Executable MS Visual C++ (generic) (24.3)
.dll | Win32 Dynamic Link Library (generic) (5.1)
.exe | Win32 Executable (generic) (3.5)
.exe | Generic Win/DOS Executable (1.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2007:03:12 04:30:52+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 102400
InitializedDataSize: 16384
UninitializedDataSize: -
EntryPoint: 0x27dc
OSVersion: 4
ImageVersion: 6.1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 6.1.0.0
ProductVersionNumber: 6.1.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
Comments: Windows Update Manager for NT
CompanyName: Microsoft Corporation
FileDescription: Windows Update Manager for NT
LegalCopyright: Copyright (C) Microsoft Corp. 1981-1999
ProductName: Microsoft(R) Windows (R) 2000 Operating System
FileVersion: 6.01
ProductVersion: 6.01
InternalName: INCUBUS
OriginalFileName: INCUBUS.exe
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
9
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 2025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe cmd.exe no specs conhost.exe no specs updatauto.exe cmd.exe no specs conhost.exe no specs 2025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader~4.exe no specs slui.exe no specs 2025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
644"C:\Users\admin\Desktop\2025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe" C:\Users\admin\Desktop\2025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Update Manager for NT
Version:
6.01
Modules
Images
c:\users\admin\desktop\2025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
680\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
920C:\WINDOWS\system32\UpdatAuto.exeC:\Windows\SysWOW64\UpdatAuto.exe
2025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Update Manager for NT
Version:
6.01
Modules
Images
c:\windows\syswow64\updatauto.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
1164"C:\Users\admin\Desktop\2025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe" C:\Users\admin\Desktop\2025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Update Manager for NT
Exit code:
3221226540
Version:
6.01
Modules
Images
c:\users\admin\desktop\2025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1180C:\WINDOWS\system32\cmd.exe /c C:\WINDOWS\system32\Option.batC:\Windows\SysWOW64\cmd.exe—2025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
1280\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5344C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
59722025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader~4.exeC:\Users\admin\Desktop\2025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader~4.exe—2025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Uninstaller
Version:
23.01
Modules
Images
c:\users\admin\desktop\2025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader~4.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
6184C:\WINDOWS\system32\cmd.exe /c C:\WINDOWS\system32\Option.batC:\Windows\SysWOW64\cmd.exe—UpdatAuto.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
Total events
216
Read events
216
Write events
0
Delete events
0

Modification events

No data
Executable files
11
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
920UpdatAuto.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe —
MD5:—
SHA256:—
920UpdatAuto.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe —
MD5:—
SHA256:—
920UpdatAuto.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe —
MD5:—
SHA256:—
6442025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exeC:\ntldr~6executable
MD5:7EFF6885E0F6C9CA1E9436D71604F578
SHA256:88EB4F8282B94327C71904C1C2CEB2125F8ACECCA7C6D6C87D5AA45F72EC7FD3
6442025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exeC:\Users\admin\Desktop\2025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader~4.exeexecutable
MD5:4C8159F1C8E28D279F8824E3DDBE3ED4
SHA256:6B89F4D212211E23395E25B7AAB5FACD66C843A6C7A0DABDAE59840776097677
6442025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exeC:\ntldr~8executable
MD5:7EFF6885E0F6C9CA1E9436D71604F578
SHA256:88EB4F8282B94327C71904C1C2CEB2125F8ACECCA7C6D6C87D5AA45F72EC7FD3
6442025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exeC:\Windows\SysWOW64\UpdatAuto.exeexecutable
MD5:7EFF6885E0F6C9CA1E9436D71604F578
SHA256:88EB4F8282B94327C71904C1C2CEB2125F8ACECCA7C6D6C87D5AA45F72EC7FD3
920UpdatAuto.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exeexecutable
MD5:460C37EAB0DC7156F5A5419C97F76C93
SHA256:2D2ADF1762033F6E48FF52B96B3683C23E3D13A6320618F8C8973EB1FBCAF0CF
920UpdatAuto.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exeexecutable
MD5:2C5CC7717C7503C5DC47AADA637C43B2
SHA256:7956A4DB358DB98D89891053842D4FAC8B2110215F143DC1334E7C9179C5D4B4
6442025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exeC:\Windows\SysWOW64\Option.battext
MD5:1D04ABF39E9DF55EED1D04430CC21EB8
SHA256:0BC485263CF8A962E64DB0B88F156F2A9AF1B81ECFDB1CF9111D497E85DF70F3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
17
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5364
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.142
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-03-24_74c6898c2acce96ae1d5b60eef73ad40_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader