analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://www.malware-traffic-analysis.net/2019/07/25/index.html

Full analysis: https://app.any.run/tasks/16f1b2f8-8ca3-4db0-8cde-9c1086b7a3a5
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: May 20, 2022, 23:50:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
amadey
pony
fareit
Indicators:
MD5:

1673053A13F4B442EA718BACF47D6418

SHA1:

2D76416AA5C6CB180E6B410DE3FC7B616FA495BF

SHA256:

7ECEFA55F3DA3742646BD054EA05B6938BDF9CED5FDEE38251223CE5FB98D785

SSDEEP:

3:N8DSLHXWQfigcWMMLA2BKAXG5G:2OLHpJY0X8G

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 2019-07-25-Cobalt-Strike-EXE-retrieved-by-Amadey-infected-host-art.exe (PID: 452)
      • 2019-07-25-Amadey-EXE-dropped-by-VBS-files.exe (PID: 2364)
      • kntd.exe (PID: 2444)
      • 2019-07-25-Pony-EXE-retrieved-by-Amadey-infected-host-p.exe (PID: 3920)
      • XLYHZCq.exe (PID: 2888)

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 2548)
      • 2019-07-25-Amadey-EXE-dropped-by-VBS-files.exe (PID: 2364)
      • WScript.exe (PID: 3412)

    • AMADEY was detected

      • 2019-07-25-Amadey-EXE-dropped-by-VBS-files.exe (PID: 2364)

    • Changes the Startup folder

      • REG.exe (PID: 332)

    • AMADEY detected by memory dumps

      • kntd.exe (PID: 2444)

    • Steals credentials from Web Browsers

      • 2019-07-25-Pony-EXE-retrieved-by-Amadey-infected-host-p.exe (PID: 3920)

    • Detected Pony/Fareit Trojan

      • 2019-07-25-Pony-EXE-retrieved-by-Amadey-infected-host-p.exe (PID: 3920)

    • Actions looks like stealing of personal data

      • 2019-07-25-Pony-EXE-retrieved-by-Amadey-infected-host-p.exe (PID: 3920)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3100)

    • Checks supported languages

      • WinRAR.exe (PID: 2548)
      • 2019-07-25-Cobalt-Strike-EXE-retrieved-by-Amadey-infected-host-art.exe (PID: 452)
      • 2019-07-25-Amadey-EXE-dropped-by-VBS-files.exe (PID: 2364)
      • kntd.exe (PID: 2444)
      • 2019-07-25-Pony-EXE-retrieved-by-Amadey-infected-host-p.exe (PID: 3920)
      • WinRAR.exe (PID: 3112)
      • cmd.exe (PID: 432)
      • WScript.exe (PID: 3412)
      • XLYHZCq.exe (PID: 2888)
      • WScript.exe (PID: 3116)

    • Reads the computer name

      • WinRAR.exe (PID: 2548)
      • 2019-07-25-Cobalt-Strike-EXE-retrieved-by-Amadey-infected-host-art.exe (PID: 452)
      • kntd.exe (PID: 2444)
      • 2019-07-25-Pony-EXE-retrieved-by-Amadey-infected-host-p.exe (PID: 3920)
      • WinRAR.exe (PID: 3112)
      • WScript.exe (PID: 3412)
      • WScript.exe (PID: 3116)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2548)
      • 2019-07-25-Amadey-EXE-dropped-by-VBS-files.exe (PID: 2364)
      • WScript.exe (PID: 3412)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 2548)
      • 2019-07-25-Amadey-EXE-dropped-by-VBS-files.exe (PID: 2364)
      • WScript.exe (PID: 3412)

    • Starts itself from another location

      • 2019-07-25-Amadey-EXE-dropped-by-VBS-files.exe (PID: 2364)

    • Creates files in the program directory

      • 2019-07-25-Amadey-EXE-dropped-by-VBS-files.exe (PID: 2364)

    • Uses REG.EXE to modify Windows registry

      • kntd.exe (PID: 2444)

    • Application launched itself

      • WinRAR.exe (PID: 2548)

    • Loads DLL from Mozilla Firefox

      • 2019-07-25-Pony-EXE-retrieved-by-Amadey-infected-host-p.exe (PID: 3920)

    • Executes scripts

      • WinRAR.exe (PID: 3112)

    • Starts CMD.EXE for commands execution

      • 2019-07-25-Pony-EXE-retrieved-by-Amadey-infected-host-p.exe (PID: 3920)

    • Executed via WMI

      • XLYHZCq.exe (PID: 2888)

    • Searches for installed software

      • 2019-07-25-Pony-EXE-retrieved-by-Amadey-infected-host-p.exe (PID: 3920)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 1500)
      • iexplore.exe (PID: 3100)

    • Checks supported languages

      • iexplore.exe (PID: 3100)
      • iexplore.exe (PID: 1500)
      • REG.exe (PID: 332)

    • Application launched itself

      • iexplore.exe (PID: 1500)

    • Changes internet zones settings

      • iexplore.exe (PID: 1500)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 1500)
      • iexplore.exe (PID: 3100)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3100)
      • iexplore.exe (PID: 1500)
      • WScript.exe (PID: 3116)
      • WScript.exe (PID: 3412)

    • Changes settings of System certificates

      • iexplore.exe (PID: 1500)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 1500)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3100)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 1500)

    • Creates files in the user directory

      • iexplore.exe (PID: 1500)

    • Dropped object may contain Bitcoin addresses

      • WinRAR.exe (PID: 2548)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
13
Malicious processes
5
Suspicious processes
3

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe winrar.exe 2019-07-25-cobalt-strike-exe-retrieved-by-amadey-infected-host-art.exe #AMADEY 2019-07-25-amadey-exe-dropped-by-vbs-files.exe #AMADEY kntd.exe reg.exe #PONY 2019-07-25-pony-exe-retrieved-by-amadey-infected-host-p.exe cmd.exe no specs winrar.exe no specs wscript.exe xlyhzcq.exe wscript.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1500"C:\Program Files\Internet Explorer\iexplore.exe" "https://www.malware-traffic-analysis.net/2019/07/25/index.html"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3100"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1500 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\iertutil.dll
2548"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\2019-07-25-Hancitor-style-Amadey-emails-and-associated-malware.zip"C:\Program Files\WinRAR\WinRAR.exe
iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
452"C:\Users\admin\AppData\Local\Temp\Rar$EXb2548.35804\malware-from-infected-Windows-host\2019-07-25-Cobalt-Strike-EXE-retrieved-by-Amadey-infected-host-art.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2548.35804\malware-from-infected-Windows-host\2019-07-25-Cobalt-Strike-EXE-retrieved-by-Amadey-infected-host-art.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1768843639
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb2548.35804\malware-from-infected-windows-host\2019-07-25-cobalt-strike-exe-retrieved-by-amadey-infected-host-art.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wininet.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
2364"C:\Users\admin\AppData\Local\Temp\Rar$EXb2548.38222\malware-from-infected-Windows-host\2019-07-25-Amadey-EXE-dropped-by-VBS-files.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2548.38222\malware-from-infected-Windows-host\2019-07-25-Amadey-EXE-dropped-by-VBS-files.exe
WinRAR.exe
User:
admin
Company:
Creative Technology Limited
Integrity Level:
MEDIUM
Description:
ReadReg MFC Application
Exit code:
0
Version:
2, 0, 0, 2
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb2548.38222\malware-from-infected-windows-host\2019-07-25-amadey-exe-dropped-by-vbs-files.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2444c:\programdata\d409470c6b\kntd.exec:\programdata\d409470c6b\kntd.exe
2019-07-25-Amadey-EXE-dropped-by-VBS-files.exe
User:
admin
Company:
Creative Technology Limited
Integrity Level:
MEDIUM
Description:
ReadReg MFC Application
Version:
2, 0, 0, 2
Modules
Images
c:\programdata\d409470c6b\kntd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
332REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\d409470c6bC:\Windows\system32\REG.exe
kntd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3920"C:\Users\admin\AppData\Local\Temp\Rar$EXb2548.39449\malware-from-infected-Windows-host\2019-07-25-Pony-EXE-retrieved-by-Amadey-infected-host-p.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2548.39449\malware-from-infected-Windows-host\2019-07-25-Pony-EXE-retrieved-by-Amadey-infected-host-p.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb2548.39449\malware-from-infected-windows-host\2019-07-25-pony-exe-retrieved-by-amadey-infected-host-p.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
432cmd /KC:\Windows\system32\cmd.exe—2019-07-25-Pony-EXE-retrieved-by-Amadey-infected-host-p.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3112"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIb2548.40671\12928130497_878408533.zipC:\Program Files\WinRAR\WinRAR.exe—WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\comdlg32.dll
Total events
22 088
Read events
21 841
Write events
0
Delete events
0

Modification events

No data
Executable files
18
Suspicious files
42
Text files
43
Unknown types
187

Dropped files

PID
Process
Filename
Type
3100iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Eder
MD5:C04F441D0220712231531A90823834DB
SHA256:055641D3987AE98E2DD627D3214EA8084AE773A3DF9592191B86977C752A29E7
3100iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dder
MD5:93995AD095112907CFC088998C161574
SHA256:FD16D238BCAC3441688E7CA940C27BB02DF8F0BF43B26D8E551414A18748C1CC
3100iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2A249A8EAE5FF8B677AA8B178688CF94der
MD5:D71BCC80A7B0FC9612D7B4619FB2C2AE
SHA256:B7C991C3B5997CDA961B68B8D3BF0597BC0A9B4805810FC2AFD1A061DD67953B
1500iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8Fder
MD5:5C1113B7526A7723B64400D44129FA78
SHA256:9ECC27C740862AB2712DA2C4FF31592E2C0A8643576E64551EE344A73FBE2494
3100iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:BED8FA3310113E9F1435B810CCA9E32C
SHA256:455BBDF0E1207246F65BDDD441D0ADD5E4560F7227AB63832AFFA9232AC0803D
3100iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:F6D1FF6DBED4F3BB38DA18FA93B5B00F
SHA256:1B5BFD8DEECD090CCFC1D6CE07674AF9F69BC07EDB7A873954F2C6A537EDAAB0
3100iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dbinary
MD5:CDA0342F9D925BE672DA43C6DECDE0DC
SHA256:D181A828AABE6116F05EE940C04251877AC3FFD32B698939DFB4962706B65632
3100iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2A249A8EAE5FF8B677AA8B178688CF94binary
MD5:144540C2A49B9E345DDA4D9069139184
SHA256:592054F174ADF5EDB0CDD1E1BBFD22EEB806DCFA828EC263A91C1DF177F7BA73
3100iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\index[1].htmhtml
MD5:B77E0C42D87CBA508542663F3DF75616
SHA256:DB05D4A2E2D1ECF3D81C0F1C589B802674CC7D6C463AE88F0506C398CA2B5A0F
1500iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8Fbinary
MD5:5BB7133FBF5FDCA59FB7266441047A80
SHA256:FB2C38B0C4892C66526BAA8B7E58C0268206197572130AC511BB8293B396AEE6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
27
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3100
iexplore.exe
GET
200
104.18.32.68:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
3100
iexplore.exe
GET
200
104.18.32.68:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECECrsM%2B7Sq5MOuq8mZpDVUKY%3D
US
der
471 b
whitelisted
3100
iexplore.exe
GET
200
104.18.32.68:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
452
2019-07-25-Cobalt-Strike-EXE-retrieved-by-Amadey-infected-host-art.exe
GET
—
31.44.184.33:80
http://31.44.184.33/H7mp
RU
—
—
malicious
1500
iexplore.exe
GET
200
93.184.220.29:80
http://crl3.digicert.com/Omniroot2025.crl
US
der
7.78 Kb
whitelisted
3100
iexplore.exe
GET
200
23.216.77.69:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b14c99519f4e922c
US
compressed
4.70 Kb
whitelisted
1500
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
3100
iexplore.exe
GET
200
23.216.77.69:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?25ecb450f1085071
US
compressed
4.70 Kb
whitelisted
1500
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1500
iexplore.exe
152.199.19.161:443
r20swj13mr.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3100
iexplore.exe
199.201.110.204:443
www.malware-traffic-analysis.net
Namecheap, Inc.
US
suspicious
1500
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3100
iexplore.exe
104.18.32.68:80
ocsp.comodoca.com
Cloudflare Inc
US
suspicious
1500
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
1500
iexplore.exe
199.201.110.204:443
www.malware-traffic-analysis.net
Namecheap, Inc.
US
suspicious
3100
iexplore.exe
23.216.77.69:80
ctldl.windowsupdate.com
NTT DOCOMO, INC.
US
suspicious
—
—
96.16.143.41:443
go.microsoft.com
Akamai International B.V.
US
whitelisted
—
—
204.79.197.203:443
www.msn.com
Microsoft Corporation
US
whitelisted
1500
iexplore.exe
20.25.53.147:443
query.prod.cms.msn.com
—
US
unknown

DNS requests

Domain
IP
Reputation
www.malware-traffic-analysis.net
  • 199.201.110.204
malicious
ctldl.windowsupdate.com
  • 23.216.77.69
  • 23.216.77.80
whitelisted
ocsp.comodoca.com
  • 104.18.32.68
  • 172.64.155.188
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ocsp.usertrust.com
  • 104.18.32.68
  • 172.64.155.188
whitelisted
ocsp.sectigo.com
  • 104.18.32.68
  • 172.64.155.188
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
crl3.digicert.com
  • 93.184.220.29
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted

Threats

No threats detected
Process
Message
2019-07-25-Cobalt-Strike-EXE-retrieved-by-Amadey-infected-host-art.exe
G8xv
2019-07-25-Amadey-EXE-dropped-by-VBS-files.exe
zI
kntd.exe
zI
XLYHZCq.exe
zI
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.malware-traffic-analysis.net/2019/07/25/index.html