File name:

155557f5e69e2cf0af05029b9c80d4a1.exe

Full analysis: https://app.any.run/tasks/372c18a0-8ce0-48c4-b58f-7dfb6a42791a
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: March 25, 2025, 05:41:41
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
amadey
botnet
stealer
opendir
loader
rdp
themida
gcleaner
auto
generic
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

155557F5E69E2CF0AF05029B9C80D4A1

SHA1:

E53704DE709CCBDDC75A3F2E3B854FC3A0D99C74

SHA256:

84B3819705253E706E5AD1116A32BFF8DC8F23AA355815486801BD2A22663446

SSDEEP:

98304:JnUBWHUxItgkwj4Mji/+zZsTaZIr+9b/tjFd3RFVQgaOTJXhleQTF+TxXOAIdvEr:8+g

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • AMADEY mutex has been found

      • 155557f5e69e2cf0af05029b9c80d4a1.exe (PID: 4448)
      • rapes.exe (PID: 7768)
      • rapes.exe (PID: 1676)
      • rapes.exe (PID: 6264)
    • AMADEY has been detected (SURICATA)

      • rapes.exe (PID: 6264)
    • Connects to the CnC server

      • rapes.exe (PID: 6264)
    • AMADEY has been detected (YARA)

      • rapes.exe (PID: 6264)
    • GENERIC has been found (auto)

      • a118825c43.exe (PID: 7632)
      • svchost015.exe (PID: 7960)
    • GCLEANER has been detected (SURICATA)

      • svchost015.exe (PID: 7960)
  • SUSPICIOUS

    • Reads the BIOS version

      • 155557f5e69e2cf0af05029b9c80d4a1.exe (PID: 4448)
      • a118825c43.exe (PID: 7632)
      • rapes.exe (PID: 7768)
      • rapes.exe (PID: 1676)
      • rapes.exe (PID: 6264)
    • Contacting a server suspected of hosting an CnC

      • rapes.exe (PID: 6264)
    • Reads security settings of Internet Explorer

      • 155557f5e69e2cf0af05029b9c80d4a1.exe (PID: 4448)
      • svchost015.exe (PID: 7960)
      • rapes.exe (PID: 6264)
    • Executable content was dropped or overwritten

      • 155557f5e69e2cf0af05029b9c80d4a1.exe (PID: 4448)
      • rapes.exe (PID: 6264)
      • a118825c43.exe (PID: 7632)
      • svchost015.exe (PID: 7960)
    • Starts itself from another location

      • 155557f5e69e2cf0af05029b9c80d4a1.exe (PID: 4448)
    • Potential Corporate Privacy Violation

      • rapes.exe (PID: 6264)
      • svchost015.exe (PID: 7960)
    • Process requests binary or script from the Internet

      • rapes.exe (PID: 6264)
    • There is functionality for enable RDP (YARA)

      • rapes.exe (PID: 6264)
    • The process executes via Task Scheduler

      • rapes.exe (PID: 7768)
      • rapes.exe (PID: 1676)
    • Connects to the server without a host name

      • svchost015.exe (PID: 7960)
      • rapes.exe (PID: 6264)
  • INFO

    • Reads the computer name

      • 155557f5e69e2cf0af05029b9c80d4a1.exe (PID: 4448)
      • rapes.exe (PID: 6264)
      • svchost015.exe (PID: 7960)
      • a118825c43.exe (PID: 7632)
    • Checks supported languages

      • 155557f5e69e2cf0af05029b9c80d4a1.exe (PID: 4448)
      • a118825c43.exe (PID: 7632)
      • rapes.exe (PID: 7768)
      • rapes.exe (PID: 6264)
      • svchost015.exe (PID: 7960)
      • rapes.exe (PID: 1676)
    • Create files in a temporary directory

      • rapes.exe (PID: 6264)
      • 155557f5e69e2cf0af05029b9c80d4a1.exe (PID: 4448)
      • a118825c43.exe (PID: 7632)
      • svchost015.exe (PID: 7960)
    • Creates files or folders in the user directory

      • rapes.exe (PID: 6264)
      • svchost015.exe (PID: 7960)
    • Process checks computer location settings

      • 155557f5e69e2cf0af05029b9c80d4a1.exe (PID: 4448)
      • rapes.exe (PID: 6264)
    • Themida protector has been detected

      • rapes.exe (PID: 6264)
    • The sample compiled with english language support

      • a118825c43.exe (PID: 7632)
    • Checks proxy server information

      • svchost015.exe (PID: 7960)
      • rapes.exe (PID: 6264)
    • Reads the machine GUID from the registry

      • svchost015.exe (PID: 7960)
    • Reads the software policy settings

      • slui.exe (PID: 1052)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(6264) rapes.exe
C2176.113.115.6
URLhttp://176.113.115.6/Ni9kiput/index.php
Version5.21
Options
Drop directorybb556cff4a
Drop namerapes.exe
Strings (125)ps1
og:
r=
------
.jpg
rundll32.exe
GET
/Ni9kiput/index.php
<c>
WinDefender
&&
pc:
wb
Norton
rapes.exe
ProgramData\
rundll32
Powershell.exe
/k
kernel32.dll
Sophos
random
POST
cred.dll|clip.dll|
#
un:
Bitdefender
cred.dll
/Plugins/
shell32.dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
|
Doctor Web
e3
2019
00000419
Kaspersky Lab
st=s
%USERPROFILE%
\0000
VideoID
CurrentBuild
dll
ar:
bi:
Content-Type: multipart/form-data; boundary=----
+++
Startup
Avira
ESET
" && ren
msi
------
Content-Disposition: form-data; name="data"; filename="
Main
<d>
bb556cff4a
SYSTEM\ControlSet001\Services\BasicDisplay\Video
360TotalSecurity
=
e1
rb
Comodo
?scr=1
Panda Security
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
" && timeout 1 && del
2025
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
0123456789
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Programs
00000422
lv:
e2
:::
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
SOFTWARE\Microsoft\Windows NT\CurrentVersion
dm:
AVG
DefaultSettings.YResolution
clip.dll
&unit=
AVAST Software
exe
http://
Keyboard Layout\Preload
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
cmd /C RMDIR /s/q
https://
shutdown -s -t 0
5.21
-unicode-
-executionpolicy remotesigned -File "
ComputerName
2022
--
vs:
\
sd:
d1
S-%lu-
" Content-Type: application/octet-stream
%-lu
GetNativeSystemInfo
176.113.115.6
&& Exit"
Content-Type: application/x-www-form-urlencoded
/quiet
abcdefghijklmnopqrstuvwxyz0123456789-_
ProductName
"taskkill /f /im "
00000423
Rem
zip
\App
2016
"
0000043f
os:
cmd
id:
av:
-%lu
DefaultSettings.XResolution
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:02:23 11:06:11+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 324096
InitializedDataSize: 115200
UninitializedDataSize: -
EntryPoint: 0x4c2000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
9
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 155557f5e69e2cf0af05029b9c80d4a1.exe #AMADEY rapes.exe sppextcomobj.exe no specs slui.exe #GENERIC a118825c43.exe rapes.exe no specs #GCLEANER svchost015.exe slui.exe no specs rapes.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1052"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1676"C:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exe"C:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exesvchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\bb556cff4a\rapes.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
3240C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exesvchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4448"C:\Users\admin\AppData\Local\Temp\155557f5e69e2cf0af05029b9c80d4a1.exe" C:\Users\admin\AppData\Local\Temp\155557f5e69e2cf0af05029b9c80d4a1.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\155557f5e69e2cf0af05029b9c80d4a1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6264"C:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exe" C:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exe
155557f5e69e2cf0af05029b9c80d4a1.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\bb556cff4a\rapes.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Amadey
(PID) Process(6264) rapes.exe
C2176.113.115.6
URLhttp://176.113.115.6/Ni9kiput/index.php
Version5.21
Options
Drop directorybb556cff4a
Drop namerapes.exe
Strings (125)ps1
og:
r=
------
.jpg
rundll32.exe
GET
/Ni9kiput/index.php
<c>
WinDefender
&&
pc:
wb
Norton
rapes.exe
ProgramData\
rundll32
Powershell.exe
/k
kernel32.dll
Sophos
random
POST
cred.dll|clip.dll|
#
un:
Bitdefender
cred.dll
/Plugins/
shell32.dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
|
Doctor Web
e3
2019
00000419
Kaspersky Lab
st=s
%USERPROFILE%
\0000
VideoID
CurrentBuild
dll
ar:
bi:
Content-Type: multipart/form-data; boundary=----
+++
Startup
Avira
ESET
" && ren
msi
------
Content-Disposition: form-data; name="data"; filename="
Main
<d>
bb556cff4a
SYSTEM\ControlSet001\Services\BasicDisplay\Video
360TotalSecurity
=
e1
rb
Comodo
?scr=1
Panda Security
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
" && timeout 1 && del
2025
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
0123456789
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Programs
00000422
lv:
e2
:::
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
SOFTWARE\Microsoft\Windows NT\CurrentVersion
dm:
AVG
DefaultSettings.YResolution
clip.dll
&unit=
AVAST Software
exe
http://
Keyboard Layout\Preload
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
cmd /C RMDIR /s/q
https://
shutdown -s -t 0
5.21
-unicode-
-executionpolicy remotesigned -File "
ComputerName
2022
--
vs:
\
sd:
d1
S-%lu-
" Content-Type: application/octet-stream
%-lu
GetNativeSystemInfo
176.113.115.6
&& Exit"
Content-Type: application/x-www-form-urlencoded
/quiet
abcdefghijklmnopqrstuvwxyz0123456789-_
ProductName
"taskkill /f /im "
00000423
Rem
zip
\App
2016
"
0000043f
os:
cmd
id:
av:
-%lu
DefaultSettings.XResolution
7264C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7632"C:\Users\admin\AppData\Local\Temp\10328680101\a118825c43.exe" C:\Users\admin\AppData\Local\Temp\10328680101\a118825c43.exe
rapes.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
2, 0, 4, 0
Modules
Images
c:\users\admin\appdata\local\temp\10328680101\a118825c43.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7768"C:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exe"C:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exesvchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\bb556cff4a\rapes.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
7960"C:\Users\admin\AppData\Local\Temp\10328680101\a118825c43.exe" C:\Users\admin\AppData\Local\Temp\svchost015.exe
a118825c43.exe
User:
admin
Company:
X-Ways Software Technology AG
Integrity Level:
MEDIUM
Description:
WinHex
Exit code:
0
Version:
21.1
Modules
Images
c:\users\admin\appdata\local\temp\svchost015.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
2 395
Read events
2 389
Write events
6
Delete events
0

Modification events

(PID) Process:(6264) rapes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6264) rapes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6264) rapes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7960) svchost015.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7960) svchost015.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7960) svchost015.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
8
Suspicious files
6
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
7960svchost015.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\success[1].htmbinary
MD5:CFCD208495D565EF66E7DFF9F98764DA
SHA256:5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
4448155557f5e69e2cf0af05029b9c80d4a1.exeC:\Windows\Tasks\rapes.jobbinary
MD5:FB212E263D82362B0009F251F6A56CD3
SHA256:82E8A4A1265045ACC8C94C275C8CACA15F1D8E62875F254F8EAAB71EDDB533FC
7960svchost015.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\soft[1]executable
MD5:FC1E4DF340C9005E05B8BFC96CEC9E09
SHA256:0C68AFFA8190AF92AAC6B35099F3E67659C42F6BC854A7D764A3A448EFF2CB51
7960svchost015.exeC:\Users\admin\Desktop\YCL.lnkbinary
MD5:B273C274E38ADBB65B20CAB7BC4E8DAD
SHA256:7DD1C620C40498FFFEDE10EE7E09A2BF8571477CA84D919D9136E45234DDD6AB
7960svchost015.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\dll[1]executable
MD5:2ECB51AB00C5F340380ECF849291DBCF
SHA256:F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
7960svchost015.exeC:\Users\admin\AppData\Local\Temp\rFE591ECVfZet3wG5e5G4Y\Bunifu_UI_v1.5.3.dllexecutable
MD5:2ECB51AB00C5F340380ECF849291DBCF
SHA256:F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
7960svchost015.exeC:\Users\admin\AppData\Local\Temp\rFE591ECVfZet3wG5e5G4Y\YCL.exeexecutable
MD5:FC1E4DF340C9005E05B8BFC96CEC9E09
SHA256:0C68AFFA8190AF92AAC6B35099F3E67659C42F6BC854A7D764A3A448EFF2CB51
7960svchost015.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\info[1].htmtext
MD5:FE9B08252F126DDFCB87FB82F9CC7677
SHA256:E63E7EBE4C2DB7E61FFC71AF0675E870BCDE0A9D8916E5B3BE0CB252478030BF
7960svchost015.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\fuckingdllENCR[1].dllbinary
MD5:4BC1EF6688690AF3DD8D3D70906A9F98
SHA256:7703A6B77C0B0935F5900A2D846CFA3AB59B46D03A1A0844F6BCB5CF9496B2FE
7960svchost015.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\service[1].htmbinary
MD5:CFCD208495D565EF66E7DFF9F98764DA
SHA256:5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
26
TCP/UDP connections
28
DNS requests
15
Threats
29

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
unknown
6264
rapes.exe
POST
200
176.113.115.6:80
http://176.113.115.6/Ni9kiput/index.php
unknown
unknown
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
unknown
6264
rapes.exe
GET
200
176.113.115.7:80
http://176.113.115.7/files/unique2/random.exe
unknown
unknown
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
unknown
7328
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
unknown
6264
rapes.exe
POST
200
176.113.115.6:80
http://176.113.115.6/Ni9kiput/index.php
unknown
unknown
6264
rapes.exe
POST
200
176.113.115.6:80
http://176.113.115.6/Ni9kiput/index.php
unknown
unknown
8156
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
unknown
8156
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
unknown
4628
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5496
MoUsoCoreWorker.exe
2.20.245.139:80
crl.microsoft.com
Akamai International B.V.
SE
unknown
4
System
192.168.100.255:138
unknown
5496
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6264
rapes.exe
176.113.115.6:80
Red Bytes LLC
RU
unknown
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
6544
svchost.exe
40.126.31.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
unknown
google.com
  • 142.250.185.174
unknown
crl.microsoft.com
  • 2.20.245.139
  • 2.20.245.137
unknown
client.wns.windows.com
  • 40.113.103.199
unknown
login.live.com
  • 40.126.31.131
  • 40.126.31.1
  • 40.126.31.3
  • 20.190.159.68
  • 40.126.31.67
  • 20.190.159.128
  • 40.126.31.130
  • 40.126.31.71
unknown
ocsp.digicert.com
  • 184.30.131.245
unknown
arc.msn.com
  • 20.199.58.43
unknown
slscr.update.microsoft.com
  • 4.245.163.56
unknown
www.microsoft.com
  • 2.23.246.101
unknown
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
unknown

Threats

PID
Process
Class
Message
6264
rapes.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 29
6264
rapes.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
6264
rapes.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
6264
rapes.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
6264
rapes.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
6264
rapes.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
6264
rapes.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 29
6264
rapes.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
7960
svchost015.exe
A Network Trojan was detected
LOADER [ANY.RUN] GCleaner HTTP Header
7960
svchost015.exe
A Network Trojan was detected
LOADER [ANY.RUN] GCleaner HTTP Header
No debug info