File name:	2025-05-17_41eb0b74281580cf6b30539bfcb3cc9d_amadey_elex_smoke-loader_stealc_tofsee
Full analysis:	https://app.any.run/tasks/bca2298b-2ab3-4736-abf2-afb9f6437200
Verdict:	Malicious activity
Threats:	A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet. A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. Phorpiex is a malicious software that has been a significant threat in the cybersecurity landscape since 2016. It is a modular malware known for its ability to maintain an extensive botnet. Unlike other botnets, Phorpiex does not concentrate on DDoS attacks. Instead, it has been involved in numerous large-scale spam email campaigns and the distribution of other malicious payloads, such as LockBit. Malware Trends Tracker >>>
Analysis date:	May 17, 2025, 23:28:04
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	loader auto-reg botnet phorpiex
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:	41EB0B74281580CF6B30539BFCB3CC9D
SHA1:	D6B39737670707D56572E0B2A91D0514D4A78BE7
SHA256:	85632CA2BCBAD0D652167CF81C5B6F510FF90EE4C1F1B7C216CB1EC1FDF222C5
SSDEEP:	49152:RIyyflIGwuJlZ/koJ2LdbHDdEQwWiS4G1RlTnVVi9jA4xOCQ6l7/1gPBkNP2zEDh:uyiyTu7xR2LdbHDhwPsRlTVojA4xOCFO

.exe	\|	Win64 Executable (generic) (64.6)
.dll	\|	Win32 Dynamic Link Library (generic) (15.4)
.exe	\|	Win32 Executable (generic) (10.5)
.exe	\|	Generic Win/DOS Executable (4.6)
.exe	\|	DOS Executable Generic (4.6)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	1970:01:01 15:50:05+00:00
ImageFileCharacteristics:	Executable, Large address aware, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	160256
InitializedDataSize:	29184
UninitializedDataSize:	-
EntryPoint:	0x35000
OSVersion:	5.1
ImageVersion:	10
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	4.7.3081.0
ProductVersionNumber:	4.7.3081.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Win32
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	English (U.S.)
CharacterSet:	Unicode
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft .NET Framework 4.7.2 Setup
FileVersion:	4.7.03081.00
InternalName:	NDP472-KB4054531-Web.exe
LegalCopyright:	© Microsoft Corporation. All rights reserved.
OriginalFileName:	NDP472-KB4054531-Web.exe
ProductName:	Microsoft .NET Framework 4.7.2
ProductVersion:	4.7.03081.00


(PID) Process:	(7724) 2025-05-17_41eb0b74281580cf6b30539bfcb3cc9d_amadey_elex_smoke-loader_stealc_tofsee.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(7724) 2025-05-17_41eb0b74281580cf6b30539bfcb3cc9d_amadey_elex_smoke-loader_stealc_tofsee.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(7724) 2025-05-17_41eb0b74281580cf6b30539bfcb3cc9d_amadey_elex_smoke-loader_stealc_tofsee.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:
(PID) Process:	(7792) C93D.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(7792) C93D.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(7792) C93D.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:
(PID) Process:	(8032) 1247726186.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:	write	Name:	Windows Settings
Value: C:\WINDOWS\syscrondvr.exe
(PID) Process:	(8156) syscrondvr.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(8156) syscrondvr.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(8156) syscrondvr.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:

PID	Process	Filename		Type
7792	C93D.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\newtpp[1].exe		executable
		MD5:F30FDBF3448F67CBC3566F31729CB7A6	SHA256:3A902ABB21D204ED6A0776789C9661F8B98E561FD0CA661EE37A7D8BD079E57B
7724	2025-05-17_41eb0b74281580cf6b30539bfcb3cc9d_amadey_elex_smoke-loader_stealc_tofsee.exe	C:\Users\admin\AppData\Local\Temp\dd_2025-05-17_41eb0b74281580cf6b30539bfcb3cc9d_amadey_elex_smoke-loader_stealc_tofsee_decompression_log.txt		csv
		MD5:190D84FDA84F4F407899A994DAF25507	SHA256:5F7C16117A5E95139BEED4C3B6623FF50CE51726E74C3013BE07DE79010EE174
8032	1247726186.exe	C:\Windows\syscrondvr.exe		executable
		MD5:F30FDBF3448F67CBC3566F31729CB7A6	SHA256:3A902ABB21D204ED6A0776789C9661F8B98E561FD0CA661EE37A7D8BD079E57B
8156	syscrondvr.exe	C:\Users\admin\tbtnds.dat		binary
		MD5:0B6A7549C1F0CD8FB602D52A391BF518	SHA256:C2412332AB89B51A12ACFA4E37CB071CD10AF1950883DC98B2EF93777C7858A9
7724	2025-05-17_41eb0b74281580cf6b30539bfcb3cc9d_amadey_elex_smoke-loader_stealc_tofsee.exe	C:\Users\admin\AppData\Local\Temp\C93D.exe		executable
		MD5:0EC46393976EB51F307CC11D80BAE845	SHA256:9175BA77AC91AFDC513CA64788A72BF12915247F64BB1F95C06B5A1938FA4A84
7792	C93D.exe	C:\Users\admin\AppData\Local\Temp\1247726186.exe		executable
		MD5:F30FDBF3448F67CBC3566F31729CB7A6	SHA256:3A902ABB21D204ED6A0776789C9661F8B98E561FD0CA661EE37A7D8BD079E57B
7724	2025-05-17_41eb0b74281580cf6b30539bfcb3cc9d_amadey_elex_smoke-loader_stealc_tofsee.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\32[1].exe		executable
		MD5:0EC46393976EB51F307CC11D80BAE845	SHA256:9175BA77AC91AFDC513CA64788A72BF12915247F64BB1F95C06B5A1938FA4A84

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
2104	svchost.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
7792	C93D.exe	GET	200	185.156.72.39:80	http://185.156.72.39/newtpp.exe	unknown	—	—	malicious
8052	SIHClient.exe	GET	200	2.16.168.114:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl	unknown	—	—	whitelisted
8156	syscrondvr.exe	GET	404	185.156.72.39:80	http://185.156.72.39/2	unknown	—	—	malicious
7724	2025-05-17_41eb0b74281580cf6b30539bfcb3cc9d_amadey_elex_smoke-loader_stealc_tofsee.exe	GET	200	185.156.72.39:80	http://185.156.72.39/32.exe	unknown	—	—	malicious
2104	svchost.exe	GET	200	104.124.11.17:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
8156	syscrondvr.exe	GET	404	185.156.72.39:80	http://185.156.72.39/5	unknown	—	—	malicious
7792	C93D.exe	GET	200	185.156.72.39:80	http://185.156.72.39/peinstall.php	unknown	—	—	malicious
8052	SIHClient.exe	GET	200	2.23.246.101:80	http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl	unknown	—	—	whitelisted
8052	SIHClient.exe	GET	200	2.16.168.114:80	http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl	unknown	—	—	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
2104	svchost.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
—	—	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
3216	svchost.exe	172.211.123.249:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	FR	whitelisted
7724	2025-05-17_41eb0b74281580cf6b30539bfcb3cc9d_amadey_elex_smoke-loader_stealc_tofsee.exe	185.156.72.39:80	—	Tov Vaiz Partner	RU	malicious
2104	svchost.exe	104.124.11.17:80	crl.microsoft.com	Akamai International B.V.	DE	unknown
2104	svchost.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
6544	svchost.exe	40.126.32.74:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
2104	svchost.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	51.104.136.2 51.124.78.146 20.73.194.208	whitelisted
google.com	142.250.185.174	whitelisted
client.wns.windows.com	172.211.123.249 172.211.123.250	whitelisted
crl.microsoft.com	104.124.11.17 104.124.11.58 2.16.168.114 2.16.168.124	whitelisted
www.microsoft.com	95.101.149.131 2.23.246.101	whitelisted
login.live.com	40.126.32.74 20.190.160.66 20.190.160.20 20.190.160.131 40.126.32.140 20.190.160.2 20.190.160.5 20.190.160.22	whitelisted
slscr.update.microsoft.com	4.245.163.56	whitelisted
fe3cr.delivery.mp.microsoft.com	13.95.31.18	whitelisted
activation-v2.sls.microsoft.com	20.83.72.98	whitelisted
nexusrules.officeapps.live.com	52.111.229.19	whitelisted

PID	Process	Class	Message
7724	2025-05-17_41eb0b74281580cf6b30539bfcb3cc9d_amadey_elex_smoke-loader_stealc_tofsee.exe	A Network Trojan was detected	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
7724	2025-05-17_41eb0b74281580cf6b30539bfcb3cc9d_amadey_elex_smoke-loader_stealc_tofsee.exe	Potentially Bad Traffic	ET INFO Executable Download from dotted-quad Host
7724	2025-05-17_41eb0b74281580cf6b30539bfcb3cc9d_amadey_elex_smoke-loader_stealc_tofsee.exe	A Network Trojan was detected	ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
7724	2025-05-17_41eb0b74281580cf6b30539bfcb3cc9d_amadey_elex_smoke-loader_stealc_tofsee.exe	A Network Trojan was detected	ET MALWARE Possible Malicious Macro DL EXE Feb 2016
7792	C93D.exe	Potentially Bad Traffic	ET INFO Executable Download from dotted-quad Host
7792	C93D.exe	Potential Corporate Privacy Violation	ET INFO PE EXE or DLL Windows file download HTTP
7792	C93D.exe	Potentially Bad Traffic	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
8156	syscrondvr.exe	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Phorpiex CnC Communication
8156	syscrondvr.exe	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Phorpiex CnC Communication
8156	syscrondvr.exe	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Phorpiex CnC Communication

General Info

2025-05-17_41eb0b74281580cf6b30539bfcb3cc9d_amadey_elex_smoke-loader_stealc_tofsee

41EB0B74281580CF6B30539BFCB3CC9D

D6B39737670707D56572E0B2A91D0514D4A78BE7

85632CA2BCBAD0D652167CF81C5B6F510FF90EE4C1F1B7C216CB1EC1FDF222C5

49152:RIyyflIGwuJlZ/koJ2LdbHDdEQwWiS4G1RlTnVVi9jA4xOCQ6l7/1gPBkNP2zEDh:uyiyTu7xR2LdbHDhwPsRlTVojA4xOCFO

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Executing a file with an untrusted certificate

Changes the autorun value in the registry

PHORPIEX has been detected (YARA)

PHORPIEX has been detected (SURICATA)

Connects to the CnC server

SUSPICIOUS

Process drops legitimate windows executable

Executable content was dropped or overwritten

Starts a Microsoft application from unusual location

Reads security settings of Internet Explorer

Connects to the server without a host name

Process requests binary or script from the Internet

Connects to unusual port

Potential Corporate Privacy Violation

Contacting a server suspected of hosting an CnC

Starts itself from another location

INFO

The sample compiled with english language support

Create files in a temporary directory

Checks supported languages

Reads the computer name

Checks proxy server information

Creates files or folders in the user directory

Reads the machine GUID from the registry

Auto-launch of the file from Registry key

Manual execution by a user

Reads the software policy settings

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings