File name:

GM2SC_random.exe

Full analysis: https://app.any.run/tasks/c7fec258-5432-4d13-b493-6ae5861f665e
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: January 18, 2025, 17:19:17
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
amadey
botnet
stealer
loader
stealc
themida
lumma
credentialflusher
gcleaner
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

FA93EE30BA0FF259954673B85347CF2E

SHA1:

A1EA1E175E4585FCB0345EF5A00D4B047384DD73

SHA256:

8E04D767B94A24732BE0868059F2D2FD09B86E73FAEF0C753E8AA6B604630CED

SSDEEP:

98304:Il4fERgKGmsltDOVCcYDeDIT48QWJ8dpt1HDfrHtj9azvT1K83HyB63s3xsJT6Ho:pOp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AMADEY mutex has been found

      • axplong.exe (PID: 4244)
      • GM2SC_random.exe (PID: 3140)
      • 571439c8b1.exe (PID: 3208)
      • skotes.exe (PID: 2076)
      • axplong.exe (PID: 4420)
      • skotes.exe (PID: 7220)
      • ITM0U1Z0EXRLGHCZOSI.exe (PID: 3260)
      • axplong.exe (PID: 2736)
      • skotes.exe (PID: 6376)

    • Connects to the CnC server

      • axplong.exe (PID: 4244)
      • aeb8a77c3e.exe (PID: 5464)
      • svchost.exe (PID: 2192)
      • skotes.exe (PID: 2076)
      • 021949f0ac.exe (PID: 6296)
      • 6IVKF7BMMT9QKW7O.exe (PID: 5872)

    • AMADEY has been detected (SURICATA)

      • axplong.exe (PID: 4244)
      • skotes.exe (PID: 2076)

    • Changes the autorun value in the registry

      • axplong.exe (PID: 4244)
      • skotes.exe (PID: 2076)

    • StealC has been detected

      • aeb8a77c3e.exe (PID: 5464)
      • 021949f0ac.exe (PID: 6296)
      • 6IVKF7BMMT9QKW7O.exe (PID: 5872)

    • STEALC has been detected (SURICATA)

      • aeb8a77c3e.exe (PID: 5464)
      • 021949f0ac.exe (PID: 6296)
      • 6IVKF7BMMT9QKW7O.exe (PID: 5872)

    • AMADEY has been detected (YARA)

      • axplong.exe (PID: 4244)
      • skotes.exe (PID: 2076)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2192)
      • f2560da6b4.exe (PID: 7812)

    • LUMMA mutex has been found

      • 54d9e0f2b2.exe (PID: 4512)
      • c2a795d497.exe (PID: 6076)
      • f2560da6b4.exe (PID: 7812)
      • 84d8863aac.exe (PID: 6844)

    • Steals credentials from Web Browsers

      • c2a795d497.exe (PID: 6076)
      • 54d9e0f2b2.exe (PID: 4512)
      • f2560da6b4.exe (PID: 7812)
      • 84d8863aac.exe (PID: 6844)

    • Actions looks like stealing of personal data

      • c2a795d497.exe (PID: 6076)
      • 54d9e0f2b2.exe (PID: 4512)
      • f2560da6b4.exe (PID: 7812)
      • 84d8863aac.exe (PID: 6844)

    • Possible tool for stealing has been detected

      • 03c656ca1f.exe (PID: 6448)
      • firefox.exe (PID: 7088)

    • LUMMA has been detected (YARA)

      • c2a795d497.exe (PID: 6076)
      • 54d9e0f2b2.exe (PID: 4512)

    • GCLEANER has been detected (SURICATA)

      • 969778179c.exe (PID: 848)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 7896)

    • Changes powershell execution policy (Bypass)

      • c2a795d497.exe (PID: 6076)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 7024)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 3696)

    • Request from PowerShell that ran from MSHTA.EXE

      • powershell.exe (PID: 3696)

    • Executing a file with an untrusted certificate

      • eda85f68f1.exe (PID: 8160)
      • servicebrowserv5.exe (PID: 5092)

    • Script downloads file (POWERSHELL)

      • powershell.exe (PID: 3696)

    • Disables Windows Defender

      • 483d2fa8a0d53818306efeb32d3.exe (PID: 6288)

    • Changes the Windows auto-update feature

      • 483d2fa8a0d53818306efeb32d3.exe (PID: 6288)

  • SUSPICIOUS

    • Reads the BIOS version

      • GM2SC_random.exe (PID: 3140)
      • axplong.exe (PID: 4244)
      • aeb8a77c3e.exe (PID: 5464)
      • 571439c8b1.exe (PID: 3208)
      • skotes.exe (PID: 2076)
      • 969778179c.exe (PID: 848)
      • c2a795d497.exe (PID: 6076)
      • 54d9e0f2b2.exe (PID: 4512)
      • 021949f0ac.exe (PID: 6296)
      • axplong.exe (PID: 4420)
      • skotes.exe (PID: 7220)
      • 6IVKF7BMMT9QKW7O.exe (PID: 5872)
      • ITM0U1Z0EXRLGHCZOSI.exe (PID: 3260)
      • 483d2fa8a0d53818306efeb32d3.exe (PID: 6288)
      • skotes.exe (PID: 6376)
      • axplong.exe (PID: 2736)

    • Reads security settings of Internet Explorer

      • axplong.exe (PID: 4244)
      • GM2SC_random.exe (PID: 3140)
      • aeb8a77c3e.exe (PID: 5464)
      • 571439c8b1.exe (PID: 3208)
      • skotes.exe (PID: 2076)
      • 021949f0ac.exe (PID: 6296)
      • fef09d218e.exe (PID: 6876)
      • 969778179c.exe (PID: 848)
      • mobilemediaplayer5.exe (PID: 8116)
      • 6IVKF7BMMT9QKW7O.exe (PID: 5872)

    • Potential Corporate Privacy Violation

      • axplong.exe (PID: 4244)
      • skotes.exe (PID: 2076)
      • 969778179c.exe (PID: 848)
      • 54d9e0f2b2.exe (PID: 4512)
      • powershell.exe (PID: 3696)

    • Contacting a server suspected of hosting an CnC

      • axplong.exe (PID: 4244)
      • aeb8a77c3e.exe (PID: 5464)
      • skotes.exe (PID: 2076)
      • svchost.exe (PID: 2192)
      • 021949f0ac.exe (PID: 6296)
      • 6IVKF7BMMT9QKW7O.exe (PID: 5872)

    • Executable content was dropped or overwritten

      • axplong.exe (PID: 4244)
      • GM2SC_random.exe (PID: 3140)
      • 571439c8b1.exe (PID: 3208)
      • skotes.exe (PID: 2076)
      • 969778179c.exe (PID: 848)
      • vx72NG3gHzoM.exe (PID: 7948)
      • vx72NG3gHzoM.tmp (PID: 7968)
      • mobilemediaplayer5.exe (PID: 8116)
      • 54d9e0f2b2.exe (PID: 4512)
      • powershell.exe (PID: 3696)
      • eda85f68f1.exe (PID: 8160)
      • eda85f68f1.tmp (PID: 8144)
      • Adobe QT32 Server.exe (PID: 7012)
      • cmd.exe (PID: 7772)

    • Connects to the server without a host name

      • axplong.exe (PID: 4244)
      • aeb8a77c3e.exe (PID: 5464)
      • skotes.exe (PID: 2076)
      • 021949f0ac.exe (PID: 6296)
      • 969778179c.exe (PID: 848)
      • 54d9e0f2b2.exe (PID: 4512)
      • 6IVKF7BMMT9QKW7O.exe (PID: 5872)
      • powershell.exe (PID: 3696)

    • Process requests binary or script from the Internet

      • axplong.exe (PID: 4244)
      • skotes.exe (PID: 2076)
      • 54d9e0f2b2.exe (PID: 4512)
      • powershell.exe (PID: 3696)

    • Windows Defender mutex has been found

      • aeb8a77c3e.exe (PID: 5464)
      • 021949f0ac.exe (PID: 6296)
      • 6IVKF7BMMT9QKW7O.exe (PID: 5872)

    • Starts itself from another location

      • GM2SC_random.exe (PID: 3140)
      • 571439c8b1.exe (PID: 3208)
      • Adobe QT32 Server.exe (PID: 7012)

    • Searches for installed software

      • 54d9e0f2b2.exe (PID: 4512)
      • f2560da6b4.exe (PID: 7812)
      • 84d8863aac.exe (PID: 6844)

    • Uses TASKKILL.EXE to kill Browsers

      • 03c656ca1f.exe (PID: 6448)

    • Uses TASKKILL.EXE to kill process

      • 03c656ca1f.exe (PID: 6448)

    • Executing commands from a ".bat" file

      • fef09d218e.exe (PID: 6876)

    • Starts CMD.EXE for commands execution

      • fef09d218e.exe (PID: 6876)
      • cmd.exe (PID: 7024)
      • Adobe QT32 Server.exe (PID: 4872)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 7024)

    • Application launched itself

      • cmd.exe (PID: 7024)
      • f2560da6b4.exe (PID: 7736)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 6324)
      • cmd.exe (PID: 8148)
      • mobilemediaplayer5.exe (PID: 8116)
      • c2a795d497.exe (PID: 6076)
      • cmd.exe (PID: 8132)
      • mshta.exe (PID: 1620)

    • Executes application which crashes

      • f2560da6b4.exe (PID: 7736)
      • 969778179c.exe (PID: 848)

    • Probably obfuscated PowerShell command line is found

      • cmd.exe (PID: 6324)
      • cmd.exe (PID: 8148)
      • cmd.exe (PID: 8132)

    • Reads the Windows owner or organization settings

      • vx72NG3gHzoM.tmp (PID: 7968)
      • eda85f68f1.tmp (PID: 8144)

    • Process drops legitimate windows executable

      • vx72NG3gHzoM.tmp (PID: 7968)
      • eda85f68f1.tmp (PID: 8144)
      • Adobe QT32 Server.exe (PID: 7012)

    • The process drops C-runtime libraries

      • vx72NG3gHzoM.tmp (PID: 7968)
      • eda85f68f1.tmp (PID: 8144)
      • Adobe QT32 Server.exe (PID: 7012)

    • The process executes via Task Scheduler

      • skotes.exe (PID: 7220)
      • axplong.exe (PID: 4420)
      • axplong.exe (PID: 2736)
      • skotes.exe (PID: 6376)

    • The process executes Powershell scripts

      • c2a795d497.exe (PID: 6076)

    • Manipulates environment variables

      • powershell.exe (PID: 3696)

    • Starts process via Powershell

      • powershell.exe (PID: 3696)

    • Probably download files using WebClient

      • mshta.exe (PID: 1620)

    • Found IP address in command line

      • powershell.exe (PID: 3696)

    • The process creates files with name similar to system file names

      • eda85f68f1.tmp (PID: 8144)
      • Adobe QT32 Server.exe (PID: 7012)

    • Connects to unusual port

      • 93e4adf5bd.exe (PID: 1520)

    • The executable file from the user directory is run by the CMD process

      • servicebrowserv5.exe (PID: 5092)

    • Detected use of alternative data streams (AltDS)

      • servicebrowserv5.exe (PID: 5092)

    • Connects to SMTP port

      • servicebrowserv5.exe (PID: 5092)

  • INFO

    • Reads the computer name

      • GM2SC_random.exe (PID: 3140)
      • axplong.exe (PID: 4244)
      • aeb8a77c3e.exe (PID: 5464)
      • 571439c8b1.exe (PID: 3208)
      • skotes.exe (PID: 2076)
      • c2a795d497.exe (PID: 6076)
      • 54d9e0f2b2.exe (PID: 4512)
      • 021949f0ac.exe (PID: 6296)
      • 03c656ca1f.exe (PID: 6448)
      • fef09d218e.exe (PID: 6876)
      • 969778179c.exe (PID: 848)
      • f2560da6b4.exe (PID: 7812)
      • f2560da6b4.exe (PID: 7736)
      • vx72NG3gHzoM.tmp (PID: 7968)
      • mobilemediaplayer5.exe (PID: 8116)
      • hVShs8C8lF7jd.exe (PID: 6808)
      • 6IVKF7BMMT9QKW7O.exe (PID: 5872)
      • 483d2fa8a0d53818306efeb32d3.exe (PID: 6288)
      • 93e4adf5bd.exe (PID: 1520)
      • Adobe QT32 Server.exe (PID: 7012)
      • eda85f68f1.tmp (PID: 8144)
      • Adobe QT32 Server.exe (PID: 4872)
      • servicebrowserv5.exe (PID: 5092)
      • 84d8863aac.exe (PID: 6844)

    • Checks supported languages

      • GM2SC_random.exe (PID: 3140)
      • aeb8a77c3e.exe (PID: 5464)
      • 571439c8b1.exe (PID: 3208)
      • axplong.exe (PID: 4244)
      • skotes.exe (PID: 2076)
      • 969778179c.exe (PID: 848)
      • c2a795d497.exe (PID: 6076)
      • 54d9e0f2b2.exe (PID: 4512)
      • 021949f0ac.exe (PID: 6296)
      • 03c656ca1f.exe (PID: 6448)
      • fef09d218e.exe (PID: 6876)
      • f2560da6b4.exe (PID: 7736)
      • f2560da6b4.exe (PID: 7812)
      • vx72NG3gHzoM.exe (PID: 7948)
      • vx72NG3gHzoM.tmp (PID: 7968)
      • mobilemediaplayer5.exe (PID: 8116)
      • axplong.exe (PID: 4420)
      • skotes.exe (PID: 7220)
      • hVShs8C8lF7jd.exe (PID: 6808)
      • 84d8863aac.exe (PID: 6844)
      • 6IVKF7BMMT9QKW7O.exe (PID: 5872)
      • ITM0U1Z0EXRLGHCZOSI.exe (PID: 3260)
      • b57652dbdc.exe (PID: 6600)
      • 483d2fa8a0d53818306efeb32d3.exe (PID: 6288)
      • 93e4adf5bd.exe (PID: 1520)
      • eda85f68f1.exe (PID: 8160)
      • eda85f68f1.tmp (PID: 8144)
      • Adobe QT32 Server.exe (PID: 7012)
      • Adobe QT32 Server.exe (PID: 4872)
      • servicebrowserv5.exe (PID: 5092)
      • axplong.exe (PID: 2736)
      • skotes.exe (PID: 6376)

    • Sends debugging messages

      • axplong.exe (PID: 4244)
      • GM2SC_random.exe (PID: 3140)
      • aeb8a77c3e.exe (PID: 5464)
      • 571439c8b1.exe (PID: 3208)
      • skotes.exe (PID: 2076)
      • 969778179c.exe (PID: 848)
      • c2a795d497.exe (PID: 6076)
      • 54d9e0f2b2.exe (PID: 4512)
      • 021949f0ac.exe (PID: 6296)
      • skotes.exe (PID: 7220)
      • axplong.exe (PID: 4420)
      • 6IVKF7BMMT9QKW7O.exe (PID: 5872)
      • ITM0U1Z0EXRLGHCZOSI.exe (PID: 3260)
      • 483d2fa8a0d53818306efeb32d3.exe (PID: 6288)
      • skotes.exe (PID: 6376)
      • axplong.exe (PID: 2736)

    • Create files in a temporary directory

      • axplong.exe (PID: 4244)
      • GM2SC_random.exe (PID: 3140)
      • 571439c8b1.exe (PID: 3208)
      • skotes.exe (PID: 2076)
      • fef09d218e.exe (PID: 6876)
      • vx72NG3gHzoM.exe (PID: 7948)
      • vx72NG3gHzoM.tmp (PID: 7968)
      • c2a795d497.exe (PID: 6076)
      • 54d9e0f2b2.exe (PID: 4512)
      • eda85f68f1.exe (PID: 8160)
      • eda85f68f1.tmp (PID: 8144)
      • Adobe QT32 Server.exe (PID: 4872)
      • 969778179c.exe (PID: 848)

    • Checks proxy server information

      • axplong.exe (PID: 4244)
      • aeb8a77c3e.exe (PID: 5464)
      • skotes.exe (PID: 2076)
      • 021949f0ac.exe (PID: 6296)
      • 969778179c.exe (PID: 848)
      • WerFault.exe (PID: 7920)
      • 6IVKF7BMMT9QKW7O.exe (PID: 5872)
      • powershell.exe (PID: 3696)
      • WerFault.exe (PID: 3288)

    • Creates files or folders in the user directory

      • axplong.exe (PID: 4244)
      • aeb8a77c3e.exe (PID: 5464)
      • skotes.exe (PID: 2076)
      • 021949f0ac.exe (PID: 6296)
      • 969778179c.exe (PID: 848)
      • vx72NG3gHzoM.tmp (PID: 7968)
      • WerFault.exe (PID: 7920)
      • 6IVKF7BMMT9QKW7O.exe (PID: 5872)
      • WerFault.exe (PID: 3288)
      • Adobe QT32 Server.exe (PID: 7012)

    • The process uses the downloaded file

      • axplong.exe (PID: 4244)
      • GM2SC_random.exe (PID: 3140)
      • 571439c8b1.exe (PID: 3208)
      • skotes.exe (PID: 2076)
      • fef09d218e.exe (PID: 6876)
      • mobilemediaplayer5.exe (PID: 8116)
      • mshta.exe (PID: 1620)
      • powershell.exe (PID: 3696)

    • Process checks computer location settings

      • axplong.exe (PID: 4244)
      • GM2SC_random.exe (PID: 3140)
      • 571439c8b1.exe (PID: 3208)
      • skotes.exe (PID: 2076)
      • fef09d218e.exe (PID: 6876)
      • mobilemediaplayer5.exe (PID: 8116)

    • The sample compiled with czech language support

      • axplong.exe (PID: 4244)

    • Themida protector has been detected

      • axplong.exe (PID: 4244)
      • skotes.exe (PID: 2076)
      • 969778179c.exe (PID: 848)
      • c2a795d497.exe (PID: 6076)
      • 54d9e0f2b2.exe (PID: 4512)

    • Reads the machine GUID from the registry

      • c2a795d497.exe (PID: 6076)
      • 54d9e0f2b2.exe (PID: 4512)
      • 969778179c.exe (PID: 848)
      • f2560da6b4.exe (PID: 7812)
      • 93e4adf5bd.exe (PID: 1520)
      • 84d8863aac.exe (PID: 6844)

    • Reads the software policy settings

      • c2a795d497.exe (PID: 6076)
      • 54d9e0f2b2.exe (PID: 4512)
      • f2560da6b4.exe (PID: 7812)
      • WerFault.exe (PID: 7920)
      • WerFault.exe (PID: 3288)
      • 84d8863aac.exe (PID: 6844)

    • The sample compiled with english language support

      • skotes.exe (PID: 2076)
      • vx72NG3gHzoM.tmp (PID: 7968)
      • mobilemediaplayer5.exe (PID: 8116)
      • eda85f68f1.tmp (PID: 8144)
      • Adobe QT32 Server.exe (PID: 7012)
      • cmd.exe (PID: 7772)

    • Reads mouse settings

      • 03c656ca1f.exe (PID: 6448)

    • Application launched itself

      • firefox.exe (PID: 7088)
      • firefox.exe (PID: 7140)

    • The sample compiled with russian language support

      • vx72NG3gHzoM.tmp (PID: 7968)

    • Creates files in the program directory

      • mobilemediaplayer5.exe (PID: 8116)

    • Creates a software uninstall entry

      • vx72NG3gHzoM.tmp (PID: 7968)

    • Changes the registry key values via Powershell

      • mobilemediaplayer5.exe (PID: 8116)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7896)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 1620)

    • Disables trace logs

      • powershell.exe (PID: 3696)

    • The executable file from the user directory is run by the Powershell process

      • 483d2fa8a0d53818306efeb32d3.exe (PID: 6288)

    • Reads Environment values

      • 93e4adf5bd.exe (PID: 1520)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:25 12:10:38+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.24
CodeSize: 321024
InitializedDataSize: 104960
UninitializedDataSize: -
EntryPoint: 0x4be000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
198
Monitored processes
78
Malicious processes
33
Suspicious processes
3

Behavior graph

Click at the process to see the details
start gm2sc_random.exe #AMADEY axplong.exe #STEALC aeb8a77c3e.exe 571439c8b1.exe #AMADEY skotes.exe #GCLEANER 969778179c.exe #LUMMA c2a795d497.exe #LUMMA svchost.exe #LUMMA 54d9e0f2b2.exe #STEALC 021949f0ac.exe #CREDENTIALFLUSHER 03c656ca1f.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs fef09d218e.exe no specs taskkill.exe no specs conhost.exe no specs fef09d218e.exe taskkill.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs #CREDENTIALFLUSHER firefox.exe no specs timeout.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs cmd.exe no specs powershell.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs f2560da6b4.exe #LUMMA f2560da6b4.exe werfault.exe vx72ng3ghzom.exe vx72ng3ghzom.tmp mobilemediaplayer5.exe cmd.exe no specs powershell.exe no specs skotes.exe axplong.exe firefox.exe no specs powershell.exe no specs conhost.exe no specs hvshs8c8lf7jd.exe no specs #LUMMA 84d8863aac.exe powershell.exe no specs conhost.exe no specs cmd.exe no specs powershell.exe no specs firefox.exe no specs #STEALC 6ivkf7bmmt9qkw7o.exe schtasks.exe no specs mshta.exe no specs powershell.exe conhost.exe no specs itm0u1z0exrlghczosi.exe b57652dbdc.exe no specs werfault.exe 483d2fa8a0d53818306efeb32d3.exe 93e4adf5bd.exe eda85f68f1.exe eda85f68f1.tmp adobe qt32 server.exe adobe qt32 server.exe no specs cmd.exe conhost.exe no specs servicebrowserv5.exe axplong.exe no specs skotes.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
848"C:\Users\admin\AppData\Local\Temp\1014395001\969778179c.exe" C:\Users\admin\AppData\Local\Temp\1014395001\969778179c.exe
axplong.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226505
Modules
Images
c:\users\admin\appdata\local\temp\1014395001\969778179c.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1520"C:\Users\admin\AppData\Local\Temp\1045990001\93e4adf5bd.exe" C:\Users\admin\AppData\Local\Temp\1045990001\93e4adf5bd.exe
skotes.exe
User:
admin
Integrity Level:
MEDIUM
Version:
6.0.5
Modules
Images
c:\users\admin\appdata\local\temp\1045990001\93e4adf5bd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1620mshta "C:\Temp\u192xgeym.hta"C:\Windows\System32\mshta.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2076"C:\Users\admin\AppData\Local\Temp\abc3bc1985\skotes.exe" C:\Users\admin\AppData\Local\Temp\abc3bc1985\skotes.exe
571439c8b1.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\abc3bc1985\skotes.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2736"C:\Users\admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\admin\AppData\Local\Temp\44111dbc49\axplong.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3140"C:\Users\admin\Desktop\GM2SC_random.exe" C:\Users\admin\Desktop\GM2SC_random.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\gm2sc_random.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3208"C:\Users\admin\AppData\Local\Temp\1014394001\571439c8b1.exe" C:\Users\admin\AppData\Local\Temp\1014394001\571439c8b1.exe
axplong.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\1014394001\571439c8b1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3260"C:\Users\admin\AppData\Local\Temp\ITM0U1Z0EXRLGHCZOSI.exe"C:\Users\admin\AppData\Local\Temp\ITM0U1Z0EXRLGHCZOSI.exe
54d9e0f2b2.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\itm0u1z0exrlghczosi.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3288C:\WINDOWS\SysWOW64\WerFault.exe -u -p 848 -s 1772C:\Windows\SysWOW64\WerFault.exe
969778179c.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
75 285
Read events
75 222
Write events
59
Delete events
4

Modification events

(PID) Process:(4244) axplong.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4244) axplong.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4244) axplong.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4244) axplong.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:aeb8a77c3e.exe
Value:
C:\Users\admin\AppData\Local\Temp\1014393001\aeb8a77c3e.exe
(PID) Process:(5464) aeb8a77c3e.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5464) aeb8a77c3e.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5464) aeb8a77c3e.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4244) axplong.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:571439c8b1.exe
Value:
C:\Users\admin\AppData\Local\Temp\1014394001\571439c8b1.exe
(PID) Process:(2076) skotes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2076) skotes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
103
Suspicious files
177
Text files
75
Unknown types
0

Dropped files

PID
Process
Filename
Type
3140GM2SC_random.exeC:\Windows\Tasks\axplong.jobbinary
MD5:2179147812CF4E7B902459C1F2395FD6
SHA256:117E300946149F45AC1B61ED582259A640E0969681DCA168282E90BAC6ED1732
4244axplong.exeC:\Users\admin\AppData\Local\Temp\1014393001\aeb8a77c3e.exeexecutable
MD5:CFED3795B5DF45BBD48F493175331240
SHA256:F2A959CAED0D99D3FF313F6C7F70A8752D8BC2DBFDA56EA577596FFADD980E67
3208571439c8b1.exeC:\Users\admin\AppData\Local\Temp\abc3bc1985\skotes.exeexecutable
MD5:2C780BD0B93D85AFBAD23124CF8994C2
SHA256:96A1EEA0F525785429D36CFF82916E54227BE6A3750796E05D594E952A213EC2
7140firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
4244axplong.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\random[1].exeexecutable
MD5:2C780BD0B93D85AFBAD23124CF8994C2
SHA256:96A1EEA0F525785429D36CFF82916E54227BE6A3750796E05D594E952A213EC2
4244axplong.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\random[1].exeexecutable
MD5:CFED3795B5DF45BBD48F493175331240
SHA256:F2A959CAED0D99D3FF313F6C7F70A8752D8BC2DBFDA56EA577596FFADD980E67
3140GM2SC_random.exeC:\Users\admin\AppData\Local\Temp\44111dbc49\axplong.exeexecutable
MD5:FA93EE30BA0FF259954673B85347CF2E
SHA256:8E04D767B94A24732BE0868059F2D2FD09B86E73FAEF0C753E8AA6B604630CED
3208571439c8b1.exeC:\Windows\Tasks\skotes.jobbinary
MD5:A818706E6AA133F7883744D684D72300
SHA256:0721B1E5FB4605E1561D625FF4A7C7EA92C98642DFAA4F54E10C2BFDBF37F426
4244axplong.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\random[2].exeexecutable
MD5:8C98F00647FCF80B28C982C2D02D2C80
SHA256:5064A5D432B8AA2C46752D5D680BB56AC1A0C100330226FC7C66BB3B87AC91B1
2076skotes.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\random[2].exeexecutable
MD5:C7973E44BF12EFC64100C761EF3978EB
SHA256:423E9F7892E7929955DCB8F97FF0F29F2255AF24BC5E6F753A3DCE8DBF7F582B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
218
TCP/UDP connections
166
DNS requests
153
Threats
96

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4244
axplong.exe
POST
200
185.215.113.16:80
http://185.215.113.16/Jo89Ku7d/index.php
unknown
—
—
malicious
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4244
axplong.exe
POST
200
185.215.113.16:80
http://185.215.113.16/Jo89Ku7d/index.php
unknown
—
—
malicious
4712
MoUsoCoreWorker.exe
GET
200
23.32.238.107:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4244
axplong.exe
POST
200
185.215.113.16:80
http://185.215.113.16/Jo89Ku7d/index.php
unknown
—
—
malicious
4244
axplong.exe
GET
200
185.215.113.16:80
http://185.215.113.16/mine/random.exe
unknown
—
—
malicious
4244
axplong.exe
GET
200
185.215.113.16:80
http://185.215.113.16/steam/random.exe
unknown
—
—
malicious
5464
aeb8a77c3e.exe
GET
200
185.215.113.206:80
http://185.215.113.206/
unknown
—
—
malicious
4244
axplong.exe
GET
200
185.215.113.39:80
http://185.215.113.39/files/unique2/random.exe
unknown
—
—
malicious
5464
aeb8a77c3e.exe
POST
200
185.215.113.206:80
http://185.215.113.206/c4becf79229cb002.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
184.86.251.16:443
—
Akamai International B.V.
DE
unknown
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4244
axplong.exe
185.215.113.16:80
—
1337team Limited
SC
malicious
4712
MoUsoCoreWorker.exe
23.32.238.107:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3976
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.110
whitelisted
crl.microsoft.com
  • 23.32.238.107
  • 23.32.238.112
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
tawdrydadysz.icu
  • —
unknown
nearycrepso.shop
  • —
malicious
abruptyopsn.shop
  • —
malicious
wholersorie.shop
  • —
malicious
framekgirus.shop
  • —
malicious
tirepublicerj.shop
  • —
malicious

Threats

PID
Process
Class
Message
4244
axplong.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 33
4244
axplong.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
4244
axplong.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
4244
axplong.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
4244
axplong.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
4244
axplong.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
4244
axplong.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
4244
axplong.exe
A Network Trojan was detected
ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2
5464
aeb8a77c3e.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 33
5464
aeb8a77c3e.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] Stealc HTTP POST Request
3 ETPRO signatures available at the full report
Process
Message
GM2SC_random.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
axplong.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
aeb8a77c3e.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
571439c8b1.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
skotes.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
969778179c.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
c2a795d497.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
54d9e0f2b2.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
021949f0ac.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
skotes.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
GM2SC_random.exe