| File name: | bomb.zip |
| Full analysis: | https://app.any.run/tasks/1ee23c62-075c-4171-819d-3bf558cca225 |
| Verdict: | Malicious activity |
| Threats: | Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks. |
| Analysis date: | February 28, 2025, 17:17:42 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract, compression method=deflate |
| MD5: | 4D9BD8DAFB8299D0FC3FC98F8B8C27D4 |
| SHA1: | F3B375208D793E65FAABFD237C5391B49F381908 |
| SHA256: | 94936FB4C7BED2E7233FADE7980425B0300451D76A7AC9329C604886E2A9A013 |
| SSDEEP: | 192:aEuBYvQPc0QskFQBTPwR8Ac4Q7SbFL8H/Pj3UhrMj:aEznFcTPwRVASbVYXj/j |
| .zip | | | ZIP compressed archive (100) |
|---|
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | 0x0001 |
| ZipCompression: | Deflated |
| ZipModifyDate: | 2024:01:30 21:59:18 |
| ZipCRC: | 0xab285edc |
| ZipCompressedSize: | 4829 |
| ZipUncompressedSize: | 12288 |
| ZipFileName: | bomb.exe |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 516 | "C:\Users\admin\Desktop\httpsgithub.comOscarito20222diciembrerawrefsheadsmainsena.exe.exe" | C:\Users\admin\Desktop\httpsgithub.comOscarito20222diciembrerawrefsheadsmainsena.exe.exe | — | bomb.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 2 Modules
| |||||||||||||||
| 732 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | — | http92.255.57.221yr.exe.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: MSBuild.exe Version: 4.8.9037.0 built by: NET481REL1 Modules
| |||||||||||||||
| 776 | "C:\Users\admin\Desktop\httpsgithub.com1tthens1PMIrawrefsheadsmainDEVM2.exe.exe" | C:\Users\admin\Desktop\httpsgithub.com1tthens1PMIrawrefsheadsmainDEVM2.exe.exe | httpsgithub.com1tthens1PMIrawrefsheadsmainDEVM2.exe.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Chapter Version: 1.0.0.0 Modules
| |||||||||||||||
| 960 | C:\WINDOWS\system32\cmd.exe /c CLS | C:\Windows\SysWOW64\cmd.exe | — | http196.251.90.104vncnvnc.exe.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1056 | C:\WINDOWS\SysWOW64\WerFault.exe -u -p 8184 -s 788 | C:\Windows\SysWOW64\WerFault.exe | — | http172.245.123.17550casse.exe.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Problem Reporting Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1228 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1512 | "C:\Users\admin\Desktop\http176.113.115.7files7098980627mAtJWNv.exe.exe" | C:\Users\admin\Desktop\http176.113.115.7files7098980627mAtJWNv.exe.exe | bomb.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226505 Modules
| |||||||||||||||
| 1628 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | — | http185.7.214.108js.exe.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: MSBuild.exe Version: 4.8.9037.0 built by: NET481REL1 Modules
| |||||||||||||||
| 1760 | "C:\Users\admin\Desktop\http62.60.226.112file8998_3800.exe.exe" | C:\Users\admin\Desktop\http62.60.226.112file8998_3800.exe.exe | — | bomb.exe | |||||||||||
User: admin Company: SAP SE Integrity Level: MEDIUM Description: SAP Enable Now Authoring Tool Version: 10.8.9 (build 5711) Modules
| |||||||||||||||
| 1764 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | http196.251.90.104vncnvnc.exe.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| (PID) Process: | (6040) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (6040) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (6040) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (6040) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\bomb.zip | |||
| (PID) Process: | (6040) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (6040) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (6040) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (6040) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (7820) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7820) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 8112 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\31dae929-fa3e-477e-bd59-2fc81bc86f81.down_data | — | |
MD5:— | SHA256:— | |||
| 8112 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\88dc55a8-8475-4849-a4e0-dbe599cb4af1.up_meta_secure | binary | |
MD5:DE010C9679592C1F56FD87AAE7D910DF | SHA256:9A3BA5D5B83260E42B737A80913C84A5651338651401D07F2C3F93DDFBAAA43E | |||
| 8112 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\88dc55a8-8475-4849-a4e0-dbe599cb4af1.d64442af-7708-456a-96d4-53080d355216.down_meta | binary | |
MD5:B1C027468354002159330F8E4704C474 | SHA256:93ECB807518A9CCB51FBCC4D9216D40015A17D6DD9B2F442743F99A56109D11E | |||
| 7864 | bomb.exe | C:\Users\admin\Desktop\httpsreservation-confirms.comin.phpaction=2id=admin&mn=DESKTOP-JGLLJLD&os=6.2 build 9200.exe | text | |
MD5:F3242051324FFA4419059321655A9960 | SHA256:4115D0E831165F718543C84681D16FB3CFAFAE893F8DEFA05E3ABFAD938C28C1 | |||
| 7864 | bomb.exe | C:\Users\admin\Desktop\httpsggepiay.comin.phpaction=2id=admin&mn=DESKTOP-JGLLJLD&os=6.2 build 9200.exe | text | |
MD5:C9CC14E9F8CF3747EA741B373949B0E6 | SHA256:3C5D644806429A3E5B8E35C97EEFB4CDD7662D6B9378A59446C7846CE1D5E3C7 | |||
| 7864 | bomb.exe | C:\Users\admin\Desktop\httpsfxepiay.comin.phpaction=2id=admin&mn=DESKTOP-JGLLJLD&os=6.2 build 9200.exe | text | |
MD5:EA6EEBA52E199890553F24734857116F | SHA256:ADA61A271D8C0D4B9B90968FF99550A36117596795565A849A183794D45A1F4E | |||
| 7864 | bomb.exe | C:\Users\admin\Desktop\httpsggepllay.comin.phpaction=1id=admin&mn=DESKTOP-JGLLJLD&os=6.2 build 9200.exe | text | |
MD5:8D714D5F9F9751BA6AF87D34939839D6 | SHA256:62C7E00F68B430585030DC1EC0A89CBEABE6D92EFDEBD7CCAA76779C9D569FFF | |||
| 7864 | bomb.exe | C:\Users\admin\Desktop\httpsimportant-confiirm.comin.phpaction=1id=admin&mn=DESKTOP-JGLLJLD&os=6.2 build 9200.exe | text | |
MD5:44AE656B05BE20062B8C0AF24669C559 | SHA256:93E8BBF5AC627ACDE49F7733F67067C835B9E73C701A1F08D7FFF1A61A686768 | |||
| 7864 | bomb.exe | C:\Users\admin\Desktop\httpsprocedeed-verific.comin.phpaction=1id=admin&mn=DESKTOP-JGLLJLD&os=6.2 build 9200.exe | text | |
MD5:29AEFF38129F05283505DAE2F9068D17 | SHA256:654A717D7B8EA9B303E34AE20EDD35D8CF23A22C21873B1179A9DC64D9A460E9 | |||
| 7864 | bomb.exe | C:\Users\admin\Desktop\httpsimportant-confiirm.comin.phpaction=2id=admin&mn=DESKTOP-JGLLJLD&os=6.2 build 9200.exe | text | |
MD5:D214EA754DC144794A02BE32B947AEB0 | SHA256:8E708257368695510EA0629763B9879F68D94CF31EA5533D9B7DC8F05BE2FA45 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
8112 | BackgroundTransferHost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
7864 | bomb.exe | GET | 200 | 45.11.59.49:80 | http://45.11.59.49/Acuerdo_de_Orden_de_Compra.exe | unknown | — | — | unknown |
7864 | bomb.exe | GET | 200 | 196.251.90.104:80 | http://196.251.90.104/vnc/nvnc.exe | unknown | — | — | unknown |
7880 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
7880 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
7864 | bomb.exe | GET | — | 62.60.226.112:80 | http://62.60.226.112/file/8998_3800.exe | unknown | — | — | unknown |
7864 | bomb.exe | GET | 200 | 176.113.115.7:80 | http://176.113.115.7/mine/random.exe | unknown | — | — | malicious |
7864 | bomb.exe | GET | 200 | 176.113.115.7:80 | http://176.113.115.7/files/qqdoup/random.exe | unknown | — | — | malicious |
7864 | bomb.exe | GET | 200 | 172.245.123.17:80 | http://172.245.123.17/550/casse.exe | unknown | — | — | unknown |
7864 | bomb.exe | GET | — | 176.113.115.7:80 | http://176.113.115.7/files/7098980627/mAtJWNv.exe | unknown | — | — | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2104 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2112 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 40.126.31.0:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3216 | svchost.exe | 40.113.103.199:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2040 | backgroundTaskHost.exe | 20.223.36.55:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3008 | backgroundTaskHost.exe | 2.19.96.41:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
2040 | backgroundTaskHost.exe | 20.103.156.88:443 | fd.api.iris.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
login.live.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
fd.api.iris.microsoft.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
7864 | bomb.exe | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |
7864 | bomb.exe | Potential Corporate Privacy Violation | ET INFO PE EXE or DLL Windows file download HTTP |
7864 | bomb.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
7864 | bomb.exe | Potentially Bad Traffic | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response |
7864 | bomb.exe | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |
7864 | bomb.exe | Potentially Bad Traffic | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response |
7864 | bomb.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
7864 | bomb.exe | Potential Corporate Privacy Violation | ET INFO PE EXE or DLL Windows file download HTTP |
7864 | bomb.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 37 |
7864 | bomb.exe | Misc activity | ET INFO Packed Executable Download |