File name:

amnew.exe

Full analysis: https://app.any.run/tasks/cfa73211-5291-458b-8cb0-7d145e83ffb7
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: May 02, 2025, 18:28:55
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
amadey
botnet
stealer
loader
rdp
auto
generic
gcleaner
delphi
themida
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

5757874C90B7195E09BE379B05AC125F

SHA1:

8F41598BA889721A139C29061B4ED8096B1C87C2

SHA256:

9577478999AD808AB89FB15792B31FCFA58A658882328D218470534AD9C99E98

SSDEEP:

6144:GS1FBY5lPBd20rxuTwKEA2lLlB1HM6bSXikW3Gtht:c5RBLQkKEAQxB1s6GXiFyt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • AMADEY has been detected (SURICATA)

      • taren.exe (PID: 7372)
    • AMADEY mutex has been found

      • amnew.exe (PID: 7280)
      • taren.exe (PID: 7372)
      • taren.exe (PID: 1348)
      • taren.exe (PID: 3900)
    • Connects to the CnC server

      • taren.exe (PID: 7372)
    • AMADEY has been detected (YARA)

      • taren.exe (PID: 7372)
    • GENERIC has been found (auto)

      • 3a54b15337.exe (PID: 7912)
      • svchost015.exe (PID: 4300)
    • GCLEANER has been detected (SURICATA)

      • svchost015.exe (PID: 4300)
  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • amnew.exe (PID: 7280)
      • taren.exe (PID: 7372)
      • svchost015.exe (PID: 4300)
    • Starts itself from another location

      • amnew.exe (PID: 7280)
    • Executable content was dropped or overwritten

      • amnew.exe (PID: 7280)
      • taren.exe (PID: 7372)
      • 3a54b15337.exe (PID: 7912)
      • svchost015.exe (PID: 4300)
    • Contacting a server suspected of hosting an CnC

      • taren.exe (PID: 7372)
    • Connects to the server without a host name

      • taren.exe (PID: 7372)
      • svchost015.exe (PID: 4300)
    • Process requests binary or script from the Internet

      • taren.exe (PID: 7372)
    • Reads the BIOS version

      • 3a54b15337.exe (PID: 7912)
    • Potential Corporate Privacy Violation

      • taren.exe (PID: 7372)
      • svchost015.exe (PID: 4300)
    • There is functionality for enable RDP (YARA)

      • taren.exe (PID: 7372)
    • There is functionality for taking screenshot (YARA)

      • taren.exe (PID: 7372)
    • The process executes via Task Scheduler

      • taren.exe (PID: 1348)
      • taren.exe (PID: 3900)
  • INFO

    • Reads the computer name

      • amnew.exe (PID: 7280)
      • taren.exe (PID: 7372)
      • 3a54b15337.exe (PID: 7912)
      • svchost015.exe (PID: 4300)
    • Create files in a temporary directory

      • amnew.exe (PID: 7280)
      • taren.exe (PID: 7372)
      • 3a54b15337.exe (PID: 7912)
      • svchost015.exe (PID: 4300)
    • Process checks computer location settings

      • amnew.exe (PID: 7280)
      • taren.exe (PID: 7372)
    • Checks supported languages

      • taren.exe (PID: 7372)
      • amnew.exe (PID: 7280)
      • 3a54b15337.exe (PID: 7912)
      • svchost015.exe (PID: 4300)
      • taren.exe (PID: 1348)
      • taren.exe (PID: 3900)
    • Checks proxy server information

      • taren.exe (PID: 7372)
      • svchost015.exe (PID: 4300)
    • Creates files or folders in the user directory

      • taren.exe (PID: 7372)
      • svchost015.exe (PID: 4300)
    • Themida protector has been detected

      • 3a54b15337.exe (PID: 7912)
    • The sample compiled with english language support

      • 3a54b15337.exe (PID: 7912)
    • Compiled with Borland Delphi (YARA)

      • 3a54b15337.exe (PID: 7912)
    • Reads the software policy settings

      • slui.exe (PID: 7468)
      • svchost015.exe (PID: 4300)
    • Reads the machine GUID from the registry

      • svchost015.exe (PID: 4300)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(7372) taren.exe
C280.64.18.63
URLhttp://80.64.18.63/tom4ku9v/index.php
Version5.34
Options
Drop directory4d0ca3b476
Drop nametaren.exe
Strings (125)ESET
0123456789
cmd
id:
https://
/tom4ku9v/index.php
Panda Security
5.34
Content-Type: application/x-www-form-urlencoded
?scr=1
Main
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AVG
Programs
|
random
abcdefghijklmnopqrstuvwxyz0123456789-_
Rem
\0000
"taskkill /f /im "
" Content-Type: application/octet-stream
"
-executionpolicy remotesigned -File "
------
cred.dll|clip.dll|
taren.exe
sd:
&&
exe
r=
CurrentBuild
av:
\
2025
00000422
#
clip.dll
<c>
Keyboard Layout\Preload
ar:
e3
shutdown -s -t 0
%USERPROFILE%
2019
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Powershell.exe
Bitdefender
Doctor Web
00000423
&& Exit"
ProductName
--
ComputerName
SYSTEM\ControlSet001\Services\BasicDisplay\Video
=
GET
og:
d1
pc:
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Content-Type: multipart/form-data; boundary=----
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
S-%lu-
e1
SOFTWARE\Microsoft\Windows NT\CurrentVersion
" && ren
Avira
Norton
-%lu
e2
cred.dll
dm:
bi:
kernel32.dll
<d>
http://
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
shell32.dll
msi
st=s
4d0ca3b476
POST
rundll32
0000043f
" && timeout 1 && del
Content-Disposition: form-data; name="data"; filename="
\App
Kaspersky Lab
ps1
GetNativeSystemInfo
wb
00000419
2016
Startup
zip
rb
.jpg
ProgramData\
2022
/k
80.64.18.63
360TotalSecurity
Comodo
%-lu
/quiet
VideoID
-unicode-
un:
DefaultSettings.YResolution
Sophos
rundll32.exe
:::
------
/Plugins/
+++
dll
cmd /C RMDIR /s/q
vs:
os:
lv:
AVAST Software
WinDefender
&unit=
DefaultSettings.XResolution
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:02 15:17:11+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 317952
InitializedDataSize: 123392
UninitializedDataSize: -
EntryPoint: 0x28c3a
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
9
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start amnew.exe #AMADEY taren.exe sppextcomobj.exe no specs slui.exe #GENERIC 3a54b15337.exe #GCLEANER svchost015.exe taren.exe no specs slui.exe no specs taren.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1348"C:\Users\admin\AppData\Local\Temp\4d0ca3b476\taren.exe"C:\Users\admin\AppData\Local\Temp\4d0ca3b476\taren.exesvchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\4d0ca3b476\taren.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
3900"C:\Users\admin\AppData\Local\Temp\4d0ca3b476\taren.exe"C:\Users\admin\AppData\Local\Temp\4d0ca3b476\taren.exesvchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\4d0ca3b476\taren.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
4300"C:\Users\admin\AppData\Local\Temp\10000060101\3a54b15337.exe" C:\Users\admin\AppData\Local\Temp\svchost015.exe
3a54b15337.exe
User:
admin
Company:
X-Ways Software Technology AG
Integrity Level:
MEDIUM
Description:
WinHex
Exit code:
0
Version:
21.1
Modules
Images
c:\users\admin\appdata\local\temp\svchost015.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6480C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7280"C:\Users\admin\AppData\Local\Temp\amnew.exe" C:\Users\admin\AppData\Local\Temp\amnew.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\amnew.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7372"C:\Users\admin\AppData\Local\Temp\4d0ca3b476\taren.exe" C:\Users\admin\AppData\Local\Temp\4d0ca3b476\taren.exe
amnew.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\4d0ca3b476\taren.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Amadey
(PID) Process(7372) taren.exe
C280.64.18.63
URLhttp://80.64.18.63/tom4ku9v/index.php
Version5.34
Options
Drop directory4d0ca3b476
Drop nametaren.exe
Strings (125)ESET
0123456789
cmd
id:
https://
/tom4ku9v/index.php
Panda Security
5.34
Content-Type: application/x-www-form-urlencoded
?scr=1
Main
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AVG
Programs
|
random
abcdefghijklmnopqrstuvwxyz0123456789-_
Rem
\0000
"taskkill /f /im "
" Content-Type: application/octet-stream
"
-executionpolicy remotesigned -File "
------
cred.dll|clip.dll|
taren.exe
sd:
&&
exe
r=
CurrentBuild
av:
\
2025
00000422
#
clip.dll
<c>
Keyboard Layout\Preload
ar:
e3
shutdown -s -t 0
%USERPROFILE%
2019
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Powershell.exe
Bitdefender
Doctor Web
00000423
&& Exit"
ProductName
--
ComputerName
SYSTEM\ControlSet001\Services\BasicDisplay\Video
=
GET
og:
d1
pc:
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Content-Type: multipart/form-data; boundary=----
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
S-%lu-
e1
SOFTWARE\Microsoft\Windows NT\CurrentVersion
" && ren
Avira
Norton
-%lu
e2
cred.dll
dm:
bi:
kernel32.dll
<d>
http://
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
shell32.dll
msi
st=s
4d0ca3b476
POST
rundll32
0000043f
" && timeout 1 && del
Content-Disposition: form-data; name="data"; filename="
\App
Kaspersky Lab
ps1
GetNativeSystemInfo
wb
00000419
2016
Startup
zip
rb
.jpg
ProgramData\
2022
/k
80.64.18.63
360TotalSecurity
Comodo
%-lu
/quiet
VideoID
-unicode-
un:
DefaultSettings.YResolution
Sophos
rundll32.exe
:::
------
/Plugins/
+++
dll
cmd /C RMDIR /s/q
vs:
os:
lv:
AVAST Software
WinDefender
&unit=
DefaultSettings.XResolution
7436C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exesvchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7468"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7912"C:\Users\admin\AppData\Local\Temp\10000060101\3a54b15337.exe" C:\Users\admin\AppData\Local\Temp\10000060101\3a54b15337.exe
taren.exe
User:
admin
Company:
Greenshot
Integrity Level:
MEDIUM
Description:
Greenshot
Exit code:
0
Version:
1.2.9.129
Modules
Images
c:\users\admin\appdata\local\temp\10000060101\3a54b15337.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
2 634
Read events
2 628
Write events
6
Delete events
0

Modification events

(PID) Process:(7372) taren.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7372) taren.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7372) taren.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4300) svchost015.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4300) svchost015.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4300) svchost015.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
8
Suspicious files
12
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
7280amnew.exeC:\Windows\Tasks\taren.jobbinary
MD5:67B2FDA6CC115613C865B721DE9CF172
SHA256:3F4F156B1981E5F16EB552B8658889B31094F8B1147933E84DF9B2AEAC1FDDC2
7372taren.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\random[1].exeexecutable
MD5:0D1AA62E309EA6C460A67398BD13B083
SHA256:4D0A5DDCAF86FE9AB13639DFA588563B0E5CED5D1910D098BF208DB2F20EC250
4300svchost015.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:2E7D090E25211DB76143CC37C3FEAD8E
SHA256:8D43604985CB1696B5DD277F0DE21E31330D674AE5B591817FEDBE22D8B27805
4300svchost015.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:4A90329071AE30B759D279CCA342B0A6
SHA256:4F544379EDA8E2653F71472AB968AEFD6B5D1F4B3CE28A5EDB14196184ED3B60
7372taren.exeC:\Users\admin\AppData\Local\Temp\10000060101\3a54b15337.exeexecutable
MD5:0D1AA62E309EA6C460A67398BD13B083
SHA256:4D0A5DDCAF86FE9AB13639DFA588563B0E5CED5D1910D098BF208DB2F20EC250
4300svchost015.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2A42127F349D54E7AA939366FF86F74E_7F7B9AAAFF465D18D58C254B044E2800binary
MD5:EEBF484493B6136599C225667FD41D7F
SHA256:04D5D0F553E1AC6DB6F9A3606545780A3F7A3E66D0FBA242B424158CC9B7FB3D
4300svchost015.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:1FBB37F79B317A9A248E7C4CE4F5BAC5
SHA256:9BF639C595FE335B6F694EE35990BEFD2123F5E07FD1973FF619E3FC88F5F49F
4300svchost015.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\success[1].htmbinary
MD5:CFCD208495D565EF66E7DFF9F98764DA
SHA256:5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
4300svchost015.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\info[1].htmtext
MD5:FE9B08252F126DDFCB87FB82F9CC7677
SHA256:E63E7EBE4C2DB7E61FFC71AF0675E870BCDE0A9D8916E5B3BE0CB252478030BF
4300svchost015.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\service[1].htmbinary
MD5:CFCD208495D565EF66E7DFF9F98764DA
SHA256:5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
30
TCP/UDP connections
30
DNS requests
18
Threats
28

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
8176
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
4300
svchost015.exe
GET
200
142.250.185.163:80
http://c.pki.goog/r/gsr1.crl
unknown
whitelisted
4300
svchost015.exe
GET
200
142.250.184.195:80
http://o.pki.goog/we2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEDmdiANCnbVJCTfkel4NKS0%3D
unknown
whitelisted
8176
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
2104
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
4300
svchost015.exe
GET
200
185.156.72.196:80
http://185.156.72.196/success?substr=mixsix&s=three&sub=none
unknown
malicious
4300
svchost015.exe
GET
200
185.156.72.196:80
http://185.156.72.196/update
unknown
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
whitelisted
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
whitelisted
7372
taren.exe
80.64.18.63:80
Joint Stock Company Tagnet
RU
unknown
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.136:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.142
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.32.136
  • 20.190.160.2
  • 20.190.160.132
  • 40.126.32.134
  • 20.190.160.22
  • 20.190.160.14
  • 20.190.160.20
  • 20.190.160.67
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
drive.usercontent.google.com
  • 142.250.184.225
whitelisted

Threats

PID
Process
Class
Message
7372
taren.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
7372
taren.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
7372
taren.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7372
taren.exe
Misc activity
ET INFO Packed Executable Download
7372
taren.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
7372
taren.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7372
taren.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
4300
svchost015.exe
A Network Trojan was detected
LOADER [ANY.RUN] GCleaner HTTP Header
4300
svchost015.exe
A Network Trojan was detected
LOADER [ANY.RUN] GCleaner HTTP Header
4300
svchost015.exe
A Network Trojan was detected
LOADER [ANY.RUN] GCleaner HTTP Header
No debug info