File name: | 2025-07-05_389b052dbd1d945b69aeb6650b36f19a_amadey_elex_smoke-loader_stop |
Full analysis: | https://app.any.run/tasks/a66bc4d4-cfd0-4c26-a134-3ad2bf3d60d0 |
Verdict: | Malicious activity |
Analysis date: | July 05, 2025, 21:39:35 |
OS: | Windows 10 Professional (build: 19044, 64 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.microsoft.portable-executable |
File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed, 5 sections |
MD5: | 389B052DBD1D945B69AEB6650B36F19A |
SHA1: | 2A81F657F8980FB557ED704FB71F5762A3C8518D |
SHA256: | 9F1890355BDF254510D7E513A98D7D1AA93B37504A12F2C709488350364703E0 |
SSDEEP: | 12288:5U74E9YGRjKOrTUrbot00LmemdHu+SRoyCAKkafxySEOnKFaV3hdv1KHL5Xgu:5CyOrTUrbo9m5u+/ykdxyzF43hdv1KCu |
.exe | | | Win32 Executable (generic) (52.9) |
---|---|---|
.exe | | | Generic Win/DOS Executable (23.5) |
.exe | | | DOS Executable Generic (23.5) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2022:01:09 21:33:16+00:00 |
ImageFileCharacteristics: | Executable, 32-bit, No debug |
PEType: | PE32 |
LinkerVersion: | 9 |
CodeSize: | 143360 |
InitializedDataSize: | 139264 |
UninitializedDataSize: | 274432 |
EntryPoint: | 0x1317f |
OSVersion: | 5 |
ImageVersion: | - |
SubsystemVersion: | 5 |
Subsystem: | Windows GUI |
FileVersionNumber: | 23.9.20.1611 |
ProductVersionNumber: | 23.9.20.1611 |
FileFlagsMask: | 0x0017 |
FileFlags: | (none) |
FileOS: | Win32 |
ObjectFileType: | Executable application |
FileSubtype: | - |
LanguageCode: | Chinese (Simplified) |
CharacterSet: | Unicode |
FileVersion: | 23, 9, 20, 1611 |
ProductVersion: | 23, 9, 20, 1611 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2128 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
2200 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
5008 | "C:\Users\admin\Desktop\2025-07-05_389b052dbd1d945b69aeb6650b36f19a_amadey_elex_smoke-loader_stop.exe" | C:\Users\admin\Desktop\2025-07-05_389b052dbd1d945b69aeb6650b36f19a_amadey_elex_smoke-loader_stop.exe | 2025-07-05_389b052dbd1d945b69aeb6650b36f19a_amadey_elex_smoke-loader_stop.exe | ||||||||||||
User: admin Integrity Level: HIGH Version: 23, 9, 20, 1611 Modules
| |||||||||||||||
5708 | C:\Windows\Syswow64\bc1b2c40 | C:\Windows\SysWOW64\bc1b2c40 | services.exe | ||||||||||||
User: SYSTEM Integrity Level: SYSTEM Exit code: 0 Version: 23, 9, 20, 1611 Modules
| |||||||||||||||
7156 | "C:\Users\admin\Desktop\2025-07-05_389b052dbd1d945b69aeb6650b36f19a_amadey_elex_smoke-loader_stop.exe" | C:\Users\admin\Desktop\2025-07-05_389b052dbd1d945b69aeb6650b36f19a_amadey_elex_smoke-loader_stop.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Version: 23, 9, 20, 1611 Modules
|
(PID) Process: | (5008) 2025-07-05_389b052dbd1d945b69aeb6650b36f19a_amadey_elex_smoke-loader_stop.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
(PID) Process: | (5008) 2025-07-05_389b052dbd1d945b69aeb6650b36f19a_amadey_elex_smoke-loader_stop.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
(PID) Process: | (5008) 2025-07-05_389b052dbd1d945b69aeb6650b36f19a_amadey_elex_smoke-loader_stop.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
Operation: | write | Name: | CachePrefix |
Value: |
PID | Process | Filename | Type | |
---|---|---|---|---|
5008 | 2025-07-05_389b052dbd1d945b69aeb6650b36f19a_amadey_elex_smoke-loader_stop.exe | C:\Windows\55bd20 | text | |
MD5:F25AA16A00810E4FDA88A924502BBCB5 | SHA256:C1B48CB3DFB4827963A69496CA79C4676C3FCF7F790A254DB68682993A04EF3F | |||
5708 | bc1b2c40 | C:\Windows\61b918 | text | |
MD5:DC187DA95D4A963F93500406D2039FDA | SHA256:6112DE28546C9994B63973B9DB1F37A1CDBF4B2DBC7ACDA0BC639380572C7E31 | |||
5008 | 2025-07-05_389b052dbd1d945b69aeb6650b36f19a_amadey_elex_smoke-loader_stop.exe | C:\Windows\SysWOW64\bc1b2c40 | executable | |
MD5:694028178B0D8E2FC0F99FB7B214D355 | SHA256:AA869EA3E4AFC8C76C637024BB3A7381EEE96AD21CF0A82340A6FCE916F3D247 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
5944 | MoUsoCoreWorker.exe | GET | 200 | 23.216.77.22:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 23.216.77.22:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
3936 | RUXIMICS.exe | GET | 200 | 23.216.77.22:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
3936 | RUXIMICS.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
5708 | bc1b2c40 | GET | 200 | 223.5.5.5:80 | http://dns.alidns.com/resolve?name=down.nugong.asia&type=1 | unknown | — | — | whitelisted |
— | — | GET | 200 | 223.5.5.5:443 | https://dns.alidns.com/resolve?name=spi1.tyui54345.xyz&type=16 | unknown | binary | 253 b | whitelisted |
5708 | bc1b2c40 | GET | 200 | 223.5.5.5:80 | http://223.5.5.5/resolve?name=down.nugong.asia&type=1 | unknown | — | — | — |
5708 | bc1b2c40 | GET | 200 | 223.5.5.5:80 | http://dns.alidns.com/resolve?name=spi1.tyui54345.xyz&type=16 | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1268 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3936 | RUXIMICS.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | 23.216.77.22:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
1268 | svchost.exe | 23.216.77.22:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
3936 | RUXIMICS.exe | 23.216.77.22:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5944 | MoUsoCoreWorker.exe | 23.35.229.160:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
3936 | RUXIMICS.exe | 23.35.229.160:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
Domain | IP | Reputation |
---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
down.nugong.asia |
| unknown |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
dns.alidns.com |
| whitelisted |
down.xy58.top |
| unknown |
activation-v2.sls.microsoft.com |
| whitelisted |
x1.c.lencr.org |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | Misc activity | ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI) |
— | — | Misc activity | ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI) |
— | — | Misc activity | ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI) |
— | — | Misc activity | ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI) |
— | — | Misc activity | ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI) |
— | — | Misc activity | ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI) |
— | — | Misc activity | ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI) |
— | — | Potentially Bad Traffic | ET DNS Query to a *.top domain - Likely Hostile |
— | — | Misc activity | ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI) |
— | — | Misc activity | ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI) |