File name:

2025-06-26_58d3579b9408837b00c23367baddb478_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop

Full analysis: https://app.any.run/tasks/5f0ae2a4-33cd-4691-8297-e102af9fd3d1
Verdict: Malicious activity
Analysis date: June 26, 2025, 05:08:18
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
sakula
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

58D3579B9408837B00C23367BADDB478

SHA1:

97E36526535A4A7D728FFC0516B46933BE1780D3

SHA256:

AE504CCA7BE304CB495446DF4502506E1E7DF9A0BCE625EC5C3125F19E562FBC

SSDEEP:

1536:xZoUZR6RnYmE2q73nTWPZJA1zekntfaMBRId6HQmRc0nNU/+AE5X:D6NYx/nYZJA5cMUepnNU/q

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • 2025-06-26_58d3579b9408837b00c23367baddb478_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe (PID: 6648)

    • SAKULA has been detected

      • 2025-06-26_58d3579b9408837b00c23367baddb478_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe (PID: 6648)

    • Starts CMD.EXE for self-deleting

      • 2025-06-26_58d3579b9408837b00c23367baddb478_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe (PID: 6648)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 2025-06-26_58d3579b9408837b00c23367baddb478_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe (PID: 6648)

    • Reads security settings of Internet Explorer

      • 2025-06-26_58d3579b9408837b00c23367baddb478_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe (PID: 6648)

    • Starts itself from another location

      • 2025-06-26_58d3579b9408837b00c23367baddb478_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe (PID: 6648)

    • Starts CMD.EXE for commands execution

      • 2025-06-26_58d3579b9408837b00c23367baddb478_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe (PID: 6648)

  • INFO

    • Checks supported languages

      • 2025-06-26_58d3579b9408837b00c23367baddb478_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe (PID: 6648)

    • Launching a file from a Registry key

      • 2025-06-26_58d3579b9408837b00c23367baddb478_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe (PID: 6648)

    • Manual execution by a user

      • AdobeUpdate.exe (PID: 2804)

    • Process checks computer location settings

      • 2025-06-26_58d3579b9408837b00c23367baddb478_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe (PID: 6648)

    • Reads the software policy settings

      • slui.exe (PID: 1800)

    • Checks proxy server information

      • slui.exe (PID: 1800)

    • Create files in a temporary directory

      • 2025-06-26_58d3579b9408837b00c23367baddb478_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe (PID: 6648)

    • Reads the computer name

      • 2025-06-26_58d3579b9408837b00c23367baddb478_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe (PID: 6648)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | DOS Executable Generic (100)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:04:02 06:46:11+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 57344
InitializedDataSize: 32768
UninitializedDataSize: -
EntryPoint: 0x4d59
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
7
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #SAKULA 2025-06-26_58d3579b9408837b00c23367baddb478_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe adobeupdate.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs adobeupdate.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1800C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2804C:\Users\admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeC:\Users\admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\micromedia\adobeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2808ping 127.0.0.1 C:\Windows\SysWOW64\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3520"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\admin\Desktop\2025-06-26_58d3579b9408837b00c23367baddb478_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe"C:\Windows\SysWOW64\cmd.exe—2025-06-26_58d3579b9408837b00c23367baddb478_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6420\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6648"C:\Users\admin\Desktop\2025-06-26_58d3579b9408837b00c23367baddb478_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe" C:\Users\admin\Desktop\2025-06-26_58d3579b9408837b00c23367baddb478_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\2025-06-26_58d3579b9408837b00c23367baddb478_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6716C:\Users\admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeC:\Users\admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe—2025-06-26_58d3579b9408837b00c23367baddb478_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\micromedia\adobeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
4 045
Read events
4 044
Write events
1
Delete events
0

Modification events

(PID) Process:(6648) 2025-06-26_58d3579b9408837b00c23367baddb478_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:AdobeUpdate
Value:
C:\Users\admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
66482025-06-26_58d3579b9408837b00c23367baddb478_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop.exeC:\Users\admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeexecutable
MD5:9ABA880444A359D92283EAAE1EDC085E
SHA256:BB8283520E2DB5415D907A92480720172B26D4A331785B69EEC786B0C8C5CC01
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
28
TCP/UDP connections
41
DNS requests
18
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4400
RUXIMICS.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4400
RUXIMICS.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
200
20.190.160.132:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
—
—
POST
200
40.126.32.140:443
https://login.live.com/RST2.srf
unknown
xml
11.0 Kb
whitelisted
—
—
POST
200
40.126.32.133:443
https://login.live.com/RST2.srf
unknown
xml
11.1 Kb
whitelisted
—
—
POST
200
20.190.160.132:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
16.7 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4400
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4400
RUXIMICS.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
69.192.161.161:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
69.192.161.161:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.250.184.206
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 69.192.161.161
whitelisted
login.live.com
  • 40.126.31.71
  • 40.126.31.0
  • 40.126.31.69
  • 20.190.159.2
  • 40.126.31.1
  • 40.126.31.73
  • 20.190.159.129
  • 40.126.31.2
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.48
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-06-26_58d3579b9408837b00c23367baddb478_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader_stop