| File name: | pam.exe |
| Full analysis: | https://app.any.run/tasks/73bf8de0-d5a8-4a76-bd0e-9ed7926c90c2 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | May 15, 2025, 23:28:59 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32+ executable (console) x86-64, for MS Windows, 6 sections |
| MD5: | 4F6667FC66709D86CDE044960E6594D8 |
| SHA1: | 3CE72566F35294C7BB84CC30BCB96846FB1C3250 |
| SHA256: | B17541CBEA1FAD5BC9CE5B6A8FDB3851FDFAD26172C51E2E96AEC830DC3BE7AB |
| SSDEEP: | 12288:XNURbfR5rANgEQMxJ6qzHMcaL5T9ALwI1Kd4wMwduc1pyDS9m5U6yhfP0tUtC:X2RrR5rANgEQMxJ6qAc4AO4wM2sS0q6m |
MALICIOUS
Adds path to the Windows Defender exclusion list
- pam.exe (PID: 7272)
- cmd.exe (PID: 7644)
Changes Windows Defender settings
- cmd.exe (PID: 7644)
Changes the autorun value in the registry
- pam.exe (PID: 7272)
- stfuhceeg.exe (PID: 4408)
Request from PowerShell which ran from CMD.EXE
- powershell.exe (PID: 7924)
- powershell.exe (PID: 8164)
Uses Task Scheduler to run other applications
- stfuhceeg.exe (PID: 4408)
SUSPICIOUS
Application launched itself
- pam.exe (PID: 6620)
Reads the date of Windows installation
- pam.exe (PID: 6620)
- pam.exe (PID: 7272)
- stfuhceeg.exe (PID: 4408)
Reads security settings of Internet Explorer
- pam.exe (PID: 6620)
- pam.exe (PID: 7272)
- stfuhceeg.exe (PID: 4408)
Script adds exclusion path to Windows Defender
- cmd.exe (PID: 7644)
Starts POWERSHELL.EXE for commands execution
- cmd.exe (PID: 7644)
- cmd.exe (PID: 7908)
- cmd.exe (PID: 8144)
Starts CMD.EXE for commands execution
- pam.exe (PID: 7272)
- stfuhceeg.exe (PID: 4408)
Found IP address in command line
- powershell.exe (PID: 7924)
- powershell.exe (PID: 8164)
Downloads file from URI via Powershell
- powershell.exe (PID: 7924)
- powershell.exe (PID: 8164)
Connects to unusual port
- powershell.exe (PID: 7924)
- powershell.exe (PID: 8164)
Executable content was dropped or overwritten
- powershell.exe (PID: 7924)
- powershell.exe (PID: 8164)
- stfuhceeg.exe (PID: 4408)
Process requests binary or script from the Internet
- powershell.exe (PID: 7924)
- powershell.exe (PID: 8164)
Potential Corporate Privacy Violation
- powershell.exe (PID: 7924)
- powershell.exe (PID: 8164)
Checks for external IP
- svchost.exe (PID: 2196)
- xkhenp.exe (PID: 7180)
Executes application which crashes
- xkhenp.exe (PID: 7180)
Executing commands from a ".bat" file
- stfuhceeg.exe (PID: 4408)
Uses TIMEOUT.EXE to delay execution
- cmd.exe (PID: 7496)
Process communicates with Telegram (possibly using it as an attacker's C2 server)
- stfuhceeg.exe (PID: 4408)
- accc.exe (PID: 7556)
Starts itself from another location
- stfuhceeg.exe (PID: 4408)
INFO
Process checks computer location settings
- pam.exe (PID: 6620)
- pam.exe (PID: 7272)
- stfuhceeg.exe (PID: 4408)
Checks supported languages
- pam.exe (PID: 6620)
- pam.exe (PID: 7272)
- xkhenp.exe (PID: 7180)
- stfuhceeg.exe (PID: 4408)
- accc.exe (PID: 7556)
Reads the computer name
- pam.exe (PID: 7272)
- pam.exe (PID: 6620)
- xkhenp.exe (PID: 7180)
- stfuhceeg.exe (PID: 4408)
- accc.exe (PID: 7556)
Checks if a key exists in the options dictionary (POWERSHELL)
- powershell.exe (PID: 7660)
Script raised an exception (POWERSHELL)
- powershell.exe (PID: 7660)
Checks proxy server information
- powershell.exe (PID: 7924)
- xkhenp.exe (PID: 7180)
- powershell.exe (PID: 8164)
- stfuhceeg.exe (PID: 4408)
- accc.exe (PID: 7556)
Disables trace logs
- powershell.exe (PID: 7924)
- xkhenp.exe (PID: 7180)
- powershell.exe (PID: 8164)
- stfuhceeg.exe (PID: 4408)
- accc.exe (PID: 7556)
Reads the machine GUID from the registry
- xkhenp.exe (PID: 7180)
- stfuhceeg.exe (PID: 4408)
- accc.exe (PID: 7556)
Reads the software policy settings
- xkhenp.exe (PID: 7180)
- stfuhceeg.exe (PID: 4408)
- accc.exe (PID: 7556)
- slui.exe (PID: 7432)
Creates files or folders in the user directory
- WerFault.exe (PID: 5156)
Creates files in the program directory
- stfuhceeg.exe (PID: 4408)
Reads Environment values
- stfuhceeg.exe (PID: 4408)
- accc.exe (PID: 7556)
Create files in a temporary directory
- stfuhceeg.exe (PID: 4408)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (87.3) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (6.3) |
| .exe | | | DOS Executable Generic (6.3) |
EXIF
EXE
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 2025:05:12 11:03:11+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32+ |
| LinkerVersion: | 14.42 |
| CodeSize: | 284672 |
| InitializedDataSize: | 140288 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x199bc |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows command line |
Total processes
158
Monitored processes
23
Malicious processes
6
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2196 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2320 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | pam.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4408 | "C:\Users\admin\AppData\Local\ogepag\stfuhceeg.exe" | C:\Users\admin\AppData\Local\ogepag\stfuhceeg.exe | pam.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Exit code: 0 Version: 0.0.0.0 Modules
| |||||||||||||||
| 4892 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | schtasks.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5156 | C:\WINDOWS\SysWOW64\WerFault.exe -u -p 7180 -s 1792 | C:\Windows\SysWOW64\WerFault.exe | — | xkhenp.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Problem Reporting Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5512 | "schtasks.exe" /create /tn ACCC Tools /tr "C:\ProgramData\KMSAuto\accc.exe" /st 23:34 /du 23:59 /sc daily /ri 1 /f | C:\Windows\System32\schtasks.exe | — | stfuhceeg.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Task Scheduler Configuration Tool Exit code: 2147500037 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6620 | "C:\Users\admin\AppData\Local\Temp\pam.exe" | C:\Users\admin\AppData\Local\Temp\pam.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 7180 | "C:\Users\admin\AppData\Local\ogepag\xkhenp.exe" | C:\Users\admin\AppData\Local\ogepag\xkhenp.exe | pam.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: ZeroTrace Exit code: 3762504530 Version: 1.0.0.0 Modules
| |||||||||||||||
| 7272 | "C:\Users\admin\AppData\Local\Temp\pam.exe" | C:\Users\admin\AppData\Local\Temp\pam.exe | pam.exe | ||||||||||||
User: admin Integrity Level: HIGH Modules
| |||||||||||||||
| 7288 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | pam.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
20 868
Read events
20 798
Write events
67
Delete events
3
Modification events
| (PID) Process: | (7272) pam.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | xkhenp.exe |
Value: C:\Users\admin\AppData\Local\ogepag\xkhenp.exe | |||
| (PID) Process: | (7180) xkhenp.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\xkhenp_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (7180) xkhenp.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\xkhenp_RASAPI32 |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (7180) xkhenp.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\xkhenp_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (7180) xkhenp.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\xkhenp_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (7180) xkhenp.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\xkhenp_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
| (PID) Process: | (7180) xkhenp.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\xkhenp_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (7180) xkhenp.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\xkhenp_RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (7180) xkhenp.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\xkhenp_RASMANCS |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (7180) xkhenp.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\xkhenp_RASMANCS |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
Executable files
3
Suspicious files
3
Text files
8
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5156 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_xkhenp.exe_ece6a4e035ade77dec7b12b9dfd1c7cd862eb546_35e01d9f_7b1eb933-a8bc-45db-868f-808a511f07fa\Report.wer | — | |
MD5:— | SHA256:— | |||
| 5156 | WerFault.exe | C:\Users\admin\AppData\Local\CrashDumps\xkhenp.exe.7180.dmp | — | |
MD5:— | SHA256:— | |||
| 7660 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_yfek2t4l.cxh.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 7924 | powershell.exe | C:\Users\admin\AppData\Local\ogepag\xkhenp.exe | executable | |
MD5:FAB9126369C252CAB5FE698B564BF255 | SHA256:A8F531651F0BBD0347DC5C8EFAD4FE6A236FEE514837BAB1CEDB756039718842 | |||
| 7660 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_nzz0aix2.r5d.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 5156 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WERFA32.tmp.WERInternalMetadata.xml | binary | |
MD5:2C388AEBCDE2780228576035802FC861 | SHA256:30C2F538039C4D9CD530D8F3B200ECDF8B5DE49005F6A0DE781C7E37DD92B5F6 | |||
| 5156 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WERF8AA.tmp.dmp | binary | |
MD5:C80721097E170E5CB5104F00E85C79D8 | SHA256:CAFE4DE6ACB4F1501D936D787B2236A8C20A8DADD7C9F6A8658CB9B4DAA964CF | |||
| 8164 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_hwakqnms.e2i.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 8164 | powershell.exe | C:\Users\admin\AppData\Local\ogepag\stfuhceeg.exe | executable | |
MD5:D14D03CE4A44C3889568222A0178110A | SHA256:4766C3B3926D290A0EDE215988BF674C328D6637B18197837B1B0FDE713A7B4D | |||
| 5156 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WERFA61.tmp.xml | xml | |
MD5:96AC74883B03D8A6DCFA16FAE68A5028 | SHA256:A95C03BE3C889BFAFC94C5DB0C94946EF29EC7CB98029B6F21831C876EDCE205 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
29
DNS requests
19
Threats
23
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | GET | 200 | 2.20.245.139:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
7924 | powershell.exe | GET | 200 | 77.110.118.27:5002 | http://77.110.118.27:5002/st1.exe | unknown | — | — | unknown |
8164 | powershell.exe | GET | 200 | 77.110.118.27:5002 | http://77.110.118.27:5002/cl2.exe | unknown | — | — | unknown |
6544 | svchost.exe | GET | 200 | 23.51.98.7:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
4920 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
4920 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2104 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 2.20.245.139:80 | crl.microsoft.com | Akamai International B.V. | SE | whitelisted |
5496 | MoUsoCoreWorker.exe | 2.23.246.101:80 | www.microsoft.com | Ooredoo Q.S.C. | QA | whitelisted |
— | — | 2.23.246.101:80 | www.microsoft.com | Ooredoo Q.S.C. | QA | whitelisted |
5496 | MoUsoCoreWorker.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 172.211.123.248:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6544 | svchost.exe | 40.126.32.138:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
ipinfo.io |
| whitelisted |
api.telegram.org |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
7924 | powershell.exe | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |
7924 | powershell.exe | Potentially Bad Traffic | ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile |
7924 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
7924 | powershell.exe | Misc activity | ET INFO Request for EXE via Powershell |
7924 | powershell.exe | Potentially Bad Traffic | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response |
7924 | powershell.exe | Potential Corporate Privacy Violation | ET INFO PE EXE or DLL Windows file download HTTP |
7924 | powershell.exe | Misc activity | ET INFO EXE - Served Attached HTTP |
7180 | xkhenp.exe | Device Retrieving External IP Address Detected | ET INFO Possible External IP Lookup Domain Observed in SNI (ipinfo. io) |
2196 | svchost.exe | Device Retrieving External IP Address Detected | ET INFO External IP Lookup Domain in DNS Lookup (ipinfo .io) |
7180 | xkhenp.exe | Device Retrieving External IP Address Detected | ET INFO External IP Lookup SSL Cert Observed (ipinfo .io) |