File name:

ZP4KZDHVHWZZ2DC13DMX.exe

Full analysis: https://app.any.run/tasks/5d0a809b-3a88-4738-b95f-94b9d02832fb
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: October 18, 2024, 20:49:31
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
xor-url
generic
amadey
rdp
botnet
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

E779C31D6EA71643CA1F9DCDBCD978FA

SHA1:

0B101C3BB1318777477D4EC71E8E068CE098C22F

SHA256:

B1AAB072AC9B3880CBFB087BDD3E7DFECAACE4DE5BC7D00E4A7238FEEB05C787

SSDEEP:

98304:V6DFjBbIVmUz8YCH7DzqI9bVtylbEGUIqLOPH3BwEqSrwwfBXpOIEYPTu13pIdL9:HH0dpB8hex+85rscAZqTLmhNelF0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Known privilege escalation attack

      • dllhost.exe (PID: 1084)

    • XORed URL has been found (YARA)

      • ZP4KZDHVHWZZ2DC13DMX.exe (PID: 5080)

    • AMADEY has been detected (YARA)

      • explorer.exe (PID: 7136)

    • Connects to the CnC server

      • explorer.exe (PID: 7136)

    • AMADEY has been detected (SURICATA)

      • explorer.exe (PID: 7136)

  • SUSPICIOUS

    • Starts application with an unusual extension

      • ZP4KZDHVHWZZ2DC13DMX.exe (PID: 5080)

    • There is functionality for enable RDP (YARA)

      • explorer.exe (PID: 7136)

    • Contacting a server suspected of hosting an CnC

      • explorer.exe (PID: 7136)

  • INFO

    • Checks supported languages

      • ZP4KZDHVHWZZ2DC13DMX.exe (PID: 4956)
      • ZP4KZDHVHWZZ2DC13DMX.exe (PID: 5080)
      • more.com (PID: 4304)

    • Reads the machine GUID from the registry

      • ZP4KZDHVHWZZ2DC13DMX.exe (PID: 4956)

    • Create files in a temporary directory

      • ZP4KZDHVHWZZ2DC13DMX.exe (PID: 4956)
      • ZP4KZDHVHWZZ2DC13DMX.exe (PID: 5080)
      • more.com (PID: 4304)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 1084)

    • Reads the computer name

      • ZP4KZDHVHWZZ2DC13DMX.exe (PID: 4956)
      • ZP4KZDHVHWZZ2DC13DMX.exe (PID: 5080)
      • more.com (PID: 4304)

    • The process uses the downloaded file

      • dllhost.exe (PID: 1084)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

xor-url

(PID) Process(5080) ZP4KZDHVHWZZ2DC13DMX.exe
Decrypted-URLs (1)http://oksoft.pro/

Amadey

(PID) Process(7136) explorer.exe
C2tipinfodownload-soft1.com
Strings (124)Kaspersky Lab
ProductName
------
POST
ESET
random
bi:
S-%lu-
Doctor Web
GET
Bitdefender
-unicode-
tipinfodownload-soft2.com
#
ar:
/Plugins/
cred.dll
VideoID
83cb987fd9
/quiet
wb
/g9jvjfd73/index.php
e3
&&
Powershell.exe
"
\
cmd /C RMDIR /s/q
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
un:
cred.dll|clip.dll|
e2
Programs
msi
av:
r=
DefaultSettings.YResolution
AVG
dm:
rb
Panda Security
" && timeout 1 && del
Main
zip
5.03
SOFTWARE\Microsoft\Windows NT\CurrentVersion
%-lu
Norton
/H9djwes81jd3/index.php
e1
Comodo
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
2016
CurrentBuild
Sophos
/0sg8e3jndw/index.php
<d>
ComputerName
pc:
GetNativeSystemInfo
abcdefghijklmnopqrstuvwxyz0123456789-_
d1
lv:
AVAST Software
tipinfodownload-soft1.com
:::
Rem
exe
|
vs:
--
https://
WinDefender
st=s
tipinfodownload-soft3.com
&unit=
Startup
=
kernel32.dll
ProgramData\
rundll32.exe
id:
sd:
" && ren
/k
.jpg
+++
-executionpolicy remotesigned -File "
"taskkill /f /im "
cmd
?scr=1
360TotalSecurity
0123456789
dll
shell32.dll
Content-Type: multipart/form-data; boundary=----
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Content-Disposition: form-data; name="data"; filename="
-%lu
------
\0000
ps1
Avira
clip.dll
2019
&& Exit"
rundll32
SYSTEM\ControlSet001\Services\BasicDisplay\Video
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
\App
http://
%USERPROFILE%
shutdown -s -t 0
" Content-Type: application/octet-stream
Content-Type: application/x-www-form-urlencoded
Gxtuum.exe
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
og:
<c>
DefaultSettings.XResolution
os:
2025
2022
No Malware configuration.

TRiD

.exe | Inno Setup installer (67.7)
.exe | Win32 EXE PECompact compressed (generic) (25.6)
.exe | Win32 Executable (generic) (2.7)
.exe | Win16/32 Executable Delphi generic (1.2)
.exe | Generic Win/DOS Executable (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:12:31 00:28:59+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 4797440
InitializedDataSize: 3997184
UninitializedDataSize: -
EntryPoint: 0x494304
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 2.7.0.3468
ProductVersionNumber: 2.7.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: OK SOFT LLC
FileDescription: Another Level
FileVersion: 2.7.0.3468
InternalName: Another Level
LegalCopyright: OK SOFT LLC
LegalTrademarks: OK SOFT LLC
OriginalFileName: AnotherLevel.exe
ProductName: Another Level
ProductVersion: 2.7
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
118
Monitored processes
6
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start zp4kzdhvhwzz2dc13dmx.exe no specs CMSTPLUA #XOR-URL zp4kzdhvhwzz2dc13dmx.exe no specs more.com no specs conhost.exe no specs THREAT explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
1084C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\SysWOW64\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\combase.dll
4076\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—more.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4304C:\WINDOWS\SysWOW64\more.comC:\Windows\SysWOW64\more.com—ZP4KZDHVHWZZ2DC13DMX.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
More Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\more.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ulib.dll
4956"C:\Users\admin\Desktop\ZP4KZDHVHWZZ2DC13DMX.exe" C:\Users\admin\Desktop\ZP4KZDHVHWZZ2DC13DMX.exe—explorer.exe
User:
admin
Company:
OK SOFT LLC
Integrity Level:
MEDIUM
Description:
Another Level
Exit code:
0
Version:
2.7.0.3468
Modules
Images
c:\users\admin\desktop\zp4kzdhvhwzz2dc13dmx.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
5080"C:\Users\admin\Desktop\ZP4KZDHVHWZZ2DC13DMX.exe" C:\Users\admin\Desktop\ZP4KZDHVHWZZ2DC13DMX.exe
dllhost.exe
User:
admin
Company:
OK SOFT LLC
Integrity Level:
HIGH
Description:
Another Level
Exit code:
1
Version:
2.7.0.3468
Modules
Images
c:\users\admin\desktop\zp4kzdhvhwzz2dc13dmx.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\oleaut32.dll
c:\windows\syswow64\msvcp_win.dll
xor-url
(PID) Process(5080) ZP4KZDHVHWZZ2DC13DMX.exe
Decrypted-URLs (1)http://oksoft.pro/
7136C:\WINDOWS\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe
more.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\gtrm
c:\windows\syswow64\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcp_win.dll
Amadey
(PID) Process(7136) explorer.exe
C2tipinfodownload-soft1.com
Strings (124)Kaspersky Lab
ProductName
------
POST
ESET
random
bi:
S-%lu-
Doctor Web
GET
Bitdefender
-unicode-
tipinfodownload-soft2.com
#
ar:
/Plugins/
cred.dll
VideoID
83cb987fd9
/quiet
wb
/g9jvjfd73/index.php
e3
&&
Powershell.exe
"
\
cmd /C RMDIR /s/q
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
un:
cred.dll|clip.dll|
e2
Programs
msi
av:
r=
DefaultSettings.YResolution
AVG
dm:
rb
Panda Security
" && timeout 1 && del
Main
zip
5.03
SOFTWARE\Microsoft\Windows NT\CurrentVersion
%-lu
Norton
/H9djwes81jd3/index.php
e1
Comodo
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
2016
CurrentBuild
Sophos
/0sg8e3jndw/index.php
<d>
ComputerName
pc:
GetNativeSystemInfo
abcdefghijklmnopqrstuvwxyz0123456789-_
d1
lv:
AVAST Software
tipinfodownload-soft1.com
:::
Rem
exe
|
vs:
--
https://
WinDefender
st=s
tipinfodownload-soft3.com
&unit=
Startup
=
kernel32.dll
ProgramData\
rundll32.exe
id:
sd:
" && ren
/k
.jpg
+++
-executionpolicy remotesigned -File "
"taskkill /f /im "
cmd
?scr=1
360TotalSecurity
0123456789
dll
shell32.dll
Content-Type: multipart/form-data; boundary=----
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Content-Disposition: form-data; name="data"; filename="
-%lu
------
\0000
ps1
Avira
clip.dll
2019
&& Exit"
rundll32
SYSTEM\ControlSet001\Services\BasicDisplay\Video
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
\App
http://
%USERPROFILE%
shutdown -s -t 0
" Content-Type: application/octet-stream
Content-Type: application/x-www-form-urlencoded
Gxtuum.exe
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
og:
<c>
DefaultSettings.XResolution
os:
2025
2022
Total events
4 313
Read events
4 309
Write events
4
Delete events
0

Modification events

(PID) Process:(1084) dllhost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(7136) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7136) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7136) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
0
Suspicious files
3
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
4304more.comC:\Users\admin\AppData\Local\Temp\gtrm —
MD5:—
SHA256:—
4304more.comC:\Windows\Tasks\VMware Workstation.jobbinary
MD5:7DA2A55AA05D19FFB80206C429055C89
SHA256:0E3BAB53B6A1F0D828439A54F255F98945AE6116287791CA9BAE8E13F722C17F
4304more.comC:\Users\admin\AppData\Local\Temp\vaivqkeuasbinary
MD5:BBD3BF7A641DDB46D076E28B0F554465
SHA256:556E37B26DE5E712A078BED478C24AEDDD7071B655BAEA1D8AA6E0E545869BA2
5080ZP4KZDHVHWZZ2DC13DMX.exeC:\Users\admin\AppData\Local\Temp\7bcbc29aimage
MD5:40880DDCE05703B7DF41059C48CE4585
SHA256:56DE7A623C01E3F53781A3771AC027719087E85AA22B5BC10B56EF801EBB82FA
5080ZP4KZDHVHWZZ2DC13DMX.exeC:\Users\admin\AppData\Local\Temp\7c074c41binary
MD5:8043AFB9E7192E432B78FE508CB380B5
SHA256:FC967A9641F7537DA0F48946BAFDFD9CEE01839E46C281AF2C247E1B0EE10ABA
4956ZP4KZDHVHWZZ2DC13DMX.exeC:\Users\admin\AppData\Local\Temp\7b63c702image
MD5:40880DDCE05703B7DF41059C48CE4585
SHA256:56DE7A623C01E3F53781A3771AC027719087E85AA22B5BC10B56EF801EBB82FA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
33
DNS requests
11
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6944
svchost.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7136
explorer.exe
POST
301
188.114.97.3:80
http://tipinfodownload-soft2.com/H9djwes81jd3/index.php
unknown
—
—
malicious
6944
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
404
172.67.196.178:443
https://tipinfodownload-soft3.com/0sg8e3jndw/index.php
unknown
—
—
unknown
7136
explorer.exe
POST
200
188.114.97.3:80
http://tipinfodownload-soft1.com/g9jvjfd73/index.php
unknown
—
—
malicious
7136
explorer.exe
POST
301
172.67.196.178:80
http://tipinfodownload-soft3.com/0sg8e3jndw/index.php
unknown
—
—
malicious
7136
explorer.exe
POST
200
188.114.97.3:80
http://tipinfodownload-soft1.com/g9jvjfd73/index.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4360
SearchApp.exe
2.23.209.187:443
www.bing.com
Akamai International B.V.
GB
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6944
svchost.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6944
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5488
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4020
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
www.bing.com
  • 2.23.209.187
  • 2.23.209.149
  • 2.23.209.130
  • 2.23.209.140
  • 2.23.209.182
  • 2.23.209.133
  • 2.23.209.179
  • 104.126.37.176
  • 104.126.37.160
  • 104.126.37.169
  • 104.126.37.171
  • 104.126.37.168
  • 104.126.37.155
  • 104.126.37.177
  • 104.126.37.163
  • 104.126.37.161
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
self.events.data.microsoft.com
  • 20.44.10.122
whitelisted
tipinfodownload-soft1.com
  • 188.114.97.3
  • 188.114.96.3
malicious
tipinfodownload-soft3.com
  • 172.67.196.178
  • 104.21.52.75
malicious
tipinfodownload-soft2.com
  • 188.114.97.3
  • 188.114.96.3
malicious

Threats

PID
Process
Class
Message
7136
explorer.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
7136
explorer.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
7136
explorer.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
6 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ZP4KZDHVHWZZ2DC13DMX.exe