File name:

2025-05-02_e0fe81cc6f25a19c4f3bd90daf2c0ced_amadey_elex_karagany_rhadamanthys_smoke-loader

Full analysis: https://app.any.run/tasks/20ebb3be-7c24-460a-9d4f-b5dde5f7f7e8
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Analysis date: May 02, 2025, 12:54:36
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
sality
sainbox
rat
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

E0FE81CC6F25A19C4F3BD90DAF2C0CED

SHA1:

B49DE5908E000DC0CECB22C14822F5B947D9CABC

SHA256:

B6B5F65A3076D91726CD27EF66D15D3109DF3ED89463E7810C73E341FAB04E14

SSDEEP:

6144:Ny5+GReZGY7EUoKT+blZdEEHckDog9ytcTcE2AJ:NyDAEsEfKCJTPckDog9ytcTcE2AJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • SALITY mutex has been found

      • 2025-05-02_e0fe81cc6f25a19c4f3bd90daf2c0ced_amadey_elex_karagany_rhadamanthys_smoke-loader.exe (PID: 7728)
      • FileCoAuth.exe (PID: 8108)
    • Runs injected code in another process

      • 2025-05-02_e0fe81cc6f25a19c4f3bd90daf2c0ced_amadey_elex_karagany_rhadamanthys_smoke-loader.exe (PID: 7728)
    • Application was injected by another process

      • FileCoAuth.exe (PID: 8108)
    • SAINBOX has been detected

      • 2025-05-02_e0fe81cc6f25a19c4f3bd90daf2c0ced_amadey_elex_karagany_rhadamanthys_smoke-loader.exe (PID: 7728)
  • SUSPICIOUS

    • Process drops legitimate windows executable

      • 2025-05-02_e0fe81cc6f25a19c4f3bd90daf2c0ced_amadey_elex_karagany_rhadamanthys_smoke-loader.exe (PID: 7728)
    • Executable content was dropped or overwritten

      • 2025-05-02_e0fe81cc6f25a19c4f3bd90daf2c0ced_amadey_elex_karagany_rhadamanthys_smoke-loader.exe (PID: 7728)
  • INFO

    • Checks supported languages

      • 2025-05-02_e0fe81cc6f25a19c4f3bd90daf2c0ced_amadey_elex_karagany_rhadamanthys_smoke-loader.exe (PID: 7728)
    • Reads the computer name

      • 2025-05-02_e0fe81cc6f25a19c4f3bd90daf2c0ced_amadey_elex_karagany_rhadamanthys_smoke-loader.exe (PID: 7728)
    • UPX packer has been detected

      • 2025-05-02_e0fe81cc6f25a19c4f3bd90daf2c0ced_amadey_elex_karagany_rhadamanthys_smoke-loader.exe (PID: 7728)
    • Create files in a temporary directory

      • 2025-05-02_e0fe81cc6f25a19c4f3bd90daf2c0ced_amadey_elex_karagany_rhadamanthys_smoke-loader.exe (PID: 7728)
    • The sample compiled with english language support

      • 2025-05-02_e0fe81cc6f25a19c4f3bd90daf2c0ced_amadey_elex_karagany_rhadamanthys_smoke-loader.exe (PID: 7728)
    • Checks proxy server information

      • slui.exe (PID: 4776)
    • Reads the software policy settings

      • slui.exe (PID: 4776)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:07:23 11:24:53+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 62464
InitializedDataSize: 31232
UninitializedDataSize: -
EntryPoint: 0x49aa
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.1.4.0
ProductVersionNumber: 1.1.4.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Unknown (0009)
CharacterSet: Unicode
CompanyName: Waves Audio Ltd.
FileDescription: Waves MaxxAudio Service Application
FileVersion: 1.1.4.0
InternalName: WavesSvc.exe
LegalCopyright: Waves Audio Ltd. Copyright (C) 2013
OriginalFileName: WavesSvc.exe
ProductName: Waves MaxxAudio
ProductVersion: 1.1.4.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
127
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #SALITY 2025-05-02_e0fe81cc6f25a19c4f3bd90daf2c0ced_amadey_elex_karagany_rhadamanthys_smoke-loader.exe #SALITY filecoauth.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
4776C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7728"C:\Users\admin\Desktop\2025-05-02_e0fe81cc6f25a19c4f3bd90daf2c0ced_amadey_elex_karagany_rhadamanthys_smoke-loader.exe" C:\Users\admin\Desktop\2025-05-02_e0fe81cc6f25a19c4f3bd90daf2c0ced_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
explorer.exe
User:
admin
Company:
Waves Audio Ltd.
Integrity Level:
MEDIUM
Description:
Waves MaxxAudio Service Application
Version:
1.1.4.0
Modules
Images
c:\users\admin\desktop\2025-05-02_e0fe81cc6f25a19c4f3bd90daf2c0ced_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
8108C:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exe -EmbeddingC:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft OneDriveFile Co-Authoring Executable
Exit code:
0
Version:
19.043.0304.0013
Modules
Images
c:\users\admin\appdata\local\microsoft\onedrive\19.043.0304.0013\filecoauth.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
Total events
3 630
Read events
3 618
Write events
12
Delete events
0

Modification events

(PID) Process:(7728) 2025-05-02_e0fe81cc6f25a19c4f3bd90daf2c0ced_amadey_elex_karagany_rhadamanthys_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:GlobalUserOffline
Value:
0
(PID) Process:(7728) 2025-05-02_e0fe81cc6f25a19c4f3bd90daf2c0ced_amadey_elex_karagany_rhadamanthys_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Aaspp\-227342143
Operation:writeName:1768776801
Value:
147
(PID) Process:(7728) 2025-05-02_e0fe81cc6f25a19c4f3bd90daf2c0ced_amadey_elex_karagany_rhadamanthys_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Aaspp\-227342143
Operation:writeName:-757413694
Value:
0
(PID) Process:(7728) 2025-05-02_e0fe81cc6f25a19c4f3bd90daf2c0ced_amadey_elex_karagany_rhadamanthys_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Aaspp\-227342143
Operation:writeName:1011363107
Value:
0
(PID) Process:(7728) 2025-05-02_e0fe81cc6f25a19c4f3bd90daf2c0ced_amadey_elex_karagany_rhadamanthys_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Aaspp\-227342143
Operation:writeName:-1514827388
Value:
35
(PID) Process:(7728) 2025-05-02_e0fe81cc6f25a19c4f3bd90daf2c0ced_amadey_elex_karagany_rhadamanthys_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Aaspp\-227342143
Operation:writeName:253949413
Value:
417
(PID) Process:(7728) 2025-05-02_e0fe81cc6f25a19c4f3bd90daf2c0ced_amadey_elex_karagany_rhadamanthys_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Aaspp\-227342143
Operation:writeName:2022726214
Value:
0C00687474703A2F2F7777772E737961747475732E636F6D2E62722F696D616765732F6C6F676F2E67696600687474703A2F2F7A616E7A6F756C2E6179612E636F6D2E73792F6C6F676F2E67696600687474703A2F2F636172676F6372797374616C2E636F6D2F6C6F676F2E67696600687474703A2F2F6162632D6B656D656A612E66722F696D672F62616E6E65722E67696600687474703A2F2F64656E6E792D64657369676E732E636F6D2F6C6F676F2E67696600687474703A2F2F61626576612E6E6C2F62616E6E65722E67696600687474703A2F2F736577616B696F736F6E6C696E652E636F6D2F6C6F676F2E67696600687474703A2F2F7363676C6F62616C2E636F6D2E70682F6C6F676F2E67696600687474703A2F2F7777772E64726F7073766964656F2E636F6D2E62722F6C6F676F2E67696600687474703A2F2F746865636C65616E657267726F75702E636F6D2E62722F6C6F676F2E67696600687474703A2F2F33656E65726A69656C656B7472696B2E636F6D2F6C6F676F2E67696600687474703A2F2F73616D617965722E6E65742F6C6F676F2E676966
(PID) Process:(7728) 2025-05-02_e0fe81cc6f25a19c4f3bd90daf2c0ced_amadey_elex_karagany_rhadamanthys_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Aaspp\-227342143
Operation:writeName:-503464281
Value:
4F7A36E77864F6283C8BFC443556E56991DAAF587D07A64539B130AE61394A8EB44525E489676F5B94D3316BE188E7E8FF09D63C91939DB6892F0DAEC5413E4D90FAABF4575C6A88FC296A4299FB48DB1C97CFAC4583B0DEFB1BE28720F59424AFC57F37E7C389A6960F98164D9C241027AF2ACBF21B3BB85511EEE485A26795
(PID) Process:(7728) 2025-05-02_e0fe81cc6f25a19c4f3bd90daf2c0ced_amadey_elex_karagany_rhadamanthys_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Aaspp
Operation:writeName:a1_0
Value:
(PID) Process:(7728) 2025-05-02_e0fe81cc6f25a19c4f3bd90daf2c0ced_amadey_elex_karagany_rhadamanthys_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Aaspp
Operation:writeName:a2_0
Value:
5517
Executable files
2
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
8108FileCoAuth.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2025-05-02.1255.8108.1.aodlbinary
MD5:28DCA2FF4B34B5A52A2E59DF202A6ED3
SHA256:33BACCB7296F1ED1F995FC77A23049F261CF391AC0388F9E8DD161F8C17B7F94
77282025-05-02_e0fe81cc6f25a19c4f3bd90daf2c0ced_amadey_elex_karagany_rhadamanthys_smoke-loader.exeC:\Users\admin\AppData\Local\Temp\wlrfn.exeexecutable
MD5:E92D3A824A0578A50D2DD81B5060145F
SHA256:87F53BC444C05230CE439DBB127C03F2E374067D6FB08E91C834371FD9ECF661
77282025-05-02_e0fe81cc6f25a19c4f3bd90daf2c0ced_amadey_elex_karagany_rhadamanthys_smoke-loader.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\OneDrive.exeexecutable
MD5:CF1A1B2A6F227D5B06AB0B3C8B88618B
SHA256:1FD250A499B2912B1ACEC31A03CAA32F1B328F2861E1383E94F23386F724FB36
8108FileCoAuth.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2025-05-02.1255.8108.1.odlbinary
MD5:819B5AC87E574E1FEA0041EB8A603622
SHA256:678B5DD9952FB8C67712F546C614B817F17D36176789FBB584E973DA6B789FF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
24
TCP/UDP connections
42
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.216.77.26:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
2104
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
GET
304
52.149.20.212:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
GET
200
52.149.20.212:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
5508
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
whitelisted
GET
200
13.85.23.206:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
5508
SIHClient.exe
GET
200
23.216.77.35:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
whitelisted
5508
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
5508
SIHClient.exe
GET
200
23.216.77.35:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
whitelisted
5508
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
whitelisted
2104
svchost.exe
23.216.77.26:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7476
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
5508
SIHClient.exe
52.149.20.212:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
google.com
  • 142.250.185.142
whitelisted
crl.microsoft.com
  • 23.216.77.26
  • 23.216.77.27
  • 23.216.77.36
  • 23.216.77.32
  • 23.216.77.33
  • 23.216.77.28
  • 23.216.77.21
  • 23.216.77.30
  • 23.216.77.35
  • 23.216.77.8
  • 23.216.77.13
  • 23.216.77.6
  • 23.216.77.38
  • 23.216.77.37
  • 23.216.77.41
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
login.live.com
  • 40.126.31.130
  • 40.126.31.67
  • 40.126.31.73
  • 40.126.31.129
  • 20.190.159.71
  • 20.190.159.128
  • 20.190.159.75
  • 40.126.31.69
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

No threats detected
No debug info