File name:

2025-03-24_03af5c4c381160615e3f0152f0dbfb7a_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader

Full analysis: https://app.any.run/tasks/2278ef96-6d1d-4966-adac-82d3d00dec91
Verdict: Malicious activity
Analysis date: March 24, 2025, 15:06:34
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

03AF5C4C381160615E3F0152F0DBFB7A

SHA1:

39CC79E446A63CEF50FCA06B791B2A34EC5128D6

SHA256:

BA9975D7B959933CA46C85FDE8DCFCC7E594950C4B87F05A5195C639866532FF

SSDEEP:

98304:iefUuZuKAuf5jTF0kOefUuZuKAuf5jTFrkHVrGDYwOwjefUuZuKAuf5jTFPkOefX:BD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 2025-03-24_03af5c4c381160615e3f0152f0dbfb7a_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader~4.exe (PID: 7876)

    • Starts NET.EXE for service management

      • net.exe (PID: 6072)
      • net.exe (PID: 6392)
      • cmd.exe (PID: 7948)
      • cmd.exe (PID: 8024)
      • net.exe (PID: 6724)
      • cmd.exe (PID: 7968)
      • cmd.exe (PID: 7992)
      • cmd.exe (PID: 8008)
      • net.exe (PID: 3620)
      • net.exe (PID: 7036)

    • Uses NET.EXE to stop Windows Update service

      • cmd.exe (PID: 7968)
      • net.exe (PID: 3620)

    • Starts NET.EXE to view/add/change user profiles

      • cmd.exe (PID: 8052)
      • net.exe (PID: 5008)

    • Uses NET.EXE to stop Windows Security Center service

      • cmd.exe (PID: 7992)
      • net.exe (PID: 7036)

    • Starts NET.EXE to view/change users localgroup

      • cmd.exe (PID: 8060)
      • net.exe (PID: 4620)

  • SUSPICIOUS

    • Starts a Microsoft application from unusual location

      • 2025-03-24_03af5c4c381160615e3f0152f0dbfb7a_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe (PID: 7584)
      • 2025-03-24_03af5c4c381160615e3f0152f0dbfb7a_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe (PID: 7692)

    • Executing commands from a ".bat" file

      • 2025-03-24_03af5c4c381160615e3f0152f0dbfb7a_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe (PID: 7692)
      • UpdatAuto.exe (PID: 7800)

    • Starts CMD.EXE for commands execution

      • 2025-03-24_03af5c4c381160615e3f0152f0dbfb7a_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe (PID: 7692)
      • UpdatAuto.exe (PID: 7800)

    • Starts itself from another location

      • 2025-03-24_03af5c4c381160615e3f0152f0dbfb7a_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe (PID: 7692)

    • Executable content was dropped or overwritten

      • 2025-03-24_03af5c4c381160615e3f0152f0dbfb7a_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe (PID: 7692)
      • UpdatAuto.exe (PID: 7800)

    • Process drops legitimate windows executable

      • 2025-03-24_03af5c4c381160615e3f0152f0dbfb7a_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe (PID: 7692)
      • UpdatAuto.exe (PID: 7800)

    • Windows service management via SC.EXE

      • sc.exe (PID: 960)
      • sc.exe (PID: 472)
      • sc.exe (PID: 7272)
      • sc.exe (PID: 7316)
      • sc.exe (PID: 7288)

    • Creates file in the systems drive root

      • UpdatAuto.exe (PID: 7800)
      • 2025-03-24_03af5c4c381160615e3f0152f0dbfb7a_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe (PID: 7692)

  • INFO

    • Checks supported languages

      • 2025-03-24_03af5c4c381160615e3f0152f0dbfb7a_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe (PID: 7692)
      • UpdatAuto.exe (PID: 7800)
      • 2025-03-24_03af5c4c381160615e3f0152f0dbfb7a_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader~4.exe (PID: 7876)

    • Create files in a temporary directory

      • 2025-03-24_03af5c4c381160615e3f0152f0dbfb7a_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe (PID: 7692)
      • UpdatAuto.exe (PID: 7800)

    • The sample compiled with english language support

      • 2025-03-24_03af5c4c381160615e3f0152f0dbfb7a_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe (PID: 7692)

    • Reads the computer name

      • UpdatAuto.exe (PID: 7800)

    • Creates files in the program directory

      • 2025-03-24_03af5c4c381160615e3f0152f0dbfb7a_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe (PID: 7692)
      • UpdatAuto.exe (PID: 7800)

    • The sample compiled with chinese language support

      • 2025-03-24_03af5c4c381160615e3f0152f0dbfb7a_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe (PID: 7692)
      • UpdatAuto.exe (PID: 7800)

    • Checks proxy server information

      • slui.exe (PID: 4464)

    • Reads the software policy settings

      • slui.exe (PID: 4464)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Microsoft Visual Basic 6 (63.9)
.exe | Win32 Executable MS Visual C++ (generic) (24.3)
.dll | Win32 Dynamic Link Library (generic) (5.1)
.exe | Win32 Executable (generic) (3.5)
.exe | Generic Win/DOS Executable (1.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2007:03:12 04:30:52+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 102400
InitializedDataSize: 16384
UninitializedDataSize: -
EntryPoint: 0x27dc
OSVersion: 4
ImageVersion: 6.1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 6.1.0.0
ProductVersionNumber: 6.1.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
Comments: Windows Update Manager for NT
CompanyName: Microsoft Corporation
FileDescription: Windows Update Manager for NT
LegalCopyright: Copyright (C) Microsoft Corp. 1981-1999
ProductName: Microsoft(R) Windows (R) 2000 Operating System
FileVersion: 6.01
ProductVersion: 6.01
InternalName: INCUBUS
OriginalFileName: INCUBUS.exe
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
165
Monitored processes
48
Malicious processes
4
Suspicious processes
7

Behavior graph

Click at the process to see the details
start 2025-03-24_03af5c4c381160615e3f0152f0dbfb7a_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe cmd.exe no specs conhost.exe no specs updatauto.exe cmd.exe no specs conhost.exe no specs 2025-03-24_03af5c4c381160615e3f0152f0dbfb7a_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader~4.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs net.exe no specs net.exe no specs net1.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net.exe no specs net.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net.exe no specs net1.exe no specs slui.exe 2025-03-24_03af5c4c381160615e3f0152f0dbfb7a_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
472sc config SharedAccess start= disabledC:\Windows\SysWOW64\sc.exe—2025-03-24_03af5c4c381160615e3f0152f0dbfb7a_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
960sc config srservice start= disabledC:\Windows\SysWOW64\sc.exe—2025-03-24_03af5c4c381160615e3f0152f0dbfb7a_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1760C:\WINDOWS\system32\net1 start TlntSvrC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
2140C:\WINDOWS\system32\net1 user helpassistant 123456C:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
2420C:\WINDOWS\system32\net1 stop wscsvcC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
3620net stop wuauservC:\Windows\SysWOW64\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4464C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4620net localgroup administrators helpassistant /addC:\Windows\SysWOW64\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4696C:\WINDOWS\system32\net1 localgroup administrators helpassistant /addC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
4976C:\WINDOWS\system32\net1 stop srserviceC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
Total events
3 976
Read events
3 976
Write events
0
Delete events
0

Modification events

No data
Executable files
20
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
76922025-03-24_03af5c4c381160615e3f0152f0dbfb7a_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exeexecutable
MD5:D34A0E86096400F03520E03605151D13
SHA256:2B6E95928A5A592C95ACB4235707C47730F11A1224867C134B9F7382BBFAB478
76922025-03-24_03af5c4c381160615e3f0152f0dbfb7a_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exeC:\ntldr~6executable
MD5:A96169AA3B3224C240EE44157EA03609
SHA256:88CA0A089F0A3ECE0A9537C88E86079FCA9F7A3D95D269C956A1CD7E26646C9F
76922025-03-24_03af5c4c381160615e3f0152f0dbfb7a_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe —
MD5:—
SHA256:—
7800UpdatAuto.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe —
MD5:—
SHA256:—
7800UpdatAuto.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exeexecutable
MD5:309AA380638DCFE5FB9EAB7C6C6E15EF
SHA256:198B6818F00D97B4D2E2B1F3C703AAD21A45632A8E2F64B78435EE94B07F3989
76922025-03-24_03af5c4c381160615e3f0152f0dbfb7a_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exeC:\Users\admin\Desktop\2025-03-24_03af5c4c381160615e3f0152f0dbfb7a_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader~4.exeexecutable
MD5:BAEDE5E132F93DC1924680C9BB406BA9
SHA256:5ED8881E4E0008D53E6F86232BE898A2D7A165EF351D78F3F98A8DDF40538D71
76922025-03-24_03af5c4c381160615e3f0152f0dbfb7a_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exeC:\ntldr~8executable
MD5:A96169AA3B3224C240EE44157EA03609
SHA256:88CA0A089F0A3ECE0A9537C88E86079FCA9F7A3D95D269C956A1CD7E26646C9F
7800UpdatAuto.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeexecutable
MD5:6B313D78B367E206A9D2C969813F3BF5
SHA256:199385D33D53F5143438182D569D11B6F4FF4BDB1CC3D8363B62F76FC99CF469
76922025-03-24_03af5c4c381160615e3f0152f0dbfb7a_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exeC:\Windows\SysWOW64\UpdatAuto.exeexecutable
MD5:A96169AA3B3224C240EE44157EA03609
SHA256:88CA0A089F0A3ECE0A9537C88E86079FCA9F7A3D95D269C956A1CD7E26646C9F
76922025-03-24_03af5c4c381160615e3f0152f0dbfb7a_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader.exeC:\Windows\SysWOW64\Option.battext
MD5:1D04ABF39E9DF55EED1D04430CC21EB8
SHA256:0BC485263CF8A962E64DB0B88F156F2A9AF1B81ECFDB1CF9111D497E85DF70F3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
17
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2920
svchost.exe
GET
200
23.48.23.144:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5084
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2920
svchost.exe
23.48.23.144:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4464
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
  • 20.73.194.208
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.142
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
crl.microsoft.com
  • 23.48.23.144
  • 23.48.23.151
  • 23.48.23.147
  • 23.48.23.154
  • 23.48.23.155
  • 23.48.23.153
  • 23.48.23.161
  • 23.48.23.139
  • 23.48.23.156
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-03-24_03af5c4c381160615e3f0152f0dbfb7a_amadey_coinminer_hijackloader_rhadamanthys_smoke-loader