File name:

SecuriteInfo.com.IL.Trojan.MSILZilla.30886.28966.14387

Full analysis: https://app.any.run/tasks/85fd854c-1d76-4e22-9608-e8726f51b246
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: November 09, 2023, 04:32:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
opendir
loader
gcleaner
stealc
stealer
evasion
amadey
botnet
smoke
phishing
privateloader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

ACA63B9E4AB5A783F11B125C71112242

SHA1:

82BABA92A2C1B320921AD05E56A5890F62697CF3

SHA256:

BAA0CB3BC60D90CFBE000D58B1E4FF06888722BFA81C68EF1486E7E48BA8740A

SSDEEP:

3072:m14iwt2CbSxPZVgwWij3tpuA6y+JrQTyy1G:m14i1CbSxRSpirt6y4C

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • SecuriteInfo.com.IL.Trojan.MSILZilla.30886.28966.14387.exe (PID: 2600)
      • explorer.exe (PID: 1944)

    • Create files in the Startup directory

      • CasPol.exe (PID: 2216)

    • Drops the executable file immediately after the start

      • CasPol.exe (PID: 2216)
      • ugbcmuwwFSnO95XZW7AA0tti.exe (PID: 2408)
      • nEud18VqsrduQL71sjEO9A7R.exe (PID: 688)
      • B5jzgU6zAoh3YKAvZrsoxE5C.exe (PID: 1940)
      • dLU2QMHGwPdQRsBLpbT0UhfT.exe (PID: 2220)
      • 1260521668.exe (PID: 2456)
      • Utsysc.exe (PID: 2492)
      • FPgG0XAkVoXc2lHGGyxtP51v.exe (PID: 308)
      • updater.exe (PID: 3056)

    • STEALC has been detected (SURICATA)

      • dLU2QMHGwPdQRsBLpbT0UhfT.exe (PID: 2220)

    • GCLEANER has been detected (SURICATA)

      • B5jzgU6zAoh3YKAvZrsoxE5C.exe (PID: 1940)

    • Connects to the CnC server

      • dLU2QMHGwPdQRsBLpbT0UhfT.exe (PID: 2220)
      • explorer.exe (PID: 1944)
      • 0iKe2ksxj7r6XHCrqCoEylUI.exe (PID: 2464)

    • Runs injected code in another process

      • hunU9LeEDys0MgJ5O4NFUw2W.exe (PID: 1784)

    • Application was injected by another process

      • explorer.exe (PID: 1944)

    • Steals credentials

      • dLU2QMHGwPdQRsBLpbT0UhfT.exe (PID: 2220)
      • rundll32.exe (PID: 2732)
      • rundll32.exe (PID: 2972)

    • Changes the autorun value in the registry

      • Utsysc.exe (PID: 2492)

    • Uses Task Scheduler to run other applications

      • Utsysc.exe (PID: 2492)
      • explorer.exe (PID: 1944)

    • AMADEY has been detected (SURICATA)

      • Utsysc.exe (PID: 2492)

    • Steals credentials from Web Browsers

      • dLU2QMHGwPdQRsBLpbT0UhfT.exe (PID: 2220)
      • rundll32.exe (PID: 2732)
      • rundll32.exe (PID: 2972)

    • Starts CMD.EXE for self-deleting

      • dLU2QMHGwPdQRsBLpbT0UhfT.exe (PID: 2220)
      • B5jzgU6zAoh3YKAvZrsoxE5C.exe (PID: 1940)

    • SMOKE has been detected (SURICATA)

      • explorer.exe (PID: 1944)

    • Unusual connection from system programs

      • rundll32.exe (PID: 2732)
      • rundll32.exe (PID: 2972)
      • rundll32.exe (PID: 2952)
      • rundll32.exe (PID: 2484)

    • Actions looks like stealing of personal data

      • rundll32.exe (PID: 2732)
      • dLU2QMHGwPdQRsBLpbT0UhfT.exe (PID: 2220)
      • 0iKe2ksxj7r6XHCrqCoEylUI.exe (PID: 2464)
      • rundll32.exe (PID: 2972)

    • Modifies hosts file to block updates

      • FPgG0XAkVoXc2lHGGyxtP51v.exe (PID: 308)

    • Creates a writable file the system directory

      • powershell.exe (PID: 3020)
      • 0iKe2ksxj7r6XHCrqCoEylUI.exe (PID: 2464)

    • PRIVATELOADER has been detected (SURICATA)

      • 0iKe2ksxj7r6XHCrqCoEylUI.exe (PID: 2464)

  • SUSPICIOUS

    • Reads settings of System Certificates

      • CasPol.exe (PID: 2216)
      • dLU2QMHGwPdQRsBLpbT0UhfT.exe (PID: 2220)
      • B5jzgU6zAoh3YKAvZrsoxE5C.exe (PID: 1940)
      • 0iKe2ksxj7r6XHCrqCoEylUI.exe (PID: 2464)

    • Script adds exclusion path to Windows Defender

      • SecuriteInfo.com.IL.Trojan.MSILZilla.30886.28966.14387.exe (PID: 2600)
      • explorer.exe (PID: 1944)

    • Reads the Internet Settings

      • CasPol.exe (PID: 2216)
      • SecuriteInfo.com.IL.Trojan.MSILZilla.30886.28966.14387.exe (PID: 2600)
      • dLU2QMHGwPdQRsBLpbT0UhfT.exe (PID: 2220)
      • B5jzgU6zAoh3YKAvZrsoxE5C.exe (PID: 1940)
      • 1260521668.exe (PID: 2456)
      • Utsysc.exe (PID: 2492)
      • cmd.exe (PID: 2856)
      • rundll32.exe (PID: 2732)
      • Utsysc.exe (PID: 1764)
      • powershell.exe (PID: 2712)
      • rundll32.exe (PID: 2972)
      • rundll32.exe (PID: 2952)
      • 0iKe2ksxj7r6XHCrqCoEylUI.exe (PID: 2464)
      • rundll32.exe (PID: 2484)
      • Utsysc.exe (PID: 2260)

    • Starts POWERSHELL.EXE for commands execution

      • SecuriteInfo.com.IL.Trojan.MSILZilla.30886.28966.14387.exe (PID: 2600)
      • explorer.exe (PID: 1944)

    • Application launched itself

      • hunU9LeEDys0MgJ5O4NFUw2W.exe (PID: 312)
      • B5jzgU6zAoh3YKAvZrsoxE5C.exe (PID: 648)
      • explorer.exe (PID: 1944)

    • Process requests binary or script from the Internet

      • CasPol.exe (PID: 2216)
      • dLU2QMHGwPdQRsBLpbT0UhfT.exe (PID: 2220)
      • Utsysc.exe (PID: 2492)

    • Connects to the server without a host name

      • CasPol.exe (PID: 2216)
      • B5jzgU6zAoh3YKAvZrsoxE5C.exe (PID: 1940)
      • 0iKe2ksxj7r6XHCrqCoEylUI.exe (PID: 2464)

    • Reads security settings of Internet Explorer

      • dLU2QMHGwPdQRsBLpbT0UhfT.exe (PID: 2220)
      • 0iKe2ksxj7r6XHCrqCoEylUI.exe (PID: 2464)

    • Checks Windows Trust Settings

      • dLU2QMHGwPdQRsBLpbT0UhfT.exe (PID: 2220)
      • 0iKe2ksxj7r6XHCrqCoEylUI.exe (PID: 2464)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • dLU2QMHGwPdQRsBLpbT0UhfT.exe (PID: 2220)

    • Connects to unusual port

      • dLU2QMHGwPdQRsBLpbT0UhfT.exe (PID: 2220)
      • explorer.exe (PID: 984)

    • Searches for installed software

      • dLU2QMHGwPdQRsBLpbT0UhfT.exe (PID: 2220)

    • Starts CMD.EXE for commands execution

      • B5jzgU6zAoh3YKAvZrsoxE5C.exe (PID: 1940)
      • dLU2QMHGwPdQRsBLpbT0UhfT.exe (PID: 2220)
      • explorer.exe (PID: 1944)

    • Starts itself from another location

      • 1260521668.exe (PID: 2456)

    • The process drops Mozilla's DLL files

      • dLU2QMHGwPdQRsBLpbT0UhfT.exe (PID: 2220)

    • The process drops C-runtime libraries

      • dLU2QMHGwPdQRsBLpbT0UhfT.exe (PID: 2220)

    • Process drops legitimate windows executable

      • dLU2QMHGwPdQRsBLpbT0UhfT.exe (PID: 2220)

    • Reads browser cookies

      • dLU2QMHGwPdQRsBLpbT0UhfT.exe (PID: 2220)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 1492)

    • Uses RUNDLL32.EXE to load library

      • rundll32.exe (PID: 2260)
      • rundll32.exe (PID: 2396)

    • Loads DLL from Mozilla Firefox

      • rundll32.exe (PID: 2732)
      • rundll32.exe (PID: 2972)

    • Accesses Microsoft Outlook profiles

      • rundll32.exe (PID: 2732)
      • rundll32.exe (PID: 2972)

    • Uses NETSH.EXE to obtain data on the network

      • rundll32.exe (PID: 2732)
      • rundll32.exe (PID: 2972)

    • The process executes via Task Scheduler

      • Utsysc.exe (PID: 1764)
      • Utsysc.exe (PID: 2260)

    • Uses powercfg.exe to modify the power settings

      • cmd.exe (PID: 2320)
      • cmd.exe (PID: 1556)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 1164)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 2160)
      • cmd.exe (PID: 2640)

    • Executes as Windows Service

      • updater.exe (PID: 3056)
      • raserver.exe (PID: 1696)

    • Drops a system driver (possible attempt to evade defenses)

      • updater.exe (PID: 3056)

    • Unusual connection from system programs

      • powershell.exe (PID: 3020)

    • The Powershell connects to the Internet

      • powershell.exe (PID: 3020)

    • Reads the BIOS version

      • 0iKe2ksxj7r6XHCrqCoEylUI.exe (PID: 2464)

    • Checks for external IP

      • 0iKe2ksxj7r6XHCrqCoEylUI.exe (PID: 2464)

  • INFO

    • Reads the machine GUID from the registry

      • SecuriteInfo.com.IL.Trojan.MSILZilla.30886.28966.14387.exe (PID: 2600)
      • CasPol.exe (PID: 2216)
      • dLU2QMHGwPdQRsBLpbT0UhfT.exe (PID: 2220)
      • B5jzgU6zAoh3YKAvZrsoxE5C.exe (PID: 1940)
      • Utsysc.exe (PID: 2492)
      • 2KpHlJSCa39xRpGmijiDY5an.exe (PID: 2440)
      • 6kJ4P6T6tCYCLqC7ZZCu4H8j.exe (PID: 1268)
      • 0iKe2ksxj7r6XHCrqCoEylUI.exe (PID: 2464)

    • Reads the computer name

      • SecuriteInfo.com.IL.Trojan.MSILZilla.30886.28966.14387.exe (PID: 2600)
      • CasPol.exe (PID: 2216)
      • dLU2QMHGwPdQRsBLpbT0UhfT.exe (PID: 2220)
      • ugbcmuwwFSnO95XZW7AA0tti.exe (PID: 2408)
      • B5jzgU6zAoh3YKAvZrsoxE5C.exe (PID: 1940)
      • Broom.exe (PID: 2412)
      • ZRrXarxyDbf2YAXhpkJ5EIUD.exe (PID: 2496)
      • 1260521668.exe (PID: 2456)
      • Utsysc.exe (PID: 2492)
      • 6kJ4P6T6tCYCLqC7ZZCu4H8j.exe (PID: 1268)
      • 2KpHlJSCa39xRpGmijiDY5an.exe (PID: 2440)
      • 0iKe2ksxj7r6XHCrqCoEylUI.exe (PID: 2464)

    • Checks supported languages

      • SecuriteInfo.com.IL.Trojan.MSILZilla.30886.28966.14387.exe (PID: 2600)
      • CasPol.exe (PID: 2216)
      • hunU9LeEDys0MgJ5O4NFUw2W.exe (PID: 312)
      • B5jzgU6zAoh3YKAvZrsoxE5C.exe (PID: 648)
      • dLU2QMHGwPdQRsBLpbT0UhfT.exe (PID: 2220)
      • hunU9LeEDys0MgJ5O4NFUw2W.exe (PID: 1784)
      • ugbcmuwwFSnO95XZW7AA0tti.exe (PID: 2408)
      • B5jzgU6zAoh3YKAvZrsoxE5C.exe (PID: 1940)
      • Broom.exe (PID: 2412)
      • nEud18VqsrduQL71sjEO9A7R.exe (PID: 688)
      • ZRrXarxyDbf2YAXhpkJ5EIUD.exe (PID: 2496)
      • 2KpHlJSCa39xRpGmijiDY5an.exe (PID: 2440)
      • 6kJ4P6T6tCYCLqC7ZZCu4H8j.exe (PID: 1268)
      • 1260521668.exe (PID: 2456)
      • Utsysc.exe (PID: 2492)
      • FPgG0XAkVoXc2lHGGyxtP51v.exe (PID: 308)
      • Utsysc.exe (PID: 1764)
      • updater.exe (PID: 3056)
      • 0iKe2ksxj7r6XHCrqCoEylUI.exe (PID: 2464)
      • Utsysc.exe (PID: 2260)

    • Reads Environment values

      • CasPol.exe (PID: 2216)
      • dLU2QMHGwPdQRsBLpbT0UhfT.exe (PID: 2220)

    • Creates files or folders in the user directory

      • CasPol.exe (PID: 2216)
      • dLU2QMHGwPdQRsBLpbT0UhfT.exe (PID: 2220)
      • B5jzgU6zAoh3YKAvZrsoxE5C.exe (PID: 1940)
      • explorer.exe (PID: 1944)
      • Utsysc.exe (PID: 2492)
      • 0iKe2ksxj7r6XHCrqCoEylUI.exe (PID: 2464)

    • Create files in a temporary directory

      • CasPol.exe (PID: 2216)
      • ugbcmuwwFSnO95XZW7AA0tti.exe (PID: 2408)
      • nEud18VqsrduQL71sjEO9A7R.exe (PID: 688)
      • B5jzgU6zAoh3YKAvZrsoxE5C.exe (PID: 1940)
      • 1260521668.exe (PID: 2456)
      • Utsysc.exe (PID: 2492)
      • FPgG0XAkVoXc2lHGGyxtP51v.exe (PID: 308)

    • Checks proxy server information

      • dLU2QMHGwPdQRsBLpbT0UhfT.exe (PID: 2220)
      • B5jzgU6zAoh3YKAvZrsoxE5C.exe (PID: 1940)
      • Utsysc.exe (PID: 2492)
      • rundll32.exe (PID: 2732)
      • rundll32.exe (PID: 2972)
      • rundll32.exe (PID: 2952)
      • 0iKe2ksxj7r6XHCrqCoEylUI.exe (PID: 2464)
      • rundll32.exe (PID: 2484)

    • Reads product name

      • dLU2QMHGwPdQRsBLpbT0UhfT.exe (PID: 2220)

    • Reads CPU info

      • dLU2QMHGwPdQRsBLpbT0UhfT.exe (PID: 2220)

    • Creates files in the program directory

      • dLU2QMHGwPdQRsBLpbT0UhfT.exe (PID: 2220)
      • FPgG0XAkVoXc2lHGGyxtP51v.exe (PID: 308)

    • The executable file from the user directory is run by the CMD process

      • 1260521668.exe (PID: 2456)

    • Drops the executable file immediately after the start

      • explorer.exe (PID: 1944)

    • Reads the Internet Settings

      • explorer.exe (PID: 1944)

    • Process checks are UAC notifies on

      • 0iKe2ksxj7r6XHCrqCoEylUI.exe (PID: 2464)

    • Process checks computer location settings

      • 0iKe2ksxj7r6XHCrqCoEylUI.exe (PID: 2464)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:11:07 19:07:31+01:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 124551
InitializedDataSize: 3072
UninitializedDataSize: -
EntryPoint: 0x20681
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 6.93.266.9
ProductVersionNumber: 6.93.266.9
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: ofexIbu
FileDescription: OYiYA abOLa OhuXAY uCikoqEi UxOb euUNaI.
FileVersion: 6.93.266.9
InternalName: IVuviBO
LegalCopyright: © 2023 ofexIbu.
OriginalFileName: omuQId
ProductName: OlUmeNOi
ProductVersion: 6.93.266.9
Comments: AVevuziIOgi EiIye aJAdavUia UzOl AfOp OtAve iZIQiCImOZO.
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
71
Malicious processes
21
Suspicious processes
2

Behavior graph

Click at the process to see the details
start inject securiteinfo.com.il.trojan.msilzilla.30886.28966.14387.exe no specs powershell.exe no specs caspol.exe hunu9leedys0mgj5o4nfuw2w.exe no specs b5jzgu6zaoh3ykavzrsoxe5c.exe no specs #STEALC dlu2qmhgwpdqrsblpbt0uhft.exe hunu9leedys0mgj5o4nfuw2w.exe no specs ugbcmuwwfsno95xzw7aa0tti.exe no specs ugbcmuwwfsno95xzw7aa0tti.exe #GCLEANER b5jzgu6zaoh3ykavzrsoxe5c.exe broom.exe no specs neud18vqsrduql71sjeo9a7r.exe no specs zrrxarxydbf2yaxhpkj5eiud.exe 2kphljsca39xrpgmijidy5an.exe no specs 6kj4p6t6tcyclqc7zzcu4h8j.exe no specs cmd.exe no specs 1260521668.exe no specs fpgg0xakvoxc2lhggyxtp51v.exe no specs #AMADEY utsysc.exe fpgg0xakvoxc2lhggyxtp51v.exe schtasks.exe no specs cmd.exe no specs cmd.exe no specs timeout.exe no specs #SMOKE explorer.exe rundll32.exe no specs rundll32.exe netsh.exe no specs utsysc.exe no specs cmd.exe no specs powershell.exe taskkill.exe no specs cmd.exe sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs cmd.exe schtasks.exe powercfg.exe no specs schtasks.exe powercfg.exe no specs powercfg.exe no specs schtasks.exe updater.exe no specs powercfg.exe no specs rundll32.exe no specs rundll32.exe netsh.exe no specs powershell.exe rundll32.exe cmd.exe sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs schtasks.exe cmd.exe powercfg.exe no specs powercfg.exe no specs conhost.exe powercfg.exe no specs explorer.exe powercfg.exe no specs 0ike2ksxj7r6xhcrqcoeylui.exe no specs #PRIVATELOADER 0ike2ksxj7r6xhcrqcoeylui.exe rundll32.exe raserver.exe no specs utsysc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
308"C:\Users\admin\Pictures\FPgG0XAkVoXc2lHGGyxtP51v.exe" C:\Users\admin\Pictures\FPgG0XAkVoXc2lHGGyxtP51v.exe
CasPol.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\pictures\fpgg0xakvoxc2lhggyxtp51v.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
312"C:\Users\admin\Pictures\hunU9LeEDys0MgJ5O4NFUw2W.exe" C:\Users\admin\Pictures\hunU9LeEDys0MgJ5O4NFUw2W.exe—CasPol.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\pictures\hunu9leedys0mgj5o4nfuw2w.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
364"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\admin\AppData\Local\Temp\5125296e5f\Utsysc.exe" /FC:\Windows\SysWOW64\schtasks.exe—Utsysc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
392"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\admin\AppData\Local\Temp\1260521668.exe"C:\Windows\SysWOW64\cmd.exe—B5jzgU6zAoh3YKAvZrsoxE5C.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
648"C:\Users\admin\Pictures\B5jzgU6zAoh3YKAvZrsoxE5C.exe" C:\Users\admin\Pictures\B5jzgU6zAoh3YKAvZrsoxE5C.exe—CasPol.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\pictures\b5jzgu6zaoh3ykavzrsoxe5c.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
688"C:\Users\admin\Pictures\nEud18VqsrduQL71sjEO9A7R.exe" --silent --allusers=0C:\Users\admin\Pictures\nEud18VqsrduQL71sjEO9A7R.exe—CasPol.exe
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera Installer
Exit code:
0
Version:
104.0.4944.36
Modules
Images
c:\users\admin\pictures\neud18vqsrduql71sjeo9a7r.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
712sc stop WaaSMedicSvc C:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
812C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\admin\AppData\Local\Temp\tlxvacrdjkek.xml"C:\Windows\System32\schtasks.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
812C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Windows\TEMP\tlxvacrdjkek.xml"C:\Windows\System32\schtasks.exe
explorer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
952netsh wlan show profilesC:\Windows\System32\netsh.exe—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
Total events
25 129
Read events
24 807
Write events
304
Delete events
18

Modification events

(PID) Process:(1944) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000088AF72B0747534094337F63DE35C94A000000000200000000001066000000010000200000003A7AE26404D75DF41C31FF40C5EA8CE90BAF74FA9E9BD7A9ACA34C7048350C1E000000000E8000000002000020000000BD2D56D46506C12C41A6A70B10E79EE53CB79EF36FD2BA8CDD2460CB8F4BE86A300000009B5D1418CBF2EB49F3C4BD4C21D58CA55B82FA3D3ED08AF0EF59D6C7ECAFC1055FA323A80FF7C154B1C9B60253392B6640000000DED9FDCC168073324C3013F1BB125E066EB1A2F09FD2C8E7CC7A793AA992E21EF1C942BF7294D04E036428704009B863B1CB981B97312E2530E3E816780CF7C9
(PID) Process:(2600) SecuriteInfo.com.IL.Trojan.MSILZilla.30886.28966.14387.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2600) SecuriteInfo.com.IL.Trojan.MSILZilla.30886.28966.14387.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2600) SecuriteInfo.com.IL.Trojan.MSILZilla.30886.28966.14387.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2600) SecuriteInfo.com.IL.Trojan.MSILZilla.30886.28966.14387.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2216) CasPol.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2216) CasPol.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2216) CasPol.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2216) CasPol.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2216) CasPol.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\156\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
47
Suspicious files
30
Text files
24
Unknown types
0

Dropped files

PID
Process
Filename
Type
2688powershell.exeC:\Users\admin\AppData\Local\Temp\4rrzzgez.kkl.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2216CasPol.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rvD9Uh32eAiUWIlWpndcTcCd.battext
MD5:551C094FD9FA59F53712942B17C3C861
SHA256:84E4F8AC550F97F873F4BB72C54F9636B8B9CA75F13C30A9D755296DF3EC385E
2216CasPol.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:D2EA26272B29FF50BA34005F5A7C8904
SHA256:A4257D9548AE2C7230B681211579C2DB5E726A363E6C43303A006C5F1BA4C24A
2216CasPol.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
2216CasPol.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\diNZO6Ju1QuyXdnbOdInEkAq.battext
MD5:DA4DC5159590C47D79E773BCFD41B568
SHA256:149A93E06C5ECDEC428E80D07803E06061842F0413B7022F68A24B056C422FD9
2216CasPol.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cWNW1W269g8rBAMfjoV1wrYF.battext
MD5:215EC79401F7A5EEA6208ECE34D8DDA9
SHA256:D8CC534C3F48E98E08D7BAF6E91FBA1D3FDB36D791D1CF82C5C27F84B953D95B
2216CasPol.exeC:\Users\admin\AppData\Local\Temp\CabAE66.tmpcompressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
2216CasPol.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yJhL1PbjVCXIov1qA13ZnUpZ.battext
MD5:1678F55E2FD81934827D9A256DD4D33D
SHA256:175D90C35D32104217A9E66A064C98EC21EDE781C504E96D8BB6EF1BD0AAA76D
2688powershell.exeC:\Users\admin\AppData\Local\Temp\q4suzkr4.pjo.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2216CasPol.exeC:\Users\admin\AppData\Local\sRT5FIRBYyNVK3oT41ztRfpI.exehtml
MD5:FCAD815E470706329E4E327194ACC07C
SHA256:280D939A66A0107297091B3B6F86D6529EF6FAC222A85DBC82822C3D5DC372B8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
66
TCP/UDP connections
62
DNS requests
39
Threats
118

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2220
dLU2QMHGwPdQRsBLpbT0UhfT.exe
GET
200
116.203.165.60:2087
http://116.203.165.60:2087/
unknown
—
—
unknown
2216
CasPol.exe
GET
200
95.214.26.28:80
http://galandskiyher5.com/downloads/toolspub1.exe
unknown
executable
318 Kb
unknown
2216
CasPol.exe
GET
200
194.49.94.48:80
http://194.49.94.48/InstallSetup3.exe
unknown
executable
2.55 Mb
unknown
2216
CasPol.exe
GET
200
194.49.94.67:80
http://194.49.94.67/files/My2.exe
unknown
executable
5.24 Mb
unknown
2216
CasPol.exe
GET
301
185.26.182.111:80
http://net.geo.opera.com/opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767
unknown
html
162 b
unknown
2216
CasPol.exe
GET
200
85.209.11.204:80
http://85.209.11.204/api/files/software/s5.exe
unknown
executable
387 Kb
unknown
2216
CasPol.exe
GET
200
89.191.234.21:80
http://gobo11fc.top/build.exe
unknown
executable
324 Kb
unknown
2216
CasPol.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?f0f0f46a9543f796
unknown
compressed
61.6 Kb
unknown
2220
dLU2QMHGwPdQRsBLpbT0UhfT.exe
POST
200
116.203.165.60:2087
http://116.203.165.60:2087/
unknown
text
48 b
unknown
1940
B5jzgU6zAoh3YKAvZrsoxE5C.exe
GET
200
85.209.11.204:80
http://85.209.11.204/api/files/client/s51
unknown
executable
887 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2216
CasPol.exe
188.114.96.3:443
yip.su
CLOUDFLARENET
NL
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2216
CasPol.exe
104.20.68.143:443
pastebin.com
CLOUDFLARENET
—
unknown
2216
CasPol.exe
177.229.198.250:443
etiquetaspiura.com
Mega Cable, S.A. de C.V.
MX
unknown
2216
CasPol.exe
103.55.39.107:443
wahyurahmat.id
PT Cloud Hosting Indonesia
ID
unknown
2216
CasPol.exe
85.209.11.204:80
—
LLC Baxet
RU
malicious
2216
CasPol.exe
95.214.26.28:80
galandskiyher5.com
Enes Koken
US
unknown
2216
CasPol.exe
194.49.94.48:80
—
Enes Koken
DE
unknown

DNS requests

Domain
IP
Reputation
pastebin.com
  • 104.20.68.143
  • 172.67.34.170
  • 104.20.67.143
shared
yip.su
  • 188.114.96.3
  • 188.114.97.3
whitelisted
etiquetaspiura.com
  • 177.229.198.250
unknown
wahyurahmat.id
  • 103.55.39.107
unknown
galandskiyher5.com
  • 95.214.26.28
malicious
flyawayaero.net
  • 104.21.93.225
  • 172.67.216.81
unknown
gons07fc.top
  • —
unknown
gobo11fc.top
  • 89.191.234.21
unknown
lycheepanel.info
  • 172.67.187.122
  • 104.21.32.208
unknown
laubenstein.space
  • —
unknown

Threats

PID
Process
Class
Message
324
svchost.exe
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
324
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2216
CasPol.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
2216
CasPol.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2216
CasPol.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
2216
CasPol.exe
Potentially Bad Traffic
ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
2216
CasPol.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2216
CasPol.exe
Misc activity
ET INFO Packed Executable Download
2216
CasPol.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2216
CasPol.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
11 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SecuriteInfo.com.IL.Trojan.MSILZilla.30886.28966.14387