File name:

6523.exe

Full analysis: https://app.any.run/tasks/24500a1f-61a8-490b-8e0c-75449e6cc68b
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: August 24, 2023, 15:07:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
loader
smoke
stealer
redline
amadey
trojan
ransomware
stop
fabookie
vidar
arkei
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

F6D72F673EE8F3DA01014DFDCCE476F2

SHA1:

075D81F03B2AE15F95FD0A87D329A933D1B328E6

SHA256:

BF375CDE510406F6CBE633C67360D65D5852A89DEC7EE555CCA04812A7F04313

SSDEEP:

3072:KSdr5Y4TCy+dCzA4isaFpGbsZAUuoanfmiZpPtWtMmEPFP9z+Y:K8/+dN4hwG7Uu9T6ymEPFP9z+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was injected by another process

      • explorer.exe (PID: 1924)

    • Runs injected code in another process

      • 6523.exe (PID: 3720)

    • Connects to the CnC server

      • explorer.exe (PID: 1924)
      • AppLaunch.exe (PID: 3908)
      • AppLaunch.exe (PID: 2536)
      • yiueea.exe (PID: 3196)
      • aafg31.exe (PID: 2664)
      • build2.exe (PID: 1064)

    • SMOKE was detected

      • explorer.exe (PID: 1924)

    • Application was dropped or rewritten from another process

      • 5DD0.exe (PID: 2892)
      • 5FD5.exe (PID: 4012)
      • D469.exe (PID: 1976)
      • D469.exe (PID: 2224)
      • toolspub2.exe (PID: 2144)
      • toolspub2.exe (PID: 2632)
      • latestplayer.exe (PID: 1680)
      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 1636)
      • yiueea.exe (PID: 3196)
      • 42F5.exe (PID: 2524)
      • 42F5.exe (PID: 1036)
      • 42F5.exe (PID: 1080)
      • 42F5.exe (PID: 2308)
      • D469.exe (PID: 3044)
      • D469.exe (PID: 3452)
      • build2.exe (PID: 2384)
      • build3.exe (PID: 2836)
      • build2.exe (PID: 1064)

    • REDLINE was detected

      • AppLaunch.exe (PID: 3908)
      • AppLaunch.exe (PID: 2536)

    • REDLINE detected by memory dumps

      • AppLaunch.exe (PID: 2536)
      • AppLaunch.exe (PID: 3908)

    • Changes the autorun value in the registry

      • yiueea.exe (PID: 3196)

    • Uses Task Scheduler to run other applications

      • yiueea.exe (PID: 3196)
      • build3.exe (PID: 2836)

    • Registers / Runs the DLL via REGSVR32.EXE

      • explorer.exe (PID: 1924)

    • AMADEY was detected

      • yiueea.exe (PID: 3196)

    • Loads dropped or rewritten executable

      • regsvr32.exe (PID: 3716)

    • Stop is detected

      • 42F5.exe (PID: 2308)
      • D469.exe (PID: 3452)

    • FABOOKIE was detected

      • aafg31.exe (PID: 2664)

    • Actions looks like stealing of personal data

      • aafg31.exe (PID: 2664)

    • VIDAR was detected

      • build2.exe (PID: 1064)

    • ARKEI was detected

      • build2.exe (PID: 1064)

    • AMADEY detected by memory dumps

      • yiueea.exe (PID: 3196)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • explorer.exe (PID: 1924)
      • 397D.exe (PID: 2940)
      • latestplayer.exe (PID: 1680)
      • 42F5.exe (PID: 1036)
      • D469.exe (PID: 3452)
      • build3.exe (PID: 2836)

    • Connects to unusual port

      • AppLaunch.exe (PID: 2536)
      • AppLaunch.exe (PID: 3908)
      • build2.exe (PID: 1064)

    • Process requests binary or script from the Internet

      • explorer.exe (PID: 1924)
      • 42F5.exe (PID: 2308)
      • D469.exe (PID: 3452)

    • Application launched itself

      • D469.exe (PID: 1976)
      • toolspub2.exe (PID: 2144)
      • cmd.exe (PID: 2672)
      • 42F5.exe (PID: 2524)
      • 42F5.exe (PID: 1080)
      • 42F5.exe (PID: 1036)
      • D469.exe (PID: 2224)
      • D469.exe (PID: 3044)
      • build2.exe (PID: 2384)

    • Reads the Internet Settings

      • D469.exe (PID: 2224)
      • 397D.exe (PID: 2940)
      • aafg31.exe (PID: 2664)
      • latestplayer.exe (PID: 1680)
      • yiueea.exe (PID: 3196)
      • 42F5.exe (PID: 1036)
      • 42F5.exe (PID: 2308)
      • D469.exe (PID: 3452)
      • build2.exe (PID: 1064)

    • Connects to the server without a host name

      • explorer.exe (PID: 1924)
      • yiueea.exe (PID: 3196)

    • Starts itself from another location

      • latestplayer.exe (PID: 1680)

    • Starts CMD.EXE for commands execution

      • yiueea.exe (PID: 3196)
      • cmd.exe (PID: 2672)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 2672)
      • 42F5.exe (PID: 1036)

    • Reads settings of System Certificates

      • 42F5.exe (PID: 1036)
      • 42F5.exe (PID: 2308)
      • D469.exe (PID: 3452)
      • aafg31.exe (PID: 2664)
      • build2.exe (PID: 1064)

    • Adds/modifies Windows certificates

      • 42F5.exe (PID: 2524)
      • 42F5.exe (PID: 1080)
      • build2.exe (PID: 2384)

    • Checks Windows Trust Settings

      • 42F5.exe (PID: 1036)
      • aafg31.exe (PID: 2664)
      • 42F5.exe (PID: 2308)
      • build2.exe (PID: 1064)
      • D469.exe (PID: 3452)

    • Reads security settings of Internet Explorer

      • 42F5.exe (PID: 1036)
      • 42F5.exe (PID: 2308)
      • D469.exe (PID: 3452)
      • aafg31.exe (PID: 2664)
      • build2.exe (PID: 1064)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • build2.exe (PID: 1064)

    • The process checks if it is being run in the virtual environment

      • regsvr32.exe (PID: 3716)

  • INFO

    • Checks supported languages

      • 6523.exe (PID: 3720)
      • AppLaunch.exe (PID: 2536)
      • 5DD0.exe (PID: 2892)
      • AppLaunch.exe (PID: 3908)
      • 5FD5.exe (PID: 4012)
      • D469.exe (PID: 1976)
      • D469.exe (PID: 2224)
      • 397D.exe (PID: 2940)
      • aafg31.exe (PID: 2664)
      • latestplayer.exe (PID: 1680)
      • toolspub2.exe (PID: 2144)
      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 1636)
      • toolspub2.exe (PID: 2632)
      • yiueea.exe (PID: 3196)
      • 42F5.exe (PID: 2524)
      • 42F5.exe (PID: 1036)
      • 42F5.exe (PID: 2308)
      • 42F5.exe (PID: 1080)
      • D469.exe (PID: 3044)
      • D469.exe (PID: 3452)
      • build3.exe (PID: 2836)
      • build2.exe (PID: 1064)
      • build2.exe (PID: 2384)

    • Creates files or folders in the user directory

      • explorer.exe (PID: 1924)
      • 42F5.exe (PID: 1036)
      • D469.exe (PID: 3452)
      • 42F5.exe (PID: 2308)
      • build3.exe (PID: 2836)
      • aafg31.exe (PID: 2664)
      • build2.exe (PID: 1064)

    • Reads the Internet Settings

      • explorer.exe (PID: 1924)

    • Create files in a temporary directory

      • explorer.exe (PID: 1924)
      • 397D.exe (PID: 2940)
      • latestplayer.exe (PID: 1680)
      • aafg31.exe (PID: 2664)

    • Reads the machine GUID from the registry

      • AppLaunch.exe (PID: 3908)
      • AppLaunch.exe (PID: 2536)
      • D469.exe (PID: 2224)
      • aafg31.exe (PID: 2664)
      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 1636)
      • yiueea.exe (PID: 3196)
      • 42F5.exe (PID: 1036)
      • 42F5.exe (PID: 2308)
      • D469.exe (PID: 3452)
      • build2.exe (PID: 1064)

    • Reads the computer name

      • AppLaunch.exe (PID: 2536)
      • AppLaunch.exe (PID: 3908)
      • D469.exe (PID: 2224)
      • 397D.exe (PID: 2940)
      • aafg31.exe (PID: 2664)
      • latestplayer.exe (PID: 1680)
      • yiueea.exe (PID: 3196)
      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 1636)
      • 42F5.exe (PID: 1036)
      • 42F5.exe (PID: 2308)
      • D469.exe (PID: 3452)
      • build2.exe (PID: 1064)

    • Reads Environment values

      • AppLaunch.exe (PID: 2536)
      • AppLaunch.exe (PID: 3908)

    • Checks proxy server information

      • D469.exe (PID: 2224)
      • aafg31.exe (PID: 2664)
      • yiueea.exe (PID: 3196)
      • 42F5.exe (PID: 1036)
      • 42F5.exe (PID: 2308)
      • D469.exe (PID: 3452)
      • build2.exe (PID: 1064)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

RedLine

(PID) Process(3908) AppLaunch.exe
C2 (1)149.202.0.242:31728
Botnet
Err_msgLogsDiller Cloud (TG: @logsdillabot)
Auth_value3a050df92d0cf082b2cdaf87863616be
US (13)
net.tcp://
/
localhost
3a050df92d0cf082b2cdaf87863616be
Authorization
ns1
CjgwRj8TDhssGkcOCwYoQz4TKBYsJxAACC1cTg==
EytYHRBJFRwDNAsVJAUjNxE+fl07MDIWESkCRTo8BR8DQRcDHSsNABE+AQUDQCIJ
Glassy
(PID) Process(2536) AppLaunch.exe
C2 (1)149.202.0.242:31728
Botnet
Err_msgLogsDiller Cloud (TG: @logsdillabot)
Auth_value3a050df92d0cf082b2cdaf87863616be
US (13)
net.tcp://
/
localhost
3a050df92d0cf082b2cdaf87863616be
Authorization
ns1
CjgwRj8TDhssGkcOCwYoQz4TKBYsJxAACC1cTg==
EytYHRBJFRwDNAsVJAUjNxE+fl07MDIWESkCRTo8BR8DQRcDHSsNABE+AQUDQCIJ
Glassy

Amadey

(PID) Process(3196) yiueea.exe
C2 (1)http://79.137.192.18
Version3.87
Options
Drop directoryS-%lu-
Drop name%-lu
Strings (119)-%lu
577f58beff
yiueea.exe
SCHTASKS
/Create /SC MINUTE /MO 1 /TN
/TR "
" /F
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Startup
Rem
cmd /C RMDIR /s/q
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
rundll32
/Delete /TN "
Programs
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
%USERPROFILE%
\App
POST
GET
id=
&vs=
&sd=
&os=
&bi=
&ar=
&pc=
&un=
&dm=
&av=
&lv=
&og=
cred.dll|clip.dll|
d1
e1
e0
Main
http://
https://
exe
dll
cmd
ps1
<c>
<d>
Plugins/
+++
#
|
&unit=
=
shell32.dll
kernel32.dll
GetNativeSystemInfo
ProgramData\
AVAST Software
Avira
Kaspersky Lab
ESET
Panda Security
Doctor Web
AVG
360TotalSecurity
Bitdefender
Norton
Sophos
Comodo
WinDefender
0123456789
rb
wb
Content-Type: multipart/form-data; boundary=----
------
Content-Disposition: form-data; name="data"; filename="
" Content-Type: application/octet-stream
------
--
?scr=1
.jpg
Content-Type: application/x-www-form-urlencoded
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
ComputerName
abcdefghijklmnopqrstuvwxyz0123456789-_
-unicode-
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
SYSTEM\ControlSet001\Services\BasicDisplay\Video
VideoID
\0000
DefaultSettings.XResolution
DefaultSettings.YResolution
SOFTWARE\Microsoft\Windows NT\CurrentVersion
ProductName
2019
2022
2016
CurrentBuild
&&
echo Y|CACLS "
" /P "
:N"
CACLS "
" /P "
:R" /E
:F" /E
&&Exit
..\
\
:::
rundll32.exe
/k
"taskkill /f /im "
" && timeout 1 && del
&& Exit"
" && ren
&&
Powershell.exe
-executionpolicy remotesigned -File "
"
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

ProductVersions: 10.25.70.52
ProductName: Gammy
LegalCopyrights: Challangers kamboja
InternalName: Literally.exe
FileVersion: 46.76.12.71
CompanyName: Thunderstack
CharacterSet: Unknown (85B2)
LanguageCode: Unknown (0293)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 26.0.0.0
FileVersionNumber: 86.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x7db2
UninitializedDataSize: -
InitializedDataSize: 32301568
CodeSize: 154112
LinkerVersion: 10
PEType: PE32
ImageFileCharacteristics: No relocs, Executable, 32-bit
TimeStamp: 2022:05:31 07:26:36+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 31-May-2022 07:26:36
Detected languages:
  • Portuguese - Portugal
CompanyName: Thunderstack
FileVersion: 46.76.12.71
InternalName: Literally.exe
LegalCopyrights: Challangers kamboja
ProductName: Gammy
ProductVersions: 10.25.70.52

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000E0

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 31-May-2022 07:26:36
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00025902
0x00025A00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
5.35933
.data
0x00027000
0x01EBBE48
0x00016800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.24456
.rsrc
0x01EE3000
0x00007508
0x00007600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.04778

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.38159
584
UNKNOWN
UNKNOWN
RT_VERSION
2
4.02242
1736
UNKNOWN
Portuguese - Portugal
RT_ICON
3
3.28195
1384
UNKNOWN
Portuguese - Portugal
RT_ICON
4
2.3839
4264
UNKNOWN
Portuguese - Portugal
RT_ICON
5
2.39543
2440
UNKNOWN
Portuguese - Portugal
RT_ICON
6
2.5278
1128
UNKNOWN
Portuguese - Portugal
RT_ICON
7
3.62407
9640
UNKNOWN
Portuguese - Portugal
RT_ICON
8
3.76944
2440
UNKNOWN
Portuguese - Portugal
RT_ICON
9
2.96984
2216
UNKNOWN
UNKNOWN
RT_CURSOR
24
2.26539
88
UNKNOWN
Portuguese - Portugal
RT_STRING

Imports

GDI32.dll
KERNEL32.dll
USER32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
79
Monitored processes
37
Malicious processes
24
Suspicious processes
3

Behavior graph

Click at the process to see the details
inject start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start 6523.exe no specs #SMOKE explorer.exe 5dd0.exe no specs 5fd5.exe no specs applaunch.exe no specs #REDLINE applaunch.exe #REDLINE applaunch.exe d469.exe no specs d469.exe 397d.exe #FABOOKIE aafg31.exe toolspub2.exe no specs toolspub2.exe no specs 31839b57a4f11171d6abc8bbc4451ee4.exe no specs latestplayer.exe #AMADEY yiueea.exe schtasks.exe no specs cmd.exe no specs cmd.exe no specs cacls.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cacls.exe no specs regsvr32.exe no specs regsvr32.exe no specs 42f5.exe no specs 42f5.exe icacls.exe no specs 42f5.exe #STOP 42f5.exe d469.exe #STOP d469.exe build2.exe no specs build3.exe schtasks.exe no specs #VIDAR build2.exe

Process information

PID
CMD
Path
Indicators
Parent process
308CACLS "yiueea.exe" /P "admin:N"C:\Windows\SysWOW64\cacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Control ACLs Program
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\cacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1036C:\Users\admin\AppData\Local\Temp\42F5.exeC:\Users\admin\AppData\Local\Temp\42F5.exe
42F5.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\42f5.exe
c:\windows\syswow64\ntdll.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
1064"C:\Users\admin\AppData\Local\1eeddeb8-137a-48a4-b7d0-28e9ea8fe9eb\build2.exe" C:\Users\admin\AppData\Local\1eeddeb8-137a-48a4-b7d0-28e9ea8fe9eb\build2.exe
build2.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\1eeddeb8-137a-48a4-b7d0-28e9ea8fe9eb\build2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1080"C:\Users\admin\AppData\Local\Temp\42F5.exe" --Admin IsNotAutoStart IsNotTaskC:\Users\admin\AppData\Local\Temp\42F5.exe
42F5.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\42f5.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\ntdll.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1636"C:\Users\admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe" C:\Users\admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe—397D.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\31839b57a4f11171d6abc8bbc4451ee4.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\system32\user32.dll
1680"C:\Users\admin\AppData\Local\Temp\latestplayer.exe" C:\Users\admin\AppData\Local\Temp\latestplayer.exe
397D.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\latestplayer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1872C:\Windows\system32\cmd.exe /S /D /c" echo Y"C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\syswow64\ntdll.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\wow64.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1912CACLS "..\577f58beff" /P "admin:R" /EC:\Windows\SysWOW64\cacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Control ACLs Program
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\cacls.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1924C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1976C:\Users\admin\AppData\Local\Temp\D469.exeC:\Users\admin\AppData\Local\Temp\D469.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\d469.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
Total events
9 740
Read events
9 576
Write events
162
Delete events
2

Modification events

(PID) Process:(1924) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000088AF72B0747534094337F63DE35C94A00000000020000000000106600000001000020000000DE596CC00FA0CE6036B57F3745DF211B8CEDC7563B5C7C90E189DFBFE4E216FC000000000E800000000200002000000034A09CAFA8980668BD48169E708CCFDA06F4ADAD9A6D0FF324841FD89016AF6F3000000097B2B3329B62DD4C9AB1E283BD9359B999E8411B9FC15AF795BFA67D05007F5CE28F7E84193A17AFEBE2A486810ADC32400000007E5B4D515AE7EE2B367ED77D5D9A272891BC7B3019A3AA7BC4BF2CA5315073E7F321A33013E44AD95CE9A5E9CA3FF01D3584C54FECFB9C1227BA4AE46F87EAF7
(PID) Process:(1924) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:HRZR_PGYFRFFVBA
Value:
00000000B6000000F2000000C1A364001500000007000000041F06007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C0063006D0064002E006500780065000000EA02000000000540008000000000542DADFFFE070000000000000000000068006B02000000005C00010000000000000000000000000000003D0000000000EB1A92770000000068006B020000000000000000FE0700002825B6FFFE070000A08886020000000018006B020000000000000000000000000100000000000000BF1DADFFFE07000060E1EA020000000060B888020000000000000000000000003B9462FDFE070000B00C88020000000008006B02000000005C00010000000000869A807700000000BE313C4A62B00000820200000000000000000000000000005C000100000000000000000000000000820200000000000002000000000000005C000100000000000000000000000000820200000000000080A6E0FF00000000C812D2FF00000000B00C88020000000001000000000000000F0000C000000000B000060000000000820200000000000001000000000000008202000000000000DB9B8077000000005C00010000000000000000000000000000000000000000000100000000000000000000000000000081020000000000000000000000000000000000000000000000000000060000002400000067510B004D006900630072006F0073006F00660074002E00570069006E0064006F00770073002E0043006F006E00740072006F006C00500061006E0065006C00000000000000000000000000000000008202000000000000010000000000000001000000000000008202000000000000D46905FCFE07000010E2EA020000000016798077000000000000000000000000869A807700000000000000000000000030E14A0000000000010000000000000010E2EA02000000000000000000000000CF41394A62B00000FFFFFFFFFFFFFFFF010000000000000000FF490000000000A0000500000000000000000000000000586705FCFE0700000000000000000000A0000500000000002B10000000000000807580770000000000000000000000000000000000000000000000000000000001000000000000001500000007000000790E06007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C0063006D0064002E006500780065000000EA02000000000540008000000000542D8CFFFE070000000000000000000068006C02000000005C0001000000000000000000000000000000280000000000EB1A6E770000000068006C020000000000000000FE070000282595FFFE070000A00D33000000000018006C02000000001B000000C86719007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C007400610073006B006D00670072002E00650078006500000041003900440043003700300042004200420034007D000000280000000000340000C000000000D48028000000000080BE28000000000000000000000000003E0040000000000060E3EA0200000000E0A4C30700000000350100C000000000C8037C770000000000000000000000007010000000000000A07D28000000000000000000000000001480280000000000D03B2B000000000048DD6F7700000000360038000000000020EBEA0200000000F8DCEA0200000000E905707700000000F1DCEA0200000000E0A4C30700000000140000000600000098E705007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C0063006D0064002E00650078006500000067FEFE0700000000000000000000F012FD020000000000000000000000000000000000000000F012FD020000000012C266FEFE070000010000000000000000000000000000000000000000000000F012FD02000000000000000000000000000000000000000000000000
(PID) Process:(1924) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:HRZR_PGYFRFFVBA
Value:
00000000B6000000F2000000D0A364001500000007000000041F06007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C0063006D0064002E006500780065000000EA02000000000540008000000000542DADFFFE070000000000000000000068006B02000000005C00010000000000000000000000000000003D0000000000EB1A92770000000068006B020000000000000000FE0700002825B6FFFE070000A08886020000000018006B020000000000000000000000000100000000000000BF1DADFFFE07000060E1EA020000000060B888020000000000000000000000003B9462FDFE070000B00C88020000000008006B02000000005C00010000000000869A807700000000BE313C4A62B00000820200000000000000000000000000005C000100000000000000000000000000820200000000000002000000000000005C000100000000000000000000000000820200000000000080A6E0FF00000000C812D2FF00000000B00C88020000000001000000000000000F0000C000000000B000060000000000820200000000000001000000000000008202000000000000DB9B8077000000005C00010000000000000000000000000000000000000000000100000000000000000000000000000081020000000000000000000000000000000000000000000000000000060000002400000067510B004D006900630072006F0073006F00660074002E00570069006E0064006F00770073002E0043006F006E00740072006F006C00500061006E0065006C00000000000000000000000000000000008202000000000000010000000000000001000000000000008202000000000000D46905FCFE07000010E2EA020000000016798077000000000000000000000000869A807700000000000000000000000030E14A0000000000010000000000000010E2EA02000000000000000000000000CF41394A62B00000FFFFFFFFFFFFFFFF010000000000000000FF490000000000A0000500000000000000000000000000586705FCFE0700000000000000000000A0000500000000002B10000000000000807580770000000000000000000000000000000000000000000000000000000001000000000000001500000007000000790E06007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C0063006D0064002E006500780065000000EA02000000000540008000000000542D8CFFFE070000000000000000000068006C02000000005C0001000000000000000000000000000000280000000000EB1A6E770000000068006C020000000000000000FE070000282595FFFE070000A00D33000000000018006C02000000001B000000C86719007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C007400610073006B006D00670072002E00650078006500000041003900440043003700300042004200420034007D000000280000000000340000C000000000D48028000000000080BE28000000000000000000000000003E0040000000000060E3EA0200000000E0A4C30700000000350100C000000000C8037C770000000000000000000000007010000000000000A07D28000000000000000000000000001480280000000000D03B2B000000000048DD6F7700000000360038000000000020EBEA0200000000F8DCEA0200000000E905707700000000F1DCEA0200000000E0A4C30700000000140000000600000098E705007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C0063006D0064002E00650078006500000067FEFE0700000000000000000000F012FD020000000000000000000000000000000000000000F012FD020000000012C266FEFE070000010000000000000000000000000000000000000000000000F012FD02000000000000000000000000000000000000000000000000
(PID) Process:(2224) D469.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2224) D469.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000B1000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2224) D469.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2224) D469.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2224) D469.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2224) D469.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2224) D469.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
Executable files
19
Suspicious files
14
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
1924explorer.exeC:\Users\admin\AppData\Roaming\jbhtujvexecutable
MD5:F6D72F673EE8F3DA01014DFDCCE476F2
SHA256:BF375CDE510406F6CBE633C67360D65D5852A89DEC7EE555CCA04812A7F04313
1924explorer.exeC:\Users\admin\AppData\Local\Temp\5DD0.exeexecutable
MD5:3899665B1157EB9FD99B2D4000EB3C59
SHA256:EDB3454E0261F85C26ACDC1FD5365DAE5D1EC5F05C97991DBAAF3ADA0791A484
2940397D.exeC:\Users\admin\AppData\Local\Temp\toolspub2.exeexecutable
MD5:222A4C7E494A2314E9E1D0A07ABECEE9
SHA256:60E8EEF70C565EC2ABBE7D16157A0EDC4F8DBF8938363680AC6362620114C436
1924explorer.exeC:\Users\admin\AppData\Local\Temp\D469.exeexecutable
MD5:630CCCA3B919FD2013B6ACE25E3599F7
SHA256:B7E4ABE438C0D0A04B6CF3DA4EE41480648A88A55924678EC08685A0045D6172
1924explorer.exeC:\Users\admin\AppData\Local\Temp\4093.dllexecutable
MD5:23669981F056DC7F590989DE5F67A347
SHA256:2AA0F01B5361AD61BF9C0C85FC000C1857BF1C3CA87932D028F20E84A095382C
2940397D.exeC:\Users\admin\AppData\Local\Temp\latestplayer.exeexecutable
MD5:55F845C433E637594AAF872E41FDA207
SHA256:F9F9B154F928549C7A4B484909F41352048CE8148C678F4EC32C807C1D173A39
1924explorer.exeC:\Users\admin\AppData\Local\Temp\397D.exeexecutable
MD5:739AC92D82F9AE4F557923EE2689099A
SHA256:E9DC3C310187D5AA3A5451C4C6799792B5E6C501DA776F0ADEAF16302AA84E6E
230842F5.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HQYU0XHJ\geo[1].jsonbinary
MD5:3C040CDE576B927DFB696D7E092BC16A
SHA256:DA912266563C379D960EDD0F44C2123CD130442F6D81EEDF122488DB620EEAC3
1924explorer.exeC:\Users\admin\AppData\Local\Temp\42F5.exeexecutable
MD5:EAB15E545C8A2B1CEFCAEBC4D5D0973E
SHA256:808AD7486D9AFE9291AE54E5D20B5F3CF843791BFEE6C88460494A56EF254FEB
3452D469.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HQYU0XHJ\get[1].htmbinary
MD5:439448755EF112F23F85F9E31931708D
SHA256:6A207324F8A36A2228ADD791AC3D314DA8B65D6CE14A7020DB1ECA5FBC730A18
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
39
TCP/UDP connections
38
DNS requests
17
Threats
92

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1924
explorer.exe
POST
404
188.114.96.3:80
http://potunulit.org/
US
binary
8 b
malicious
1924
explorer.exe
POST
404
188.114.96.3:80
http://potunulit.org/
US
html
401 b
malicious
1924
explorer.exe
POST
404
188.114.96.3:80
http://potunulit.org/
US
html
401 b
malicious
1924
explorer.exe
POST
404
188.114.96.3:80
http://potunulit.org/
US
binary
51 b
malicious
1924
explorer.exe
POST
404
188.114.96.3:80
http://potunulit.org/
US
binary
378 Kb
malicious
1924
explorer.exe
POST
404
188.114.96.3:80
http://potunulit.org/
US
binary
378 Kb
malicious
1924
explorer.exe
POST
404
188.114.96.3:80
http://potunulit.org/
US
binary
44 b
malicious
1924
explorer.exe
POST
404
188.114.96.3:80
http://potunulit.org/
US
binary
42 b
malicious
1924
explorer.exe
POST
404
188.114.96.3:80
http://potunulit.org/
US
binary
2.50 Mb
malicious
3196
yiueea.exe
POST
200
79.137.192.18:80
http://79.137.192.18/9bDc8sQ/index.php
RU
text
6 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1924
explorer.exe
211.40.39.251:80
colisumy.com
LG DACOM Corporation
KR
malicious
2224
D469.exe
162.0.217.254:443
api.2ip.ua
NAMECHEAP-NET
NL
suspicious
1924
explorer.exe
79.137.192.18:80
—
Partner LLC
RU
malicious
2664
aafg31.exe
156.236.72.121:443
z.nnnaajjjgc.com
YISU CLOUD LTD
US
malicious
3196
yiueea.exe
79.137.192.18:80
—
Partner LLC
RU
malicious
1036
42F5.exe
162.0.217.254:443
api.2ip.ua
NAMECHEAP-NET
NL
suspicious
4
System
192.168.100.255:137
—
—
—
whitelisted
1208
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
332
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
potunulit.org
  • 188.114.96.3
  • 188.114.97.3
malicious
admaiscont.com.br
  • 142.4.24.122
unknown
colisumy.com
  • 211.40.39.251
  • 189.232.25.209
  • 62.217.232.10
  • 186.48.27.156
  • 190.219.108.202
  • 197.40.162.57
  • 220.82.134.215
  • 195.158.3.162
  • 190.139.250.133
  • 190.220.222.145
malicious
api.2ip.ua
  • 162.0.217.254
shared
dns.msftncsi.com
  • 131.107.255.255
shared
z.nnnaajjjgc.com
  • 156.236.72.121
suspicious
zexeq.com
  • 95.86.21.52
  • 177.254.85.20
  • 211.119.84.112
  • 188.36.122.174
  • 62.217.232.10
  • 190.12.87.61
  • 222.236.49.123
  • 95.158.162.200
  • 115.88.24.200
  • 2.180.10.7
malicious
host-file-host6.com
  • —
malicious
host-host-file8.com
  • 194.169.175.250
malicious
filebin.net
  • 185.47.40.36
suspicious

Threats

PID
Process
Class
Message
332
svchost.exe
A Network Trojan was detected
ET MALWARE DNS Query to SmokeLoader Domain (potunulit .org)
1924
explorer.exe
A Network Trojan was detected
ET MALWARE Suspected Smokeloader Activity (POST)
1924
explorer.exe
A Network Trojan was detected
ET MALWARE Suspected Smokeloader Activity (POST)
1924
explorer.exe
A Network Trojan was detected
ET MALWARE Suspected Smokeloader Activity (POST)
1924
explorer.exe
A Network Trojan was detected
ET MALWARE Suspected Smokeloader Activity (POST)
1924
explorer.exe
A Network Trojan was detected
ET MALWARE Suspected Smokeloader Activity (POST)
1924
explorer.exe
A Network Trojan was detected
ET MALWARE Suspected Smokeloader Activity (POST)
1924
explorer.exe
A Network Trojan was detected
ET MALWARE Suspected Smokeloader Activity (POST)
3908
AppLaunch.exe
Potentially Bad Traffic
ET INFO Microsoft net.tcp Connection Initialization Activity
3908
AppLaunch.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC Activity
22 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
6523.exe