File name:

6523.exe

Full analysis: https://app.any.run/tasks/24500a1f-61a8-490b-8e0c-75449e6cc68b
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: August 24, 2023, 15:07:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
loader
smoke
stealer
redline
amadey
trojan
ransomware
stop
fabookie
vidar
arkei
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

F6D72F673EE8F3DA01014DFDCCE476F2

SHA1:

075D81F03B2AE15F95FD0A87D329A933D1B328E6

SHA256:

BF375CDE510406F6CBE633C67360D65D5852A89DEC7EE555CCA04812A7F04313

SSDEEP:

3072:KSdr5Y4TCy+dCzA4isaFpGbsZAUuoanfmiZpPtWtMmEPFP9z+Y:K8/+dN4hwG7Uu9T6ymEPFP9z+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Runs injected code in another process

      • 6523.exe (PID: 3720)

    • Application was dropped or rewritten from another process

      • 5DD0.exe (PID: 2892)
      • 5FD5.exe (PID: 4012)
      • D469.exe (PID: 2224)
      • D469.exe (PID: 1976)
      • toolspub2.exe (PID: 2632)
      • toolspub2.exe (PID: 2144)
      • latestplayer.exe (PID: 1680)
      • yiueea.exe (PID: 3196)
      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 1636)
      • 42F5.exe (PID: 2524)
      • 42F5.exe (PID: 1036)
      • 42F5.exe (PID: 1080)
      • D469.exe (PID: 3452)
      • D469.exe (PID: 3044)
      • 42F5.exe (PID: 2308)
      • build2.exe (PID: 2384)
      • build3.exe (PID: 2836)
      • build2.exe (PID: 1064)

    • Application was injected by another process

      • explorer.exe (PID: 1924)

    • Connects to the CnC server

      • explorer.exe (PID: 1924)
      • AppLaunch.exe (PID: 3908)
      • AppLaunch.exe (PID: 2536)
      • yiueea.exe (PID: 3196)
      • aafg31.exe (PID: 2664)
      • build2.exe (PID: 1064)

    • SMOKE was detected

      • explorer.exe (PID: 1924)

    • REDLINE was detected

      • AppLaunch.exe (PID: 3908)
      • AppLaunch.exe (PID: 2536)

    • REDLINE detected by memory dumps

      • AppLaunch.exe (PID: 2536)
      • AppLaunch.exe (PID: 3908)

    • Registers / Runs the DLL via REGSVR32.EXE

      • explorer.exe (PID: 1924)

    • Loads dropped or rewritten executable

      • regsvr32.exe (PID: 3716)

    • Changes the autorun value in the registry

      • yiueea.exe (PID: 3196)

    • Uses Task Scheduler to run other applications

      • yiueea.exe (PID: 3196)
      • build3.exe (PID: 2836)

    • AMADEY was detected

      • yiueea.exe (PID: 3196)

    • Stop is detected

      • D469.exe (PID: 3452)
      • 42F5.exe (PID: 2308)

    • FABOOKIE was detected

      • aafg31.exe (PID: 2664)

    • VIDAR was detected

      • build2.exe (PID: 1064)

    • ARKEI was detected

      • build2.exe (PID: 1064)

    • AMADEY detected by memory dumps

      • yiueea.exe (PID: 3196)

    • Actions looks like stealing of personal data

      • aafg31.exe (PID: 2664)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • explorer.exe (PID: 1924)
      • 397D.exe (PID: 2940)
      • latestplayer.exe (PID: 1680)
      • 42F5.exe (PID: 1036)
      • D469.exe (PID: 3452)
      • build3.exe (PID: 2836)

    • Connects to unusual port

      • AppLaunch.exe (PID: 3908)
      • AppLaunch.exe (PID: 2536)
      • build2.exe (PID: 1064)

    • Process requests binary or script from the Internet

      • explorer.exe (PID: 1924)
      • 42F5.exe (PID: 2308)
      • D469.exe (PID: 3452)

    • Reads the Internet Settings

      • D469.exe (PID: 2224)
      • 397D.exe (PID: 2940)
      • aafg31.exe (PID: 2664)
      • latestplayer.exe (PID: 1680)
      • yiueea.exe (PID: 3196)
      • 42F5.exe (PID: 1036)
      • 42F5.exe (PID: 2308)
      • D469.exe (PID: 3452)
      • build2.exe (PID: 1064)

    • Application launched itself

      • D469.exe (PID: 1976)
      • toolspub2.exe (PID: 2144)
      • cmd.exe (PID: 2672)
      • 42F5.exe (PID: 2524)
      • D469.exe (PID: 3044)
      • D469.exe (PID: 2224)
      • 42F5.exe (PID: 1080)
      • 42F5.exe (PID: 1036)
      • build2.exe (PID: 2384)

    • Connects to the server without a host name

      • explorer.exe (PID: 1924)
      • yiueea.exe (PID: 3196)

    • Starts itself from another location

      • latestplayer.exe (PID: 1680)

    • Starts CMD.EXE for commands execution

      • yiueea.exe (PID: 3196)
      • cmd.exe (PID: 2672)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 2672)
      • 42F5.exe (PID: 1036)

    • Reads settings of System Certificates

      • 42F5.exe (PID: 1036)
      • 42F5.exe (PID: 2308)
      • D469.exe (PID: 3452)
      • aafg31.exe (PID: 2664)
      • build2.exe (PID: 1064)

    • Checks Windows Trust Settings

      • 42F5.exe (PID: 1036)
      • 42F5.exe (PID: 2308)
      • D469.exe (PID: 3452)
      • aafg31.exe (PID: 2664)
      • build2.exe (PID: 1064)

    • Reads security settings of Internet Explorer

      • 42F5.exe (PID: 1036)
      • 42F5.exe (PID: 2308)
      • D469.exe (PID: 3452)
      • aafg31.exe (PID: 2664)
      • build2.exe (PID: 1064)

    • Adds/modifies Windows certificates

      • 42F5.exe (PID: 2524)
      • 42F5.exe (PID: 1080)
      • build2.exe (PID: 2384)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • build2.exe (PID: 1064)

    • The process checks if it is being run in the virtual environment

      • regsvr32.exe (PID: 3716)

  • INFO

    • Reads the Internet Settings

      • explorer.exe (PID: 1924)

    • Checks supported languages

      • 6523.exe (PID: 3720)
      • 5DD0.exe (PID: 2892)
      • 5FD5.exe (PID: 4012)
      • AppLaunch.exe (PID: 3908)
      • AppLaunch.exe (PID: 2536)
      • D469.exe (PID: 1976)
      • D469.exe (PID: 2224)
      • 397D.exe (PID: 2940)
      • toolspub2.exe (PID: 2144)
      • aafg31.exe (PID: 2664)
      • toolspub2.exe (PID: 2632)
      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 1636)
      • latestplayer.exe (PID: 1680)
      • yiueea.exe (PID: 3196)
      • 42F5.exe (PID: 2524)
      • 42F5.exe (PID: 1036)
      • D469.exe (PID: 3044)
      • 42F5.exe (PID: 2308)
      • 42F5.exe (PID: 1080)
      • D469.exe (PID: 3452)
      • build2.exe (PID: 2384)
      • build3.exe (PID: 2836)
      • build2.exe (PID: 1064)

    • Reads the computer name

      • AppLaunch.exe (PID: 3908)
      • AppLaunch.exe (PID: 2536)
      • D469.exe (PID: 2224)
      • 397D.exe (PID: 2940)
      • aafg31.exe (PID: 2664)
      • latestplayer.exe (PID: 1680)
      • yiueea.exe (PID: 3196)
      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 1636)
      • 42F5.exe (PID: 1036)
      • 42F5.exe (PID: 2308)
      • D469.exe (PID: 3452)
      • build2.exe (PID: 1064)

    • Reads the machine GUID from the registry

      • AppLaunch.exe (PID: 3908)
      • AppLaunch.exe (PID: 2536)
      • D469.exe (PID: 2224)
      • aafg31.exe (PID: 2664)
      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 1636)
      • yiueea.exe (PID: 3196)
      • 42F5.exe (PID: 1036)
      • 42F5.exe (PID: 2308)
      • D469.exe (PID: 3452)
      • build2.exe (PID: 1064)

    • Creates files or folders in the user directory

      • explorer.exe (PID: 1924)
      • 42F5.exe (PID: 1036)
      • D469.exe (PID: 3452)
      • 42F5.exe (PID: 2308)
      • aafg31.exe (PID: 2664)
      • build3.exe (PID: 2836)
      • build2.exe (PID: 1064)

    • Create files in a temporary directory

      • explorer.exe (PID: 1924)
      • 397D.exe (PID: 2940)
      • latestplayer.exe (PID: 1680)
      • aafg31.exe (PID: 2664)

    • Reads Environment values

      • AppLaunch.exe (PID: 3908)
      • AppLaunch.exe (PID: 2536)

    • Checks proxy server information

      • D469.exe (PID: 2224)
      • aafg31.exe (PID: 2664)
      • yiueea.exe (PID: 3196)
      • 42F5.exe (PID: 1036)
      • 42F5.exe (PID: 2308)
      • D469.exe (PID: 3452)
      • build2.exe (PID: 1064)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

RedLine

(PID) Process(3908) AppLaunch.exe
C2 (1)149.202.0.242:31728
Botnet
Err_msgLogsDiller Cloud (TG: @logsdillabot)
Auth_value3a050df92d0cf082b2cdaf87863616be
US (13)
net.tcp://
/
localhost
3a050df92d0cf082b2cdaf87863616be
Authorization
ns1
CjgwRj8TDhssGkcOCwYoQz4TKBYsJxAACC1cTg==
EytYHRBJFRwDNAsVJAUjNxE+fl07MDIWESkCRTo8BR8DQRcDHSsNABE+AQUDQCIJ
Glassy
(PID) Process(2536) AppLaunch.exe
C2 (1)149.202.0.242:31728
Botnet
Err_msgLogsDiller Cloud (TG: @logsdillabot)
Auth_value3a050df92d0cf082b2cdaf87863616be
US (13)
net.tcp://
/
localhost
3a050df92d0cf082b2cdaf87863616be
Authorization
ns1
CjgwRj8TDhssGkcOCwYoQz4TKBYsJxAACC1cTg==
EytYHRBJFRwDNAsVJAUjNxE+fl07MDIWESkCRTo8BR8DQRcDHSsNABE+AQUDQCIJ
Glassy

Amadey

(PID) Process(3196) yiueea.exe
C2 (1)http://79.137.192.18
Version3.87
Options
Drop directoryS-%lu-
Drop name%-lu
Strings (119)-%lu
577f58beff
yiueea.exe
SCHTASKS
/Create /SC MINUTE /MO 1 /TN
/TR "
" /F
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Startup
Rem
cmd /C RMDIR /s/q
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
rundll32
/Delete /TN "
Programs
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
%USERPROFILE%
\App
POST
GET
id=
&vs=
&sd=
&os=
&bi=
&ar=
&pc=
&un=
&dm=
&av=
&lv=
&og=
cred.dll|clip.dll|
d1
e1
e0
Main
http://
https://
exe
dll
cmd
ps1
<c>
<d>
Plugins/
+++
#
|
&unit=
=
shell32.dll
kernel32.dll
GetNativeSystemInfo
ProgramData\
AVAST Software
Avira
Kaspersky Lab
ESET
Panda Security
Doctor Web
AVG
360TotalSecurity
Bitdefender
Norton
Sophos
Comodo
WinDefender
0123456789
rb
wb
Content-Type: multipart/form-data; boundary=----
------
Content-Disposition: form-data; name="data"; filename="
" Content-Type: application/octet-stream
------
--
?scr=1
.jpg
Content-Type: application/x-www-form-urlencoded
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
ComputerName
abcdefghijklmnopqrstuvwxyz0123456789-_
-unicode-
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
SYSTEM\ControlSet001\Services\BasicDisplay\Video
VideoID
\0000
DefaultSettings.XResolution
DefaultSettings.YResolution
SOFTWARE\Microsoft\Windows NT\CurrentVersion
ProductName
2019
2022
2016
CurrentBuild
&&
echo Y|CACLS "
" /P "
:N"
CACLS "
" /P "
:R" /E
:F" /E
&&Exit
..\
\
:::
rundll32.exe
/k
"taskkill /f /im "
" && timeout 1 && del
&& Exit"
" && ren
&&
Powershell.exe
-executionpolicy remotesigned -File "
"
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

ProductVersions: 10.25.70.52
ProductName: Gammy
LegalCopyrights: Challangers kamboja
InternalName: Literally.exe
FileVersion: 46.76.12.71
CompanyName: Thunderstack
CharacterSet: Unknown (85B2)
LanguageCode: Unknown (0293)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 26.0.0.0
FileVersionNumber: 86.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x7db2
UninitializedDataSize: -
InitializedDataSize: 32301568
CodeSize: 154112
LinkerVersion: 10
PEType: PE32
ImageFileCharacteristics: No relocs, Executable, 32-bit
TimeStamp: 2022:05:31 07:26:36+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 31-May-2022 07:26:36
Detected languages:
  • Portuguese - Portugal
CompanyName: Thunderstack
FileVersion: 46.76.12.71
InternalName: Literally.exe
LegalCopyrights: Challangers kamboja
ProductName: Gammy
ProductVersions: 10.25.70.52

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000E0

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 31-May-2022 07:26:36
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00025902
0x00025A00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
5.35933
.data
0x00027000
0x01EBBE48
0x00016800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.24456
.rsrc
0x01EE3000
0x00007508
0x00007600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.04778

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.38159
584
UNKNOWN
UNKNOWN
RT_VERSION
2
4.02242
1736
UNKNOWN
Portuguese - Portugal
RT_ICON
3
3.28195
1384
UNKNOWN
Portuguese - Portugal
RT_ICON
4
2.3839
4264
UNKNOWN
Portuguese - Portugal
RT_ICON
5
2.39543
2440
UNKNOWN
Portuguese - Portugal
RT_ICON
6
2.5278
1128
UNKNOWN
Portuguese - Portugal
RT_ICON
7
3.62407
9640
UNKNOWN
Portuguese - Portugal
RT_ICON
8
3.76944
2440
UNKNOWN
Portuguese - Portugal
RT_ICON
9
2.96984
2216
UNKNOWN
UNKNOWN
RT_CURSOR
24
2.26539
88
UNKNOWN
Portuguese - Portugal
RT_STRING

Imports

GDI32.dll
KERNEL32.dll
USER32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
79
Monitored processes
37
Malicious processes
24
Suspicious processes
3

Behavior graph

Click at the process to see the details
inject start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start 6523.exe no specs #SMOKE explorer.exe 5dd0.exe no specs 5fd5.exe no specs applaunch.exe no specs #REDLINE applaunch.exe #REDLINE applaunch.exe d469.exe no specs d469.exe 397d.exe #FABOOKIE aafg31.exe toolspub2.exe no specs toolspub2.exe no specs 31839b57a4f11171d6abc8bbc4451ee4.exe no specs latestplayer.exe #AMADEY yiueea.exe schtasks.exe no specs cmd.exe no specs cmd.exe no specs cacls.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cacls.exe no specs regsvr32.exe no specs regsvr32.exe no specs 42f5.exe no specs 42f5.exe icacls.exe no specs 42f5.exe #STOP 42f5.exe d469.exe #STOP d469.exe build2.exe no specs build3.exe schtasks.exe no specs #VIDAR build2.exe

Process information

PID
CMD
Path
Indicators
Parent process
308CACLS "yiueea.exe" /P "admin:N"C:\Windows\SysWOW64\cacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Control ACLs Program
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\cacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1036C:\Users\admin\AppData\Local\Temp\42F5.exeC:\Users\admin\AppData\Local\Temp\42F5.exe
42F5.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\42f5.exe
c:\windows\syswow64\ntdll.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
1064"C:\Users\admin\AppData\Local\1eeddeb8-137a-48a4-b7d0-28e9ea8fe9eb\build2.exe" C:\Users\admin\AppData\Local\1eeddeb8-137a-48a4-b7d0-28e9ea8fe9eb\build2.exe
build2.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\1eeddeb8-137a-48a4-b7d0-28e9ea8fe9eb\build2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1080"C:\Users\admin\AppData\Local\Temp\42F5.exe" --Admin IsNotAutoStart IsNotTaskC:\Users\admin\AppData\Local\Temp\42F5.exe
42F5.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\42f5.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\ntdll.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1636"C:\Users\admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe" C:\Users\admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe—397D.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\31839b57a4f11171d6abc8bbc4451ee4.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\system32\user32.dll
1680"C:\Users\admin\AppData\Local\Temp\latestplayer.exe" C:\Users\admin\AppData\Local\Temp\latestplayer.exe
397D.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\latestplayer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1872C:\Windows\system32\cmd.exe /S /D /c" echo Y"C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\syswow64\ntdll.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\wow64.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1912CACLS "..\577f58beff" /P "admin:R" /EC:\Windows\SysWOW64\cacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Control ACLs Program
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\cacls.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1924C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1976C:\Users\admin\AppData\Local\Temp\D469.exeC:\Users\admin\AppData\Local\Temp\D469.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\d469.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
Total events
9 740
Read events
9 576
Write events
162
Delete events
2

Modification events

(PID) Process:(1924) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000088AF72B0747534094337F63DE35C94A00000000020000000000106600000001000020000000DE596CC00FA0CE6036B57F3745DF211B8CEDC7563B5C7C90E189DFBFE4E216FC000000000E800000000200002000000034A09CAFA8980668BD48169E708CCFDA06F4ADAD9A6D0FF324841FD89016AF6F3000000097B2B3329B62DD4C9AB1E283BD9359B999E8411B9FC15AF795BFA67D05007F5CE28F7E84193A17AFEBE2A486810ADC32400000007E5B4D515AE7EE2B367ED77D5D9A272891BC7B3019A3AA7BC4BF2CA5315073E7F321A33013E44AD95CE9A5E9CA3FF01D3584C54FECFB9C1227BA4AE46F87EAF7
(PID) Process:(1924) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:HRZR_PGYFRFFVBA
Value:
00000000B6000000F2000000C1A364001500000007000000041F06007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C0063006D0064002E006500780065000000EA02000000000540008000000000542DADFFFE070000000000000000000068006B02000000005C00010000000000000000000000000000003D0000000000EB1A92770000000068006B020000000000000000FE0700002825B6FFFE070000A08886020000000018006B020000000000000000000000000100000000000000BF1DADFFFE07000060E1EA020000000060B888020000000000000000000000003B9462FDFE070000B00C88020000000008006B02000000005C00010000000000869A807700000000BE313C4A62B00000820200000000000000000000000000005C000100000000000000000000000000820200000000000002000000000000005C000100000000000000000000000000820200000000000080A6E0FF00000000C812D2FF00000000B00C88020000000001000000000000000F0000C000000000B000060000000000820200000000000001000000000000008202000000000000DB9B8077000000005C00010000000000000000000000000000000000000000000100000000000000000000000000000081020000000000000000000000000000000000000000000000000000060000002400000067510B004D006900630072006F0073006F00660074002E00570069006E0064006F00770073002E0043006F006E00740072006F006C00500061006E0065006C00000000000000000000000000000000008202000000000000010000000000000001000000000000008202000000000000D46905FCFE07000010E2EA020000000016798077000000000000000000000000869A807700000000000000000000000030E14A0000000000010000000000000010E2EA02000000000000000000000000CF41394A62B00000FFFFFFFFFFFFFFFF010000000000000000FF490000000000A0000500000000000000000000000000586705FCFE0700000000000000000000A0000500000000002B10000000000000807580770000000000000000000000000000000000000000000000000000000001000000000000001500000007000000790E06007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C0063006D0064002E006500780065000000EA02000000000540008000000000542D8CFFFE070000000000000000000068006C02000000005C0001000000000000000000000000000000280000000000EB1A6E770000000068006C020000000000000000FE070000282595FFFE070000A00D33000000000018006C02000000001B000000C86719007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C007400610073006B006D00670072002E00650078006500000041003900440043003700300042004200420034007D000000280000000000340000C000000000D48028000000000080BE28000000000000000000000000003E0040000000000060E3EA0200000000E0A4C30700000000350100C000000000C8037C770000000000000000000000007010000000000000A07D28000000000000000000000000001480280000000000D03B2B000000000048DD6F7700000000360038000000000020EBEA0200000000F8DCEA0200000000E905707700000000F1DCEA0200000000E0A4C30700000000140000000600000098E705007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C0063006D0064002E00650078006500000067FEFE0700000000000000000000F012FD020000000000000000000000000000000000000000F012FD020000000012C266FEFE070000010000000000000000000000000000000000000000000000F012FD02000000000000000000000000000000000000000000000000
(PID) Process:(1924) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:HRZR_PGYFRFFVBA
Value:
00000000B6000000F2000000D0A364001500000007000000041F06007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C0063006D0064002E006500780065000000EA02000000000540008000000000542DADFFFE070000000000000000000068006B02000000005C00010000000000000000000000000000003D0000000000EB1A92770000000068006B020000000000000000FE0700002825B6FFFE070000A08886020000000018006B020000000000000000000000000100000000000000BF1DADFFFE07000060E1EA020000000060B888020000000000000000000000003B9462FDFE070000B00C88020000000008006B02000000005C00010000000000869A807700000000BE313C4A62B00000820200000000000000000000000000005C000100000000000000000000000000820200000000000002000000000000005C000100000000000000000000000000820200000000000080A6E0FF00000000C812D2FF00000000B00C88020000000001000000000000000F0000C000000000B000060000000000820200000000000001000000000000008202000000000000DB9B8077000000005C00010000000000000000000000000000000000000000000100000000000000000000000000000081020000000000000000000000000000000000000000000000000000060000002400000067510B004D006900630072006F0073006F00660074002E00570069006E0064006F00770073002E0043006F006E00740072006F006C00500061006E0065006C00000000000000000000000000000000008202000000000000010000000000000001000000000000008202000000000000D46905FCFE07000010E2EA020000000016798077000000000000000000000000869A807700000000000000000000000030E14A0000000000010000000000000010E2EA02000000000000000000000000CF41394A62B00000FFFFFFFFFFFFFFFF010000000000000000FF490000000000A0000500000000000000000000000000586705FCFE0700000000000000000000A0000500000000002B10000000000000807580770000000000000000000000000000000000000000000000000000000001000000000000001500000007000000790E06007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C0063006D0064002E006500780065000000EA02000000000540008000000000542D8CFFFE070000000000000000000068006C02000000005C0001000000000000000000000000000000280000000000EB1A6E770000000068006C020000000000000000FE070000282595FFFE070000A00D33000000000018006C02000000001B000000C86719007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C007400610073006B006D00670072002E00650078006500000041003900440043003700300042004200420034007D000000280000000000340000C000000000D48028000000000080BE28000000000000000000000000003E0040000000000060E3EA0200000000E0A4C30700000000350100C000000000C8037C770000000000000000000000007010000000000000A07D28000000000000000000000000001480280000000000D03B2B000000000048DD6F7700000000360038000000000020EBEA0200000000F8DCEA0200000000E905707700000000F1DCEA0200000000E0A4C30700000000140000000600000098E705007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C0063006D0064002E00650078006500000067FEFE0700000000000000000000F012FD020000000000000000000000000000000000000000F012FD020000000012C266FEFE070000010000000000000000000000000000000000000000000000F012FD02000000000000000000000000000000000000000000000000
(PID) Process:(2224) D469.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2224) D469.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000B1000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2224) D469.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2224) D469.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2224) D469.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2224) D469.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2224) D469.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
Executable files
19
Suspicious files
14
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
1924explorer.exeC:\Users\admin\AppData\Local\Temp\5DD0.exeexecutable
MD5:3899665B1157EB9FD99B2D4000EB3C59
SHA256:EDB3454E0261F85C26ACDC1FD5365DAE5D1EC5F05C97991DBAAF3ADA0791A484
1924explorer.exeC:\Users\admin\AppData\Local\Temp\397D.exeexecutable
MD5:739AC92D82F9AE4F557923EE2689099A
SHA256:E9DC3C310187D5AA3A5451C4C6799792B5E6C501DA776F0ADEAF16302AA84E6E
1924explorer.exeC:\Users\admin\AppData\Roaming\jbhtujvexecutable
MD5:F6D72F673EE8F3DA01014DFDCCE476F2
SHA256:BF375CDE510406F6CBE633C67360D65D5852A89DEC7EE555CCA04812A7F04313
103642F5.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HQYU0XHJ\geo[1].jsonbinary
MD5:99EEB7D796FFF681912435183A1E4B6B
SHA256:B2940B9889E6FBAE20928751B8DF4BB388EA8AB3A8EC8DAE6D117E41B88D85FB
2940397D.exeC:\Users\admin\AppData\Local\Temp\latestplayer.exeexecutable
MD5:55F845C433E637594AAF872E41FDA207
SHA256:F9F9B154F928549C7A4B484909F41352048CE8148C678F4EC32C807C1D173A39
2940397D.exeC:\Users\admin\AppData\Local\Temp\toolspub2.exeexecutable
MD5:222A4C7E494A2314E9E1D0A07ABECEE9
SHA256:60E8EEF70C565EC2ABBE7D16157A0EDC4F8DBF8938363680AC6362620114C436
1680latestplayer.exeC:\Users\admin\AppData\Local\Temp\577f58beff\yiueea.exeexecutable
MD5:55F845C433E637594AAF872E41FDA207
SHA256:F9F9B154F928549C7A4B484909F41352048CE8148C678F4EC32C807C1D173A39
2940397D.exeC:\Users\admin\AppData\Local\Temp\aafg31.exeexecutable
MD5:E3031F99F17A7C8CEF9F8CCF6F0DC28E
SHA256:FDCA3A9EFF84349214459ACB7530451C244A66E5E3347AC8366E22C2BEE4A0FD
103642F5.exeC:\Users\admin\AppData\Local\345f8a0c-4d9a-44c7-b78a-e2d20ef84474\42F5.exeexecutable
MD5:EAB15E545C8A2B1CEFCAEBC4D5D0973E
SHA256:808AD7486D9AFE9291AE54E5D20B5F3CF843791BFEE6C88460494A56EF254FEB
230842F5.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HQYU0XHJ\geo[1].jsonbinary
MD5:3C040CDE576B927DFB696D7E092BC16A
SHA256:DA912266563C379D960EDD0F44C2123CD130442F6D81EEDF122488DB620EEAC3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
39
TCP/UDP connections
38
DNS requests
17
Threats
92

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3196
yiueea.exe
POST
200
79.137.192.18:80
http://79.137.192.18/9bDc8sQ/index.php
RU
text
6 b
malicious
1924
explorer.exe
GET
200
79.137.192.18:80
http://79.137.192.18/wowo2.exe
RU
executable
5.13 Mb
malicious
1924
explorer.exe
POST
404
188.114.96.3:80
http://potunulit.org/
US
binary
8 b
malicious
1924
explorer.exe
POST
404
188.114.96.3:80
http://potunulit.org/
US
html
401 b
malicious
1924
explorer.exe
POST
404
188.114.96.3:80
http://potunulit.org/
US
html
401 b
malicious
1924
explorer.exe
POST
404
188.114.96.3:80
http://potunulit.org/
US
binary
51 b
malicious
1924
explorer.exe
POST
404
188.114.96.3:80
http://potunulit.org/
US
binary
44 b
malicious
1924
explorer.exe
POST
404
188.114.96.3:80
http://potunulit.org/
US
binary
378 Kb
malicious
1924
explorer.exe
POST
404
188.114.96.3:80
http://potunulit.org/
US
html
401 b
malicious
1924
explorer.exe
POST
404
188.114.96.3:80
http://potunulit.org/
US
html
401 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1208
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
332
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1924
explorer.exe
188.114.96.3:80
potunulit.org
CLOUDFLARENET
NL
malicious
3908
AppLaunch.exe
149.202.0.242:31728
—
OVH SAS
FR
malicious
2536
AppLaunch.exe
149.202.0.242:31728
—
OVH SAS
FR
malicious
1924
explorer.exe
142.4.24.122:443
admaiscont.com.br
UNIFIEDLAYER-AS-1
US
unknown
1924
explorer.exe
211.40.39.251:80
colisumy.com
LG DACOM Corporation
KR
malicious
1924
explorer.exe
189.232.25.209:80
colisumy.com
Uninet S.A. de C.V.
MX
malicious

DNS requests

Domain
IP
Reputation
potunulit.org
  • 188.114.96.3
  • 188.114.97.3
malicious
admaiscont.com.br
  • 142.4.24.122
unknown
colisumy.com
  • 211.40.39.251
  • 189.232.25.209
  • 62.217.232.10
  • 186.48.27.156
  • 190.219.108.202
  • 197.40.162.57
  • 220.82.134.215
  • 195.158.3.162
  • 190.139.250.133
  • 190.220.222.145
malicious
api.2ip.ua
  • 162.0.217.254
shared
dns.msftncsi.com
  • 131.107.255.255
shared
z.nnnaajjjgc.com
  • 156.236.72.121
suspicious
zexeq.com
  • 95.86.21.52
  • 177.254.85.20
  • 211.119.84.112
  • 188.36.122.174
  • 62.217.232.10
  • 190.12.87.61
  • 222.236.49.123
  • 95.158.162.200
  • 115.88.24.200
  • 2.180.10.7
malicious
host-file-host6.com
  • —
malicious
host-host-file8.com
  • 194.169.175.250
malicious
filebin.net
  • 185.47.40.36
suspicious

Threats

PID
Process
Class
Message
332
svchost.exe
A Network Trojan was detected
ET MALWARE DNS Query to SmokeLoader Domain (potunulit .org)
1924
explorer.exe
A Network Trojan was detected
ET MALWARE Suspected Smokeloader Activity (POST)
1924
explorer.exe
A Network Trojan was detected
ET MALWARE Suspected Smokeloader Activity (POST)
1924
explorer.exe
A Network Trojan was detected
ET MALWARE Suspected Smokeloader Activity (POST)
1924
explorer.exe
A Network Trojan was detected
ET MALWARE Suspected Smokeloader Activity (POST)
1924
explorer.exe
A Network Trojan was detected
ET MALWARE Suspected Smokeloader Activity (POST)
1924
explorer.exe
A Network Trojan was detected
ET MALWARE Suspected Smokeloader Activity (POST)
1924
explorer.exe
A Network Trojan was detected
ET MALWARE Suspected Smokeloader Activity (POST)
3908
AppLaunch.exe
Potentially Bad Traffic
ET INFO Microsoft net.tcp Connection Initialization Activity
3908
AppLaunch.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC Activity
22 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
6523.exe