File name:

file

Full analysis: https://app.any.run/tasks/6e2b1f9d-12b1-43d3-b862-201f60f1daf8
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: December 21, 2024, 11:46:15
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
amadey
botnet
stealer
loader
lumma
auto
generic
coinminer
telegram
evasion
arch-exec
cryptbot
github
gcleaner
stealc
credentialflusher
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

CAE8A411CF8F2223C645DAE80819489B

SHA1:

E8A4D2C9A8ED23BB0525A609877C8BA99B4A4CA8

SHA256:

C3269A1D5644EFFDF2071A8437D4DEF5644074BCAC0B73715CA891F6B10F5274

SSDEEP:

98304:bvINkY6lDAZrnTnLznCzrjPPXwNPER/soIo+8w6H1rzqdORqgLMOzJSWVL8je1dv:rA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AMADEY mutex has been found

      • file.exe (PID: 6244)
      • skotes.exe (PID: 6452)
      • skotes.exe (PID: 5604)

    • Connects to the CnC server

      • skotes.exe (PID: 6452)
      • Gxtuum.exe (PID: 6388)
      • 4d2c9cf192.exe (PID: 4308)
      • svchost.exe (PID: 2192)
      • 4a050a201a.exe (PID: 2432)
      • RGG7W917UBDR0FR948N7P.exe (PID: 5920)

    • AMADEY has been detected (SURICATA)

      • skotes.exe (PID: 6452)
      • Gxtuum.exe (PID: 6388)

    • Actions looks like stealing of personal data

      • 2b525f1188.exe (PID: 7140)
      • 070bf52268.exe (PID: 4640)
      • 15626a8bde.exe (PID: 5992)
      • 9bc91a9f43.exe (PID: 6868)
      • 4d2c9cf192.exe (PID: 4308)
      • 4ffa051aced74a63a77874674aebd51a.exe (PID: 1796)
      • ffd93abb5b.exe (PID: 5732)

    • LUMMA mutex has been found

      • 2b525f1188.exe (PID: 7140)
      • 15626a8bde.exe (PID: 5992)
      • 9bc91a9f43.exe (PID: 6868)
      • ffd93abb5b.exe (PID: 5732)

    • Steals credentials from Web Browsers

      • 2b525f1188.exe (PID: 7140)
      • 15626a8bde.exe (PID: 5992)

    • GENERIC has been found (auto)

      • skotes.exe (PID: 6452)

    • Executing a file with an untrusted certificate

      • af7ac7f79d.exe (PID: 3260)
      • ffd93abb5b.exe (PID: 7376)
      • ffd93abb5b.exe (PID: 6328)
      • ffd93abb5b.exe (PID: 5732)

    • COINMINER has been found (auto)

      • skotes.exe (PID: 6452)

    • Changes the autorun value in the registry

      • 070bf52268.exe (PID: 4640)
      • skotes.exe (PID: 6452)

    • Uses Task Scheduler to run other applications

      • in.exe (PID: 7108)

    • CRYPTBOT mutex has been found

      • 4d2c9cf192.exe (PID: 4308)
      • 7b9f6060af.exe (PID: 628)

    • AMADEY has been detected (YARA)

      • skotes.exe (PID: 6452)

    • Adds path to the Windows Defender exclusion list

      • a6cd62d55f.exe (PID: 6624)

    • CRYPTBOT has been detected (SURICATA)

      • 4d2c9cf192.exe (PID: 4308)

    • LUMMA has been detected (SURICATA)

      • 9bc91a9f43.exe (PID: 6868)
      • svchost.exe (PID: 2192)
      • ffd93abb5b.exe (PID: 5732)

    • StealC has been detected

      • 4a050a201a.exe (PID: 2432)
      • RGG7W917UBDR0FR948N7P.exe (PID: 5920)

    • GCLEANER has been detected (SURICATA)

      • 34d27bb3d7.exe (PID: 4804)

    • STEALC has been detected (SURICATA)

      • 4a050a201a.exe (PID: 2432)
      • RGG7W917UBDR0FR948N7P.exe (PID: 5920)

    • Possible tool for stealing has been detected

      • firefox.exe (PID: 8896)
      • 65a2984edf.exe (PID: 3812)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • file.exe (PID: 6244)
      • skotes.exe (PID: 6452)
      • 0b9d6c1650.exe (PID: 6316)
      • 070bf52268.exe (PID: 4640)
      • af7ac7f79d.exe (PID: 3260)
      • 7z.exe (PID: 7096)
      • cmd.exe (PID: 3832)
      • in.exe (PID: 7108)
      • a6cd62d55f.exe (PID: 6624)
      • 9bc91a9f43.exe (PID: 6868)

    • Reads the BIOS version

      • file.exe (PID: 6244)
      • skotes.exe (PID: 6452)
      • 2b525f1188.exe (PID: 7140)
      • 4d2c9cf192.exe (PID: 4308)
      • 7b9f6060af.exe (PID: 628)
      • 34d27bb3d7.exe (PID: 4804)
      • 4a050a201a.exe (PID: 2432)
      • skotes.exe (PID: 5604)
      • FEOXLSE2ZNAUCGKOQ5R59AEJKFW.exe (PID: 7416)
      • f7bf2e4c79.exe (PID: 8288)

    • Reads security settings of Internet Explorer

      • file.exe (PID: 6244)
      • skotes.exe (PID: 6452)
      • 0b9d6c1650.exe (PID: 6316)
      • Gxtuum.exe (PID: 6388)
      • 070bf52268.exe (PID: 4640)
      • af7ac7f79d.exe (PID: 3260)
      • a6cd62d55f.exe (PID: 2728)
      • 4ffa051aced74a63a77874674aebd51a.exe (PID: 1796)
      • a6cd62d55f.exe (PID: 6624)
      • 3102ae946a9c43ecae3e9dd99158334e.exe (PID: 2292)

    • Starts itself from another location

      • file.exe (PID: 6244)
      • 0b9d6c1650.exe (PID: 6316)

    • Contacting a server suspected of hosting an CnC

      • skotes.exe (PID: 6452)
      • Gxtuum.exe (PID: 6388)
      • svchost.exe (PID: 2192)
      • 9bc91a9f43.exe (PID: 6868)
      • 4a050a201a.exe (PID: 2432)
      • RGG7W917UBDR0FR948N7P.exe (PID: 5920)
      • ffd93abb5b.exe (PID: 5732)

    • Potential Corporate Privacy Violation

      • skotes.exe (PID: 6452)
      • 9bc91a9f43.exe (PID: 6868)

    • Process requests binary or script from the Internet

      • skotes.exe (PID: 6452)
      • 9bc91a9f43.exe (PID: 6868)

    • Connects to the server without a host name

      • skotes.exe (PID: 6452)
      • Gxtuum.exe (PID: 6388)
      • 4a050a201a.exe (PID: 2432)
      • 9bc91a9f43.exe (PID: 6868)
      • 34d27bb3d7.exe (PID: 4804)
      • RGG7W917UBDR0FR948N7P.exe (PID: 5920)

    • Checks Windows Trust Settings

      • 070bf52268.exe (PID: 4640)
      • 4ffa051aced74a63a77874674aebd51a.exe (PID: 1796)

    • Drops 7-zip archiver for unpacking

      • af7ac7f79d.exe (PID: 3260)

    • Starts CMD.EXE for commands execution

      • af7ac7f79d.exe (PID: 3260)
      • 0KGPkVX.exe (PID: 7544)

    • Executing commands from a ".bat" file

      • af7ac7f79d.exe (PID: 3260)

    • The executable file from the user directory is run by the CMD process

      • 7z.exe (PID: 4804)
      • 7z.exe (PID: 6656)
      • 7z.exe (PID: 6032)
      • 7z.exe (PID: 6620)
      • 7z.exe (PID: 6872)
      • 7z.exe (PID: 6948)
      • 7z.exe (PID: 7096)
      • 7z.exe (PID: 7076)
      • in.exe (PID: 7108)

    • Checks for external IP

      • 070bf52268.exe (PID: 4640)
      • svchost.exe (PID: 2192)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 3832)
      • in.exe (PID: 7108)

    • Found IP address in command line

      • powershell.exe (PID: 6356)
      • powershell.exe (PID: 6340)

    • Starts POWERSHELL.EXE for commands execution

      • in.exe (PID: 7108)
      • a6cd62d55f.exe (PID: 6624)
      • Intel_PTT_EK_Recertification.exe (PID: 5728)

    • Searches for installed software

      • 4d2c9cf192.exe (PID: 4308)
      • 4ffa051aced74a63a77874674aebd51a.exe (PID: 1796)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • 070bf52268.exe (PID: 4640)
      • 4ffa051aced74a63a77874674aebd51a.exe (PID: 1796)

    • Script adds exclusion path to Windows Defender

      • a6cd62d55f.exe (PID: 6624)

    • Application launched itself

      • a6cd62d55f.exe (PID: 2728)
      • ffd93abb5b.exe (PID: 7376)

    • Process drops legitimate windows executable

      • a6cd62d55f.exe (PID: 6624)

    • The process executes via Task Scheduler

      • skotes.exe (PID: 5604)
      • Intel_PTT_EK_Recertification.exe (PID: 5728)
      • Gxtuum.exe (PID: 1576)

    • Windows Defender mutex has been found

      • 4a050a201a.exe (PID: 2432)
      • RGG7W917UBDR0FR948N7P.exe (PID: 5920)

    • Uses TASKKILL.EXE to kill Browsers

      • 65a2984edf.exe (PID: 3812)

    • Uses TASKKILL.EXE to kill process

      • 65a2984edf.exe (PID: 3812)

    • Get information on the list of running processes

      • cmd.exe (PID: 7396)
      • 0KGPkVX.exe (PID: 7544)
      • cmd.exe (PID: 8360)
      • cmd.exe (PID: 8284)
      • cmd.exe (PID: 7872)
      • cmd.exe (PID: 8800)
      • cmd.exe (PID: 1192)
      • cmd.exe (PID: 1856)

  • INFO

    • Checks supported languages

      • file.exe (PID: 6244)
      • skotes.exe (PID: 6452)
      • 2b525f1188.exe (PID: 7140)
      • 0b9d6c1650.exe (PID: 6316)
      • Gxtuum.exe (PID: 6388)
      • 070bf52268.exe (PID: 4640)
      • graph.exe (PID: 3188)
      • af7ac7f79d.exe (PID: 3260)
      • mode.com (PID: 1544)
      • 7z.exe (PID: 6032)
      • 7z.exe (PID: 4804)
      • 7z.exe (PID: 6620)
      • 7z.exe (PID: 6948)
      • 7z.exe (PID: 6872)
      • 7z.exe (PID: 6656)
      • 7z.exe (PID: 7096)
      • 7z.exe (PID: 7076)
      • in.exe (PID: 7108)
      • 4d2c9cf192.exe (PID: 4308)
      • 15626a8bde.exe (PID: 5992)
      • a6cd62d55f.exe (PID: 2728)
      • a6cd62d55f.exe (PID: 6624)
      • 7b9f6060af.exe (PID: 628)
      • 9bc91a9f43.exe (PID: 6868)
      • 34d27bb3d7.exe (PID: 4804)
      • 3102ae946a9c43ecae3e9dd99158334e.exe (PID: 2292)
      • 4ffa051aced74a63a77874674aebd51a.exe (PID: 1796)
      • 4a050a201a.exe (PID: 2432)
      • skotes.exe (PID: 5604)
      • Intel_PTT_EK_Recertification.exe (PID: 5728)
      • Gxtuum.exe (PID: 1576)
      • 65a2984edf.exe (PID: 3812)
      • FEOXLSE2ZNAUCGKOQ5R59AEJKFW.exe (PID: 7416)
      • f7bf2e4c79.exe (PID: 8288)
      • ffd93abb5b.exe (PID: 7376)

    • Reads the computer name

      • file.exe (PID: 6244)
      • skotes.exe (PID: 6452)
      • 2b525f1188.exe (PID: 7140)
      • 0b9d6c1650.exe (PID: 6316)
      • Gxtuum.exe (PID: 6388)
      • 070bf52268.exe (PID: 4640)
      • af7ac7f79d.exe (PID: 3260)
      • graph.exe (PID: 3188)
      • 7z.exe (PID: 6032)
      • 7z.exe (PID: 4804)
      • 7z.exe (PID: 6620)
      • 7z.exe (PID: 6872)
      • 7z.exe (PID: 6656)
      • 7z.exe (PID: 6948)
      • 7z.exe (PID: 7076)
      • 7z.exe (PID: 7096)
      • 4d2c9cf192.exe (PID: 4308)
      • a6cd62d55f.exe (PID: 2728)
      • a6cd62d55f.exe (PID: 6624)
      • 15626a8bde.exe (PID: 5992)
      • 9bc91a9f43.exe (PID: 6868)
      • 4ffa051aced74a63a77874674aebd51a.exe (PID: 1796)
      • 34d27bb3d7.exe (PID: 4804)
      • 65a2984edf.exe (PID: 3812)
      • 0KGPkVX.exe (PID: 7544)

    • The process uses the downloaded file

      • file.exe (PID: 6244)
      • skotes.exe (PID: 6452)
      • 0b9d6c1650.exe (PID: 6316)
      • a6cd62d55f.exe (PID: 2728)
      • powershell.exe (PID: 2972)
      • powershell.exe (PID: 6272)

    • Sends debugging messages

      • file.exe (PID: 6244)
      • skotes.exe (PID: 6452)
      • 2b525f1188.exe (PID: 7140)
      • 4d2c9cf192.exe (PID: 4308)
      • 7b9f6060af.exe (PID: 628)
      • 34d27bb3d7.exe (PID: 4804)
      • 9bc91a9f43.exe (PID: 6868)
      • 4a050a201a.exe (PID: 2432)
      • skotes.exe (PID: 5604)
      • FEOXLSE2ZNAUCGKOQ5R59AEJKFW.exe (PID: 7416)
      • f7bf2e4c79.exe (PID: 8288)
      • RGG7W917UBDR0FR948N7P.exe (PID: 5920)

    • Process checks computer location settings

      • file.exe (PID: 6244)
      • skotes.exe (PID: 6452)
      • 0b9d6c1650.exe (PID: 6316)
      • af7ac7f79d.exe (PID: 3260)
      • a6cd62d55f.exe (PID: 2728)
      • a6cd62d55f.exe (PID: 6624)

    • Checks proxy server information

      • skotes.exe (PID: 6452)
      • Gxtuum.exe (PID: 6388)
      • 070bf52268.exe (PID: 4640)
      • a6cd62d55f.exe (PID: 6624)
      • 4ffa051aced74a63a77874674aebd51a.exe (PID: 1796)
      • 3102ae946a9c43ecae3e9dd99158334e.exe (PID: 2292)
      • 4a050a201a.exe (PID: 2432)

    • Create files in a temporary directory

      • 0b9d6c1650.exe (PID: 6316)
      • skotes.exe (PID: 6452)
      • af7ac7f79d.exe (PID: 3260)
      • 7z.exe (PID: 4804)
      • 7z.exe (PID: 6032)
      • 7z.exe (PID: 6656)
      • 7z.exe (PID: 6620)
      • 7z.exe (PID: 6872)
      • 7z.exe (PID: 6948)
      • 7z.exe (PID: 7096)
      • 7z.exe (PID: 7076)
      • 9bc91a9f43.exe (PID: 6868)

    • Reads the software policy settings

      • 2b525f1188.exe (PID: 7140)
      • 070bf52268.exe (PID: 4640)
      • a6cd62d55f.exe (PID: 6624)
      • 4ffa051aced74a63a77874674aebd51a.exe (PID: 1796)

    • Creates files or folders in the user directory

      • skotes.exe (PID: 6452)
      • 070bf52268.exe (PID: 4640)
      • in.exe (PID: 7108)
      • 4ffa051aced74a63a77874674aebd51a.exe (PID: 1796)
      • 4a050a201a.exe (PID: 2432)
      • 34d27bb3d7.exe (PID: 4804)

    • The sample compiled with english language support

      • skotes.exe (PID: 6452)
      • af7ac7f79d.exe (PID: 3260)

    • Reads the machine GUID from the registry

      • 070bf52268.exe (PID: 4640)
      • 4d2c9cf192.exe (PID: 4308)
      • 7b9f6060af.exe (PID: 628)
      • 4ffa051aced74a63a77874674aebd51a.exe (PID: 1796)
      • 3102ae946a9c43ecae3e9dd99158334e.exe (PID: 2292)
      • 34d27bb3d7.exe (PID: 4804)

    • Creates files in the program directory

      • 070bf52268.exe (PID: 4640)
      • 4ffa051aced74a63a77874674aebd51a.exe (PID: 1796)

    • Starts MODE.COM to configure console settings

      • mode.com (PID: 1544)

    • Attempting to use instant messaging service

      • svchost.exe (PID: 2192)
      • 070bf52268.exe (PID: 4640)
      • 4ffa051aced74a63a77874674aebd51a.exe (PID: 1796)

    • Themida protector has been detected

      • skotes.exe (PID: 6452)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6356)
      • powershell.exe (PID: 2972)
      • powershell.exe (PID: 6272)
      • powershell.exe (PID: 6340)

    • The sample compiled with czech language support

      • skotes.exe (PID: 6452)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 2972)
      • powershell.exe (PID: 6272)

    • Disables trace logs

      • a6cd62d55f.exe (PID: 6624)

    • Reads CPU info

      • 4d2c9cf192.exe (PID: 4308)
      • 4ffa051aced74a63a77874674aebd51a.exe (PID: 1796)

    • Reads Environment values

      • 3102ae946a9c43ecae3e9dd99158334e.exe (PID: 2292)
      • 4ffa051aced74a63a77874674aebd51a.exe (PID: 1796)

    • Reads product name

      • 4ffa051aced74a63a77874674aebd51a.exe (PID: 1796)

    • Application launched itself

      • chrome.exe (PID: 6864)
      • msedge.exe (PID: 2432)
      • msedge.exe (PID: 3076)
      • chrome.exe (PID: 7576)
      • firefox.exe (PID: 8896)
      • firefox.exe (PID: 8944)

    • Manual execution by a user

      • msedge.exe (PID: 3076)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 6
ImageVersion: -
OSVersion: 6
EntryPoint: 0x32a000
UninitializedDataSize: -
InitializedDataSize: 104960
CodeSize: 322048
LinkerVersion: 14.24
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2024:09:22 17:40:44+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
265
Monitored processes
137
Malicious processes
23
Suspicious processes
6

Behavior graph

Click at the process to see the details
start #LUMMA svchost.exe file.exe #AMADEY skotes.exe #LUMMA 2b525f1188.exe 0b9d6c1650.exe #AMADEY gxtuum.exe 070bf52268.exe no specs 070bf52268.exe af7ac7f79d.exe graph.exe no specs cmd.exe conhost.exe no specs mode.com no specs 7z.exe no specs 7z.exe no specs 7z.exe no specs 7z.exe no specs 7z.exe no specs 7z.exe no specs 7z.exe no specs 7z.exe attrib.exe no specs in.exe #CRYPTBOT 4d2c9cf192.exe attrib.exe no specs attrib.exe no specs conhost.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs ping.exe no specs #LUMMA 15626a8bde.exe a6cd62d55f.exe no specs conhost.exe no specs a6cd62d55f.exe conhost.exe no specs powershell.exe no specs conhost.exe no specs #CRYPTBOT 7b9f6060af.exe #GCLEANER 34d27bb3d7.exe powershell.exe no specs conhost.exe no specs #LUMMA 9bc91a9f43.exe 4ffa051aced74a63a77874674aebd51a.exe 3102ae946a9c43ecae3e9dd99158334e.exe #STEALC 4a050a201a.exe skotes.exe chrome.exe no specs chrome.exe no specs intel_ptt_ek_recertification.exe no specs explorer.exe no specs powershell.exe no specs conhost.exe no specs gxtuum.exe no specs #CREDENTIALFLUSHER 65a2984edf.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe ping.exe no specs taskkill.exe no specs conhost.exe no specs msedge.exe no specs feoxlse2znaucgkoq5r59aejkfw.exe msedge.exe no specs msedge.exe msedge.exe no specs chrome.exe chrome.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs #STEALC rgg7w917ubdr0fr948n7p.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs f7bf2e4c79.exe taskkill.exe no specs conhost.exe no specs msedge.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs chrome.exe no specs taskkill.exe no specs conhost.exe no specs chrome.exe no specs #CREDENTIALFLUSHER firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs 7fe7122837.exe no specs ffd93abb5b.exe no specs conhost.exe no specs ffd93abb5b.exe no specs #LUMMA ffd93abb5b.exe 0kgpkvx.exe cmd.exe no specs conhost.exe no specs tasklist.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
6244"C:\Users\admin\AppData\Local\Temp\file.exe" C:\Users\admin\AppData\Local\Temp\file.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\file.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6452"C:\Users\admin\AppData\Local\Temp\abc3bc1985\skotes.exe" C:\Users\admin\AppData\Local\Temp\abc3bc1985\skotes.exe
file.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\abc3bc1985\skotes.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7140"C:\Users\admin\AppData\Local\Temp\1019330001\2b525f1188.exe" C:\Users\admin\AppData\Local\Temp\1019330001\2b525f1188.exe
skotes.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\1019330001\2b525f1188.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6316"C:\Users\admin\AppData\Local\Temp\1019331001\0b9d6c1650.exe" C:\Users\admin\AppData\Local\Temp\1019331001\0b9d6c1650.exe
skotes.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\1019331001\0b9d6c1650.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6388"C:\Users\admin\AppData\Local\Temp\e458d263c0\Gxtuum.exe" C:\Users\admin\AppData\Local\Temp\e458d263c0\Gxtuum.exe
0b9d6c1650.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\e458d263c0\gxtuum.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5392"C:\Users\admin\AppData\Local\Temp\1019332001\070bf52268.exe" C:\Users\admin\AppData\Local\Temp\1019332001\070bf52268.exe—skotes.exe
User:
admin
Integrity Level:
MEDIUM
Description:
wusvc
Exit code:
3221226540
Version:
1.0.0.1
Modules
Images
c:\users\admin\appdata\local\temp\1019332001\070bf52268.exe
c:\windows\system32\ntdll.dll
4640"C:\Users\admin\AppData\Local\Temp\1019332001\070bf52268.exe" C:\Users\admin\AppData\Local\Temp\1019332001\070bf52268.exe
skotes.exe
User:
admin
Integrity Level:
HIGH
Description:
wusvc
Exit code:
0
Version:
1.0.0.1
Modules
Images
c:\users\admin\appdata\local\temp\1019332001\070bf52268.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3260"C:\Users\admin\AppData\Local\Temp\1019333001\af7ac7f79d.exe" C:\Users\admin\AppData\Local\Temp\1019333001\af7ac7f79d.exe
skotes.exe
User:
admin
Company:
FileZilla Project
Integrity Level:
MEDIUM
Description:
FileZilla FTP Client
Version:
3.67.1.0
Modules
Images
c:\users\admin\appdata\local\temp\1019333001\af7ac7f79d.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
3188"C:\Program Files\Windows Media Player\graph\graph.exe"C:\Program Files\Windows Media Player\graph\graph.exe—070bf52268.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\program files\windows media player\graph\graph.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
54 815
Read events
54 731
Write events
84
Delete events
0

Modification events

(PID) Process:(6452) skotes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6452) skotes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6452) skotes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6388) Gxtuum.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6388) Gxtuum.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6388) Gxtuum.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4640) 070bf52268.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4640) 070bf52268.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4640) 070bf52268.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4640) 070bf52268.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Graph
Value:
C:\Program Files\Windows Media Player\graph\graph.exe
Executable files
47
Suspicious files
260
Text files
87
Unknown types
1

Dropped files

PID
Process
Filename
Type
6244file.exeC:\Windows\Tasks\skotes.jobbinary
MD5:7387AA557413BA4FE278BE980ACEACC9
SHA256:D098BD5400379D59BFCCE6B3FFC0F6E43CE508BD7C2600905B117658152FCC91
63160b9d6c1650.exeC:\Windows\Tasks\Gxtuum.jobbinary
MD5:5414B6EAD4B02780941C00A5A2217037
SHA256:317F71723098795299ADCB311F9A1EBD3B40F2905DA595D9BF6AAF230FDB12BD
63160b9d6c1650.exeC:\Users\admin\AppData\Local\Temp\e458d263c0\Gxtuum.exeexecutable
MD5:51FF79B406CB223DD49DD4C947EC97B0
SHA256:2E3A5DFA44D59681A60D78B8B08A1AF3878D8E270C02D7E31A0876A85EB42A7E
4640070bf52268.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199binary
MD5:E935BC5762068CAF3E24A2683B1B8A88
SHA256:A8ACCFCFEB51BD73DF23B91F4D89FF1A9EB7438EF5B12E8AFDA1A6FF1769E89D
6452skotes.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\random[1].exeexecutable
MD5:3567CB15156760B2F111512FFDBC1451
SHA256:0285D3A6C1CA2E3A993491C44E9CF2D33DBEC0FB85FDBF48989A4E3B14B37630
6452skotes.exeC:\Users\admin\AppData\Local\Temp\1019332001\070bf52268.exeexecutable
MD5:3567CB15156760B2F111512FFDBC1451
SHA256:0285D3A6C1CA2E3A993491C44E9CF2D33DBEC0FB85FDBF48989A4E3B14B37630
4640070bf52268.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C02877841121CC45139CB51404116B25_F72D98017580551DBBF1A0EF88D7569Fbinary
MD5:7876D4CA053A6520C3AEF7D76FA776DC
SHA256:033F9151450E72BBA790A5E0D9EAC5B1CA04430231CCC9B46410149919F645C7
6452skotes.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\random[1].exeexecutable
MD5:51FF79B406CB223DD49DD4C947EC97B0
SHA256:2E3A5DFA44D59681A60D78B8B08A1AF3878D8E270C02D7E31A0876A85EB42A7E
6452skotes.exeC:\Users\admin\AppData\Local\Temp\1019331001\0b9d6c1650.exeexecutable
MD5:51FF79B406CB223DD49DD4C947EC97B0
SHA256:2E3A5DFA44D59681A60D78B8B08A1AF3878D8E270C02D7E31A0876A85EB42A7E
6452skotes.exeC:\Users\admin\AppData\Local\Temp\1019330001\2b525f1188.exeexecutable
MD5:15709EBA2AFAF7CC0A86CE0ABF8E53F1
SHA256:10BFF40A9D960D0BE3CC81B074A748764D7871208F324DE26D365B1F8EA3935A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
102
TCP/UDP connections
198
DNS requests
189
Threats
99

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6388
Gxtuum.exe
POST
200
212.193.31.8:80
http://212.193.31.8/3ofn3jf3e2ljk2/index.php
unknown
—
—
malicious
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6452
skotes.exe
POST
200
185.215.113.43:80
http://185.215.113.43/Zu7JuNko/index.php
unknown
—
—
malicious
—
—
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6452
skotes.exe
GET
200
31.41.244.11:80
http://31.41.244.11/files/geopoxid/random.exe
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
104.126.37.145:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1076
svchost.exe
23.213.166.81:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.158
  • 23.48.23.173
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.186.174
whitelisted
www.bing.com
  • 104.126.37.145
  • 104.126.37.163
  • 104.126.37.162
  • 104.126.37.152
  • 104.126.37.161
  • 104.126.37.154
  • 104.126.37.155
  • 104.126.37.146
  • 104.126.37.160
  • 2.23.209.130
  • 2.23.209.176
  • 2.23.209.133
  • 2.23.209.140
  • 2.23.209.148
  • 2.23.209.149
  • 2.23.209.177
  • 2.23.209.161
  • 2.23.209.150
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
login.live.com
  • 40.126.32.136
  • 20.190.160.14
  • 40.126.32.72
  • 40.126.32.133
  • 40.126.32.140
  • 20.190.160.20
  • 40.126.32.138
  • 20.190.160.22
  • 40.126.32.68
  • 40.126.32.74
  • 40.126.32.76
whitelisted
cheapptaxysu.click
  • 172.67.177.88
  • 104.21.67.146
malicious
drive.google.com
  • 142.250.186.174
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 33
—
—
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
—
—
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
—
—
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 2
—
—
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
—
—
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
—
—
A Network Trojan was detected
ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2
—
—
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
4 ETPRO signatures available at the full report
Process
Message
file.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
skotes.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
2b525f1188.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
4d2c9cf192.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
7b9f6060af.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
34d27bb3d7.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
9bc91a9f43.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
4a050a201a.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
skotes.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
FEOXLSE2ZNAUCGKOQ5R59AEJKFW.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
file