File name:

file

Full analysis: https://app.any.run/tasks/6e2b1f9d-12b1-43d3-b862-201f60f1daf8
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: December 21, 2024, 11:46:15
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
amadey
botnet
stealer
loader
lumma
auto
generic
coinminer
telegram
evasion
arch-exec
cryptbot
github
gcleaner
stealc
credentialflusher
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

CAE8A411CF8F2223C645DAE80819489B

SHA1:

E8A4D2C9A8ED23BB0525A609877C8BA99B4A4CA8

SHA256:

C3269A1D5644EFFDF2071A8437D4DEF5644074BCAC0B73715CA891F6B10F5274

SSDEEP:

98304:bvINkY6lDAZrnTnLznCzrjPPXwNPER/soIo+8w6H1rzqdORqgLMOzJSWVL8je1dv:rA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AMADEY mutex has been found

      • file.exe (PID: 6244)
      • skotes.exe (PID: 6452)
      • skotes.exe (PID: 5604)

    • Connects to the CnC server

      • skotes.exe (PID: 6452)
      • Gxtuum.exe (PID: 6388)
      • svchost.exe (PID: 2192)
      • 4d2c9cf192.exe (PID: 4308)
      • 4a050a201a.exe (PID: 2432)
      • RGG7W917UBDR0FR948N7P.exe (PID: 5920)

    • AMADEY has been detected (SURICATA)

      • skotes.exe (PID: 6452)
      • Gxtuum.exe (PID: 6388)

    • LUMMA mutex has been found

      • 2b525f1188.exe (PID: 7140)
      • 15626a8bde.exe (PID: 5992)
      • 9bc91a9f43.exe (PID: 6868)
      • ffd93abb5b.exe (PID: 5732)

    • Actions looks like stealing of personal data

      • 2b525f1188.exe (PID: 7140)
      • 070bf52268.exe (PID: 4640)
      • 15626a8bde.exe (PID: 5992)
      • 4d2c9cf192.exe (PID: 4308)
      • 9bc91a9f43.exe (PID: 6868)
      • 4ffa051aced74a63a77874674aebd51a.exe (PID: 1796)
      • ffd93abb5b.exe (PID: 5732)

    • Steals credentials from Web Browsers

      • 2b525f1188.exe (PID: 7140)
      • 15626a8bde.exe (PID: 5992)

    • GENERIC has been found (auto)

      • skotes.exe (PID: 6452)

    • COINMINER has been found (auto)

      • skotes.exe (PID: 6452)

    • Executing a file with an untrusted certificate

      • af7ac7f79d.exe (PID: 3260)
      • ffd93abb5b.exe (PID: 5732)
      • ffd93abb5b.exe (PID: 7376)
      • ffd93abb5b.exe (PID: 6328)

    • Changes the autorun value in the registry

      • 070bf52268.exe (PID: 4640)
      • skotes.exe (PID: 6452)

    • Uses Task Scheduler to run other applications

      • in.exe (PID: 7108)

    • CRYPTBOT mutex has been found

      • 4d2c9cf192.exe (PID: 4308)
      • 7b9f6060af.exe (PID: 628)

    • AMADEY has been detected (YARA)

      • skotes.exe (PID: 6452)

    • Adds path to the Windows Defender exclusion list

      • a6cd62d55f.exe (PID: 6624)

    • CRYPTBOT has been detected (SURICATA)

      • 4d2c9cf192.exe (PID: 4308)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2192)
      • 9bc91a9f43.exe (PID: 6868)
      • ffd93abb5b.exe (PID: 5732)

    • StealC has been detected

      • 4a050a201a.exe (PID: 2432)
      • RGG7W917UBDR0FR948N7P.exe (PID: 5920)

    • GCLEANER has been detected (SURICATA)

      • 34d27bb3d7.exe (PID: 4804)

    • STEALC has been detected (SURICATA)

      • 4a050a201a.exe (PID: 2432)
      • RGG7W917UBDR0FR948N7P.exe (PID: 5920)

    • Possible tool for stealing has been detected

      • firefox.exe (PID: 8896)
      • 65a2984edf.exe (PID: 3812)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • file.exe (PID: 6244)
      • skotes.exe (PID: 6452)
      • 0b9d6c1650.exe (PID: 6316)
      • Gxtuum.exe (PID: 6388)
      • 070bf52268.exe (PID: 4640)
      • af7ac7f79d.exe (PID: 3260)
      • a6cd62d55f.exe (PID: 2728)
      • a6cd62d55f.exe (PID: 6624)
      • 4ffa051aced74a63a77874674aebd51a.exe (PID: 1796)
      • 3102ae946a9c43ecae3e9dd99158334e.exe (PID: 2292)

    • Reads the BIOS version

      • file.exe (PID: 6244)
      • skotes.exe (PID: 6452)
      • 2b525f1188.exe (PID: 7140)
      • 4d2c9cf192.exe (PID: 4308)
      • 7b9f6060af.exe (PID: 628)
      • 34d27bb3d7.exe (PID: 4804)
      • 4a050a201a.exe (PID: 2432)
      • skotes.exe (PID: 5604)
      • FEOXLSE2ZNAUCGKOQ5R59AEJKFW.exe (PID: 7416)
      • f7bf2e4c79.exe (PID: 8288)

    • Starts itself from another location

      • file.exe (PID: 6244)
      • 0b9d6c1650.exe (PID: 6316)

    • Executable content was dropped or overwritten

      • file.exe (PID: 6244)
      • skotes.exe (PID: 6452)
      • 0b9d6c1650.exe (PID: 6316)
      • 070bf52268.exe (PID: 4640)
      • af7ac7f79d.exe (PID: 3260)
      • 7z.exe (PID: 7096)
      • cmd.exe (PID: 3832)
      • in.exe (PID: 7108)
      • a6cd62d55f.exe (PID: 6624)
      • 9bc91a9f43.exe (PID: 6868)

    • Contacting a server suspected of hosting an CnC

      • skotes.exe (PID: 6452)
      • Gxtuum.exe (PID: 6388)
      • svchost.exe (PID: 2192)
      • 9bc91a9f43.exe (PID: 6868)
      • 4a050a201a.exe (PID: 2432)
      • RGG7W917UBDR0FR948N7P.exe (PID: 5920)
      • ffd93abb5b.exe (PID: 5732)

    • Process requests binary or script from the Internet

      • skotes.exe (PID: 6452)
      • 9bc91a9f43.exe (PID: 6868)

    • Potential Corporate Privacy Violation

      • skotes.exe (PID: 6452)
      • 9bc91a9f43.exe (PID: 6868)

    • Connects to the server without a host name

      • skotes.exe (PID: 6452)
      • Gxtuum.exe (PID: 6388)
      • 4a050a201a.exe (PID: 2432)
      • 9bc91a9f43.exe (PID: 6868)
      • RGG7W917UBDR0FR948N7P.exe (PID: 5920)
      • 34d27bb3d7.exe (PID: 4804)

    • Checks Windows Trust Settings

      • 070bf52268.exe (PID: 4640)
      • 4ffa051aced74a63a77874674aebd51a.exe (PID: 1796)

    • Drops 7-zip archiver for unpacking

      • af7ac7f79d.exe (PID: 3260)

    • Executing commands from a ".bat" file

      • af7ac7f79d.exe (PID: 3260)

    • Starts CMD.EXE for commands execution

      • af7ac7f79d.exe (PID: 3260)
      • 0KGPkVX.exe (PID: 7544)

    • The executable file from the user directory is run by the CMD process

      • 7z.exe (PID: 4804)
      • 7z.exe (PID: 6032)
      • 7z.exe (PID: 6656)
      • 7z.exe (PID: 6620)
      • 7z.exe (PID: 6872)
      • 7z.exe (PID: 6948)
      • 7z.exe (PID: 7076)
      • 7z.exe (PID: 7096)
      • in.exe (PID: 7108)

    • Checks for external IP

      • svchost.exe (PID: 2192)
      • 070bf52268.exe (PID: 4640)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 3832)
      • in.exe (PID: 7108)

    • Found IP address in command line

      • powershell.exe (PID: 6356)
      • powershell.exe (PID: 6340)

    • Starts POWERSHELL.EXE for commands execution

      • in.exe (PID: 7108)
      • a6cd62d55f.exe (PID: 6624)
      • Intel_PTT_EK_Recertification.exe (PID: 5728)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • 070bf52268.exe (PID: 4640)
      • 4ffa051aced74a63a77874674aebd51a.exe (PID: 1796)

    • Searches for installed software

      • 4d2c9cf192.exe (PID: 4308)
      • 4ffa051aced74a63a77874674aebd51a.exe (PID: 1796)

    • Application launched itself

      • a6cd62d55f.exe (PID: 2728)
      • ffd93abb5b.exe (PID: 7376)

    • Script adds exclusion path to Windows Defender

      • a6cd62d55f.exe (PID: 6624)

    • Process drops legitimate windows executable

      • a6cd62d55f.exe (PID: 6624)

    • The process executes via Task Scheduler

      • skotes.exe (PID: 5604)
      • Intel_PTT_EK_Recertification.exe (PID: 5728)
      • Gxtuum.exe (PID: 1576)

    • Windows Defender mutex has been found

      • 4a050a201a.exe (PID: 2432)
      • RGG7W917UBDR0FR948N7P.exe (PID: 5920)

    • Uses TASKKILL.EXE to kill process

      • 65a2984edf.exe (PID: 3812)

    • Uses TASKKILL.EXE to kill Browsers

      • 65a2984edf.exe (PID: 3812)

    • Get information on the list of running processes

      • 0KGPkVX.exe (PID: 7544)
      • cmd.exe (PID: 7396)
      • cmd.exe (PID: 8284)
      • cmd.exe (PID: 8800)
      • cmd.exe (PID: 8360)
      • cmd.exe (PID: 1192)
      • cmd.exe (PID: 7872)
      • cmd.exe (PID: 1856)

  • INFO

    • The process uses the downloaded file

      • file.exe (PID: 6244)
      • skotes.exe (PID: 6452)
      • 0b9d6c1650.exe (PID: 6316)
      • a6cd62d55f.exe (PID: 2728)
      • powershell.exe (PID: 2972)
      • powershell.exe (PID: 6272)

    • Checks supported languages

      • file.exe (PID: 6244)
      • skotes.exe (PID: 6452)
      • 2b525f1188.exe (PID: 7140)
      • 0b9d6c1650.exe (PID: 6316)
      • Gxtuum.exe (PID: 6388)
      • 070bf52268.exe (PID: 4640)
      • graph.exe (PID: 3188)
      • af7ac7f79d.exe (PID: 3260)
      • mode.com (PID: 1544)
      • 7z.exe (PID: 6032)
      • 7z.exe (PID: 4804)
      • 7z.exe (PID: 6656)
      • 7z.exe (PID: 6620)
      • 7z.exe (PID: 6872)
      • 7z.exe (PID: 6948)
      • 7z.exe (PID: 7076)
      • 7z.exe (PID: 7096)
      • in.exe (PID: 7108)
      • 4d2c9cf192.exe (PID: 4308)
      • a6cd62d55f.exe (PID: 2728)
      • 15626a8bde.exe (PID: 5992)
      • a6cd62d55f.exe (PID: 6624)
      • 7b9f6060af.exe (PID: 628)
      • 34d27bb3d7.exe (PID: 4804)
      • 9bc91a9f43.exe (PID: 6868)
      • 4ffa051aced74a63a77874674aebd51a.exe (PID: 1796)
      • 3102ae946a9c43ecae3e9dd99158334e.exe (PID: 2292)
      • 4a050a201a.exe (PID: 2432)
      • skotes.exe (PID: 5604)
      • Gxtuum.exe (PID: 1576)
      • 65a2984edf.exe (PID: 3812)
      • Intel_PTT_EK_Recertification.exe (PID: 5728)
      • FEOXLSE2ZNAUCGKOQ5R59AEJKFW.exe (PID: 7416)
      • f7bf2e4c79.exe (PID: 8288)
      • ffd93abb5b.exe (PID: 7376)

    • Sends debugging messages

      • file.exe (PID: 6244)
      • skotes.exe (PID: 6452)
      • 2b525f1188.exe (PID: 7140)
      • 4d2c9cf192.exe (PID: 4308)
      • 7b9f6060af.exe (PID: 628)
      • 34d27bb3d7.exe (PID: 4804)
      • 9bc91a9f43.exe (PID: 6868)
      • skotes.exe (PID: 5604)
      • 4a050a201a.exe (PID: 2432)
      • FEOXLSE2ZNAUCGKOQ5R59AEJKFW.exe (PID: 7416)
      • f7bf2e4c79.exe (PID: 8288)
      • RGG7W917UBDR0FR948N7P.exe (PID: 5920)

    • Reads the computer name

      • file.exe (PID: 6244)
      • skotes.exe (PID: 6452)
      • 2b525f1188.exe (PID: 7140)
      • 0b9d6c1650.exe (PID: 6316)
      • Gxtuum.exe (PID: 6388)
      • 070bf52268.exe (PID: 4640)
      • graph.exe (PID: 3188)
      • af7ac7f79d.exe (PID: 3260)
      • 7z.exe (PID: 6032)
      • 7z.exe (PID: 4804)
      • 7z.exe (PID: 6620)
      • 7z.exe (PID: 6656)
      • 7z.exe (PID: 6872)
      • 7z.exe (PID: 6948)
      • 7z.exe (PID: 7096)
      • 7z.exe (PID: 7076)
      • 4d2c9cf192.exe (PID: 4308)
      • a6cd62d55f.exe (PID: 2728)
      • a6cd62d55f.exe (PID: 6624)
      • 15626a8bde.exe (PID: 5992)
      • 9bc91a9f43.exe (PID: 6868)
      • 4ffa051aced74a63a77874674aebd51a.exe (PID: 1796)
      • 34d27bb3d7.exe (PID: 4804)
      • 65a2984edf.exe (PID: 3812)
      • 0KGPkVX.exe (PID: 7544)

    • Process checks computer location settings

      • file.exe (PID: 6244)
      • skotes.exe (PID: 6452)
      • 0b9d6c1650.exe (PID: 6316)
      • af7ac7f79d.exe (PID: 3260)
      • a6cd62d55f.exe (PID: 2728)
      • a6cd62d55f.exe (PID: 6624)

    • Checks proxy server information

      • skotes.exe (PID: 6452)
      • Gxtuum.exe (PID: 6388)
      • 070bf52268.exe (PID: 4640)
      • a6cd62d55f.exe (PID: 6624)
      • 4ffa051aced74a63a77874674aebd51a.exe (PID: 1796)
      • 3102ae946a9c43ecae3e9dd99158334e.exe (PID: 2292)
      • 4a050a201a.exe (PID: 2432)

    • Create files in a temporary directory

      • skotes.exe (PID: 6452)
      • 0b9d6c1650.exe (PID: 6316)
      • af7ac7f79d.exe (PID: 3260)
      • 7z.exe (PID: 6032)
      • 7z.exe (PID: 4804)
      • 7z.exe (PID: 6656)
      • 7z.exe (PID: 6620)
      • 7z.exe (PID: 6872)
      • 7z.exe (PID: 6948)
      • 7z.exe (PID: 7076)
      • 7z.exe (PID: 7096)
      • 9bc91a9f43.exe (PID: 6868)

    • Reads the software policy settings

      • 2b525f1188.exe (PID: 7140)
      • 070bf52268.exe (PID: 4640)
      • a6cd62d55f.exe (PID: 6624)
      • 4ffa051aced74a63a77874674aebd51a.exe (PID: 1796)

    • Creates files or folders in the user directory

      • skotes.exe (PID: 6452)
      • 070bf52268.exe (PID: 4640)
      • in.exe (PID: 7108)
      • 4ffa051aced74a63a77874674aebd51a.exe (PID: 1796)
      • 4a050a201a.exe (PID: 2432)
      • 34d27bb3d7.exe (PID: 4804)

    • The sample compiled with english language support

      • skotes.exe (PID: 6452)
      • af7ac7f79d.exe (PID: 3260)

    • Reads the machine GUID from the registry

      • 070bf52268.exe (PID: 4640)
      • 4d2c9cf192.exe (PID: 4308)
      • 7b9f6060af.exe (PID: 628)
      • 3102ae946a9c43ecae3e9dd99158334e.exe (PID: 2292)
      • 4ffa051aced74a63a77874674aebd51a.exe (PID: 1796)
      • 34d27bb3d7.exe (PID: 4804)

    • Creates files in the program directory

      • 070bf52268.exe (PID: 4640)
      • 4ffa051aced74a63a77874674aebd51a.exe (PID: 1796)

    • Starts MODE.COM to configure console settings

      • mode.com (PID: 1544)

    • Attempting to use instant messaging service

      • 070bf52268.exe (PID: 4640)
      • svchost.exe (PID: 2192)
      • 4ffa051aced74a63a77874674aebd51a.exe (PID: 1796)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6356)
      • powershell.exe (PID: 6272)
      • powershell.exe (PID: 2972)
      • powershell.exe (PID: 6340)

    • Themida protector has been detected

      • skotes.exe (PID: 6452)

    • The sample compiled with czech language support

      • skotes.exe (PID: 6452)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 2972)
      • powershell.exe (PID: 6272)

    • Disables trace logs

      • a6cd62d55f.exe (PID: 6624)

    • Reads CPU info

      • 4d2c9cf192.exe (PID: 4308)
      • 4ffa051aced74a63a77874674aebd51a.exe (PID: 1796)

    • Reads Environment values

      • 3102ae946a9c43ecae3e9dd99158334e.exe (PID: 2292)
      • 4ffa051aced74a63a77874674aebd51a.exe (PID: 1796)

    • Reads product name

      • 4ffa051aced74a63a77874674aebd51a.exe (PID: 1796)

    • Application launched itself

      • chrome.exe (PID: 6864)
      • msedge.exe (PID: 2432)
      • chrome.exe (PID: 7576)
      • msedge.exe (PID: 3076)
      • firefox.exe (PID: 8896)
      • firefox.exe (PID: 8944)

    • Manual execution by a user

      • msedge.exe (PID: 3076)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:09:22 17:40:44+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.24
CodeSize: 322048
InitializedDataSize: 104960
UninitializedDataSize: -
EntryPoint: 0x32a000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
265
Monitored processes
137
Malicious processes
23
Suspicious processes
6

Behavior graph

Click at the process to see the details
start file.exe #AMADEY skotes.exe #LUMMA 2b525f1188.exe 0b9d6c1650.exe #AMADEY gxtuum.exe 070bf52268.exe no specs 070bf52268.exe af7ac7f79d.exe graph.exe no specs cmd.exe conhost.exe no specs mode.com no specs 7z.exe no specs 7z.exe no specs 7z.exe no specs 7z.exe no specs 7z.exe no specs 7z.exe no specs 7z.exe no specs 7z.exe attrib.exe no specs in.exe #CRYPTBOT 4d2c9cf192.exe attrib.exe no specs attrib.exe no specs conhost.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs ping.exe no specs #LUMMA 15626a8bde.exe a6cd62d55f.exe no specs conhost.exe no specs a6cd62d55f.exe conhost.exe no specs powershell.exe no specs conhost.exe no specs #CRYPTBOT 7b9f6060af.exe #GCLEANER 34d27bb3d7.exe powershell.exe no specs conhost.exe no specs #LUMMA 9bc91a9f43.exe 4ffa051aced74a63a77874674aebd51a.exe 3102ae946a9c43ecae3e9dd99158334e.exe #STEALC 4a050a201a.exe skotes.exe chrome.exe no specs chrome.exe no specs intel_ptt_ek_recertification.exe no specs explorer.exe no specs powershell.exe no specs conhost.exe no specs gxtuum.exe no specs #CREDENTIALFLUSHER 65a2984edf.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe ping.exe no specs taskkill.exe no specs conhost.exe no specs msedge.exe no specs feoxlse2znaucgkoq5r59aejkfw.exe msedge.exe no specs msedge.exe msedge.exe no specs chrome.exe chrome.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs #STEALC rgg7w917ubdr0fr948n7p.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs f7bf2e4c79.exe taskkill.exe no specs conhost.exe no specs msedge.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs chrome.exe no specs taskkill.exe no specs conhost.exe no specs chrome.exe no specs #CREDENTIALFLUSHER firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs 7fe7122837.exe no specs ffd93abb5b.exe no specs conhost.exe no specs ffd93abb5b.exe no specs #LUMMA ffd93abb5b.exe 0kgpkvx.exe cmd.exe no specs conhost.exe no specs tasklist.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs #LUMMA svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
628attrib +H +S C:\Users\admin\AppData\Roaming\Intel_PTT_EK_Recertification.exeC:\Windows\System32\attrib.exe—in.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
628"C:\Users\admin\AppData\Local\Temp\1019337001\7b9f6060af.exe" C:\Users\admin\AppData\Local\Temp\1019337001\7b9f6060af.exe
skotes.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\1019337001\7b9f6060af.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
712"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=2320 --field-trial-handle=1932,i,6075208586232499429,2546444365354992008,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
1
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
716\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
768"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=2244 --field-trial-handle=1932,i,6075208586232499429,2546444365354992008,262144 --variations-seed-version /prefetch:3C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1140"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4576 --field-trial-handle=1932,i,6075208586232499429,2546444365354992008,262144 --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
1
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1192C:\WINDOWS\system32\cmd.exe /c "tasklist"C:\Windows\System32\cmd.exe—0KGPkVX.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1488attrib +H C:\Users\admin\AppData\Roaming\Intel_PTT_EK_Recertification.exeC:\Windows\System32\attrib.exe—in.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
1544mode 65,10C:\Windows\System32\mode.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
DOS Device MODE Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mode.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1576"C:\Users\admin\AppData\Local\Temp\e458d263c0\Gxtuum.exe"C:\Users\admin\AppData\Local\Temp\e458d263c0\Gxtuum.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\e458d263c0\gxtuum.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
Total events
54 815
Read events
54 731
Write events
84
Delete events
0

Modification events

(PID) Process:(6452) skotes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6452) skotes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6452) skotes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6388) Gxtuum.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6388) Gxtuum.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6388) Gxtuum.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4640) 070bf52268.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4640) 070bf52268.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4640) 070bf52268.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4640) 070bf52268.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Graph
Value:
C:\Program Files\Windows Media Player\graph\graph.exe
Executable files
47
Suspicious files
260
Text files
87
Unknown types
1

Dropped files

PID
Process
Filename
Type
6452skotes.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\random[1].exeexecutable
MD5:51FF79B406CB223DD49DD4C947EC97B0
SHA256:2E3A5DFA44D59681A60D78B8B08A1AF3878D8E270C02D7E31A0876A85EB42A7E
63160b9d6c1650.exeC:\Windows\Tasks\Gxtuum.jobbinary
MD5:5414B6EAD4B02780941C00A5A2217037
SHA256:317F71723098795299ADCB311F9A1EBD3B40F2905DA595D9BF6AAF230FDB12BD
6244file.exeC:\Windows\Tasks\skotes.jobbinary
MD5:7387AA557413BA4FE278BE980ACEACC9
SHA256:D098BD5400379D59BFCCE6B3FFC0F6E43CE508BD7C2600905B117658152FCC91
6244file.exeC:\Users\admin\AppData\Local\Temp\abc3bc1985\skotes.exeexecutable
MD5:CAE8A411CF8F2223C645DAE80819489B
SHA256:C3269A1D5644EFFDF2071A8437D4DEF5644074BCAC0B73715CA891F6B10F5274
4640070bf52268.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:4831178023EAC23833D89F62060723EF
SHA256:EB3B5A388324329319D07FBA7A890300E00E2B8A41DBC906C28D3D60650FC495
4640070bf52268.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_CB0386D01AD4CDBD503575C3CD1660FAbinary
MD5:E3C66F0FA62894B0D352CEDFC1CEAEDB
SHA256:4437C283FE7856296D54FC7C608D79FDBD893F83CDF9EBB2DE2EA10A09FFB26B
4640070bf52268.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C02877841121CC45139CB51404116B25_F72D98017580551DBBF1A0EF88D7569Fbinary
MD5:3922B30F7B2D7C70C3585B103CC6919D
SHA256:7060AB9BC12A7F9614A7816389D41384F2B34F6186D5C2F27F4D7511161BD6ED
6452skotes.exeC:\Users\admin\AppData\Local\Temp\1019330001\2b525f1188.exeexecutable
MD5:15709EBA2AFAF7CC0A86CE0ABF8E53F1
SHA256:10BFF40A9D960D0BE3CC81B074A748764D7871208F324DE26D365B1F8EA3935A
4640070bf52268.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_CB0386D01AD4CDBD503575C3CD1660FAbinary
MD5:180E1F1E77E79C044E93A44EFED07B58
SHA256:C7CEA508976BF520A74D9CF85121FFE37AEB5ECCFCEF454FB033E633B4EA3A54
4640070bf52268.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199binary
MD5:E935BC5762068CAF3E24A2683B1B8A88
SHA256:A8ACCFCFEB51BD73DF23B91F4D89FF1A9EB7438EF5B12E8AFDA1A6FF1769E89D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
102
TCP/UDP connections
198
DNS requests
189
Threats
99

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4640
070bf52268.exe
GET
200
142.250.186.99:80
http://c.pki.goog/r/r1.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6452
skotes.exe
GET
200
31.41.244.11:80
http://31.41.244.11/files/geopoxid/random.exe
unknown
—
—
unknown
6452
skotes.exe
POST
200
185.215.113.43:80
http://185.215.113.43/Zu7JuNko/index.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
104.126.37.145:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1076
svchost.exe
23.213.166.81:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.158
  • 23.48.23.173
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.186.174
whitelisted
www.bing.com
  • 104.126.37.145
  • 104.126.37.163
  • 104.126.37.162
  • 104.126.37.152
  • 104.126.37.161
  • 104.126.37.154
  • 104.126.37.155
  • 104.126.37.146
  • 104.126.37.160
  • 2.23.209.130
  • 2.23.209.176
  • 2.23.209.133
  • 2.23.209.140
  • 2.23.209.148
  • 2.23.209.149
  • 2.23.209.177
  • 2.23.209.161
  • 2.23.209.150
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
login.live.com
  • 40.126.32.136
  • 20.190.160.14
  • 40.126.32.72
  • 40.126.32.133
  • 40.126.32.140
  • 20.190.160.20
  • 40.126.32.138
  • 20.190.160.22
  • 40.126.32.68
  • 40.126.32.74
  • 40.126.32.76
whitelisted
cheapptaxysu.click
  • 172.67.177.88
  • 104.21.67.146
malicious
drive.google.com
  • 142.250.186.174
whitelisted

Threats

PID
Process
Class
Message
6452
skotes.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 33
6452
skotes.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
6452
skotes.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
6452
skotes.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 2
6452
skotes.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
6452
skotes.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
6452
skotes.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
6452
skotes.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
6452
skotes.exe
A Network Trojan was detected
ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2
6452
skotes.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
4 ETPRO signatures available at the full report
Process
Message
file.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
skotes.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
2b525f1188.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
4d2c9cf192.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
7b9f6060af.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
34d27bb3d7.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
9bc91a9f43.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
4a050a201a.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
skotes.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
FEOXLSE2ZNAUCGKOQ5R59AEJKFW.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------