File name:

Setup.exe

Full analysis: https://app.any.run/tasks/ad2f7f42-6c9f-4157-94bf-698161e6dbe3
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: June 12, 2024, 20:15:21
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
lumma
hijackloader
loader
stealer
exfiltration
miner
amadey
botnet
xmrig
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

CF6D8ED410DD3CA38FC9ED02D44DAFF1

SHA1:

85D0BEF448DBE4711C23327DD80A05B6F80EBCA6

SHA256:

C9A9E7B788E7E9147DBDB52DF63A71EAD448B86FEE5D4E7EBD52BC08167E1511

SSDEEP:

98304:j+cD4dnWUZsdIStSfe/jvwjFOJN4jbFAoO1wLwaLFm2h4/ooR6/4PqzaG4TwVDi2:7RCQtoMMQgZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Setup.exe (PID: 5776)
      • Setup.tmp (PID: 3592)
      • Setup.exe (PID: 4360)
      • Setup.tmp (PID: 4140)
      • UnRAR.exe (PID: 4500)
      • identity_helper.exe (PID: 1720)
      • coml.au3 (PID: 5180)

    • LUMMA has been detected (YARA)

      • comp.exe (PID: 5720)
      • coml.au3 (PID: 5180)

    • HIJACKLOADER has been detected (YARA)

      • comp.exe (PID: 5720)
      • coml.au3 (PID: 5180)
      • 6E6TIGWDLVQF1GVJY2SU05DGZG93.exe (PID: 5228)
      • ftp.exe (PID: 4012)
      • IMEDQHEYO6YXCO0X6Y7.exe (PID: 4080)
      • ftp.exe (PID: 5620)
      • explorer.exe (PID: 3652)

    • LUMMA has been detected (SURICATA)

      • coml.au3 (PID: 5180)

    • Actions looks like stealing of personal data

      • coml.au3 (PID: 5180)

    • Connects to the CnC server

      • ngen.exe (PID: 5256)
      • explorer.exe (PID: 3652)

    • AMADEY has been detected (YARA)

      • explorer.exe (PID: 3652)

    • AMADEY has been detected (SURICATA)

      • explorer.exe (PID: 3652)

    • XMRIG has been detected (YARA)

      • ngen.exe (PID: 5256)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Setup.exe (PID: 5776)
      • Setup.tmp (PID: 3592)
      • Setup.exe (PID: 4360)
      • Setup.tmp (PID: 4140)
      • UnRAR.exe (PID: 4500)
      • comp.exe (PID: 5720)
      • identity_helper.exe (PID: 1720)
      • coml.au3 (PID: 5180)

    • Reads the Windows owner or organization settings

      • Setup.tmp (PID: 3592)
      • Setup.tmp (PID: 4140)

    • Reads security settings of Internet Explorer

      • Setup.tmp (PID: 3592)
      • Setup.tmp (PID: 4140)
      • 6E6TIGWDLVQF1GVJY2SU05DGZG93.exe (PID: 5900)

    • Reads the date of Windows installation

      • Setup.tmp (PID: 3592)
      • Setup.tmp (PID: 4140)
      • 6E6TIGWDLVQF1GVJY2SU05DGZG93.exe (PID: 5900)

    • Creates file in the systems drive root

      • Setup.tmp (PID: 3592)

    • Process drops legitimate windows executable

      • UnRAR.exe (PID: 4500)
      • identity_helper.exe (PID: 1720)

    • Starts application with an unusual extension

      • comp.exe (PID: 5720)

    • Starts itself from another location

      • identity_helper.exe (PID: 1720)

    • The executable file from the user directory is run by the CMD process

      • 6E6TIGWDLVQF1GVJY2SU05DGZG93.exe (PID: 5228)

    • Starts CMD.EXE for commands execution

      • 6E6TIGWDLVQF1GVJY2SU05DGZG93.exe (PID: 5900)

    • Searches for installed software

      • coml.au3 (PID: 5180)

    • Potential Corporate Privacy Violation

      • ngen.exe (PID: 5256)

    • Connects to unusual port

      • ngen.exe (PID: 5256)

    • Connects to the server without a host name

      • MSBuild.exe (PID: 2920)

    • Contacting a server suspected of hosting an CnC

      • explorer.exe (PID: 3652)

    • Crypto Currency Mining Activity Detected

      • ngen.exe (PID: 5256)

  • INFO

    • Create files in a temporary directory

      • Setup.exe (PID: 5776)
      • Setup.tmp (PID: 3592)
      • Setup.exe (PID: 4360)
      • Setup.tmp (PID: 4140)
      • identity_helper.exe (PID: 4344)
      • comp.exe (PID: 5720)
      • coml.au3 (PID: 5180)
      • 6E6TIGWDLVQF1GVJY2SU05DGZG93.exe (PID: 5900)
      • 6E6TIGWDLVQF1GVJY2SU05DGZG93.exe (PID: 5228)
      • IMEDQHEYO6YXCO0X6Y7.exe (PID: 4080)
      • ftp.exe (PID: 4012)
      • ftp.exe (PID: 5620)

    • Checks supported languages

      • Setup.exe (PID: 5776)
      • Setup.tmp (PID: 3592)
      • Setup.exe (PID: 4360)
      • Setup.tmp (PID: 4140)
      • UnRAR.exe (PID: 4500)
      • identity_helper.exe (PID: 1720)
      • coml.au3 (PID: 5180)
      • identity_helper.exe (PID: 4344)
      • 6E6TIGWDLVQF1GVJY2SU05DGZG93.exe (PID: 5900)
      • 6E6TIGWDLVQF1GVJY2SU05DGZG93.exe (PID: 5228)
      • IMEDQHEYO6YXCO0X6Y7.exe (PID: 4080)
      • MSBuild.exe (PID: 2920)
      • ngen.exe (PID: 5256)

    • Reads the computer name

      • Setup.tmp (PID: 3592)
      • Setup.tmp (PID: 4140)
      • identity_helper.exe (PID: 4344)
      • identity_helper.exe (PID: 1720)
      • coml.au3 (PID: 5180)
      • 6E6TIGWDLVQF1GVJY2SU05DGZG93.exe (PID: 5900)
      • 6E6TIGWDLVQF1GVJY2SU05DGZG93.exe (PID: 5228)
      • IMEDQHEYO6YXCO0X6Y7.exe (PID: 4080)
      • ngen.exe (PID: 5256)
      • MSBuild.exe (PID: 2920)

    • Process checks computer location settings

      • Setup.tmp (PID: 3592)
      • Setup.tmp (PID: 4140)
      • 6E6TIGWDLVQF1GVJY2SU05DGZG93.exe (PID: 5900)

    • Creates files or folders in the user directory

      • Setup.tmp (PID: 4140)
      • UnRAR.exe (PID: 4500)
      • identity_helper.exe (PID: 1720)

    • Drops the executable file immediately after the start

      • comp.exe (PID: 5720)

    • Reads the machine GUID from the registry

      • coml.au3 (PID: 5180)
      • IMEDQHEYO6YXCO0X6Y7.exe (PID: 4080)
      • MSBuild.exe (PID: 2920)

    • Reads the software policy settings

      • coml.au3 (PID: 5180)
      • IMEDQHEYO6YXCO0X6Y7.exe (PID: 4080)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 3652)

    • Checks proxy server information

      • explorer.exe (PID: 3652)
      • MSBuild.exe (PID: 2920)

    • Reads Environment values

      • MSBuild.exe (PID: 2920)

    • Disables trace logs

      • MSBuild.exe (PID: 2920)

    • Creates files in the program directory

      • MSBuild.exe (PID: 2920)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Lumma

(PID) Process(5720) comp.exe
C2 (9)standingcomperewhitwo.shop
stickyyummyskiwffe.shop
innerverdanytiresw.shop
sturdyregularrmsnhw.shop
macabrecondfucews.shop
distincttangyflippan.shop
lamentablegapingkwaq.shop
specialadventurousw.shop
greentastellesqwm.shop
(PID) Process(5180) coml.au3
C2 (9)standingcomperewhitwo.shop
stickyyummyskiwffe.shop
innerverdanytiresw.shop
sturdyregularrmsnhw.shop
macabrecondfucews.shop
distincttangyflippan.shop
lamentablegapingkwaq.shop
specialadventurousw.shop
greentastellesqwm.shop

Amadey

(PID) Process(3652) explorer.exe
C2proresupdate.com
URLhttp://proresupdate.com/h9fmdW5/index.php
Version4.30
Options
Drop directory4bbb72a446
Drop nameHkbsse.exe
Strings (113)Main
cmd /C RMDIR /s/q
/Plugins/
ESET
" && timeout 1 && del
&& Exit"
lv:
av:
SOFTWARE\Microsoft\Windows NT\CurrentVersion
st=s
Doctor Web
https://
Norton
Content-Type: application/x-www-form-urlencoded
ProductName
/k
Content-Type: multipart/form-data; boundary=----
?scr=1
cred.dll|clip.dll|
vs:
4.30
<d>
exe
ComputerName
2019
id:
" && ren
ar:
:::
Sophos
sd:
#
Bitdefender
Panda Security
2016
abcdefghijklmnopqrstuvwxyz0123456789-_
-unicode-
Programs
Startup
d1
VideoID
bi:
&&
S-%lu-
Content-Disposition: form-data; name="data"; filename="
rb
Rem
\App
rundll32.exe
SYSTEM\ControlSet001\Services\BasicDisplay\Video
------
4bbb72a446
\0000
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
=
Avira
%USERPROFILE%
og:
un:
pc:
WinDefender
r=
+++
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
e0
random
|
&unit=
DefaultSettings.YResolution
GetNativeSystemInfo
360TotalSecurity
-%lu
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
ps1
------
Comodo
AVAST Software
wb
proresupdate.com
\
AVG
/h9fmdW5/index.php
GET
-executionpolicy remotesigned -File "
Powershell.exe
" Content-Type: application/octet-stream
shutdown -s -t 0
kernel32.dll
shell32.dll
dll
"taskkill /f /im "
ProgramData\
CurrentBuild
cmd
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
POST
0123456789
os:
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
"
rundll32
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
<c>
dm:
e1
Hkbsse.exe
http://
--
%-lu
.jpg
Kaspersky Lab
2022
DefaultSettings.XResolution
No Malware configuration.

TRiD

.exe | Inno Setup installer (51.8)
.exe | InstallShield setup (20.3)
.exe | Win32 EXE PECompact compressed (generic) (19.6)
.dll | Win32 Dynamic Link Library (generic) (3.1)
.exe | Win32 Executable (generic) (2.1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:02:15 14:54:16+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741888
InitializedDataSize: 48640
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6
ImageVersion: 6
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 4.2131.88.1
ProductVersionNumber: 4.2131.88.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: UN_Writer Setup
FileVersion: 4.2131.88.1
LegalCopyright:
OriginalFileName:
ProductName: UN_Writer
ProductVersion: 4.2131.88.1
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
23
Malicious processes
17
Suspicious processes
1

Behavior graph

Click at the process to see the details
start setup.exe setup.tmp setup.exe setup.tmp unrar.exe conhost.exe no specs identity_helper.exe identity_helper.exe no specs #LUMMA comp.exe conhost.exe no specs #LUMMA coml.au3 6e6tigwdlvqf1gvjy2su05dgzg93.exe no specs cmd.exe conhost.exe no specs #HIJACKLOADER 6e6tigwdlvqf1gvjy2su05dgzg93.exe no specs #HIJACKLOADER ftp.exe no specs conhost.exe no specs #HIJACKLOADER imedqheyo6yxco0x6y7.exe #HIJACKLOADER ftp.exe no specs conhost.exe no specs msbuild.exe #AMADEY explorer.exe #XMRIG ngen.exe

Process information

PID
CMD
Path
Indicators
Parent process
608\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1720"C:\Users\admin\AppData\Local\UN_Writer\config\identity_helper.exe" C:\Users\admin\AppData\Local\UN_Writer\config\identity_helper.exe
Setup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
0
Version:
120.0.2210.61
Modules
Images
c:\users\admin\appdata\local\un_writer\config\identity_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2796\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—comp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2920C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
ftp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
MSBuild.exe
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\users\admin\appdata\local\temp\udvsjomauvemcg
c:\windows\system32\mshtml.dll
c:\windows\microsoft.net\framework64\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
2960"C:\WINDOWS\SysWOW64\cmd.exe" /c "C:\Users\admin\AppData\Local\Temp\6E6TIGWDLVQF1GVJY2SU05DGZG93.exe"C:\Windows\SysWOW64\cmd.exe
6E6TIGWDLVQF1GVJY2SU05DGZG93.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3592"C:\Users\admin\AppData\Local\Temp\is-UJV7F.tmp\Setup.tmp" /SL5="$401DE,4066494,791552,C:\Users\admin\Desktop\Setup.exe" C:\Users\admin\AppData\Local\Temp\is-UJV7F.tmp\Setup.tmp
Setup.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\is-ujv7f.tmp\setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
3624\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—ftp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3652C:\WINDOWS\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe
ftp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\mxt
c:\windows\syswow64\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcp_win.dll
Amadey
(PID) Process(3652) explorer.exe
C2proresupdate.com
URLhttp://proresupdate.com/h9fmdW5/index.php
Version4.30
Options
Drop directory4bbb72a446
Drop nameHkbsse.exe
Strings (113)Main
cmd /C RMDIR /s/q
/Plugins/
ESET
" && timeout 1 && del
&& Exit"
lv:
av:
SOFTWARE\Microsoft\Windows NT\CurrentVersion
st=s
Doctor Web
https://
Norton
Content-Type: application/x-www-form-urlencoded
ProductName
/k
Content-Type: multipart/form-data; boundary=----
?scr=1
cred.dll|clip.dll|
vs:
4.30
<d>
exe
ComputerName
2019
id:
" && ren
ar:
:::
Sophos
sd:
#
Bitdefender
Panda Security
2016
abcdefghijklmnopqrstuvwxyz0123456789-_
-unicode-
Programs
Startup
d1
VideoID
bi:
&&
S-%lu-
Content-Disposition: form-data; name="data"; filename="
rb
Rem
\App
rundll32.exe
SYSTEM\ControlSet001\Services\BasicDisplay\Video
------
4bbb72a446
\0000
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
=
Avira
%USERPROFILE%
og:
un:
pc:
WinDefender
r=
+++
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
e0
random
|
&unit=
DefaultSettings.YResolution
GetNativeSystemInfo
360TotalSecurity
-%lu
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
ps1
------
Comodo
AVAST Software
wb
proresupdate.com
\
AVG
/h9fmdW5/index.php
GET
-executionpolicy remotesigned -File "
Powershell.exe
" Content-Type: application/octet-stream
shutdown -s -t 0
kernel32.dll
shell32.dll
dll
"taskkill /f /im "
ProgramData\
CurrentBuild
cmd
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
POST
0123456789
os:
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
"
rundll32
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
<c>
dm:
e1
Hkbsse.exe
http://
--
%-lu
.jpg
Kaspersky Lab
2022
DefaultSettings.XResolution
4012C:\WINDOWS\SysWOW64\ftp.exeC:\Windows\SysWOW64\ftp.exe
6E6TIGWDLVQF1GVJY2SU05DGZG93.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
File Transfer Program
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ftp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ws2_32.dll
4080"C:\Users\admin\AppData\Local\Temp\IMEDQHEYO6YXCO0X6Y7.exe"C:\Users\admin\AppData\Local\Temp\IMEDQHEYO6YXCO0X6Y7.exe
coml.au3
User:
admin
Company:
Select Code UG (haftungsbeschraenkt)
Integrity Level:
MEDIUM
Description:
Econap
Exit code:
1
Version:
1.0.1.0
Modules
Images
c:\users\admin\appdata\local\temp\imedqheyo6yxco0x6y7.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
16 970
Read events
16 899
Write events
61
Delete events
10

Modification events

(PID) Process:(3592) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
080E00005445F74705BDDA01
(PID) Process:(3592) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
8F31286E110F9AB0732293465EDF049EA02B8BFED82AE0F06D20F0C859FEEDC2
(PID) Process:(3592) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(3592) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3592) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3592) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3592) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3592) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:delete valueName:Sequence
Value:

(PID) Process:(3592) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:delete valueName:SessionHash
Value:
㆏渨༑낚≳䚓�鸄⮠ﺋ⫘죰﹙십
(PID) Process:(3592) Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:delete valueName:Owner
Value:
จ
Executable files
15
Suspicious files
12
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
5720comp.exeC:\Users\admin\AppData\Local\Temp\kcndbk —
MD5:—
SHA256:—
3592Setup.tmpC:\Users\admin\AppData\Local\Temp\is-H33VI.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
4360Setup.exeC:\Users\admin\AppData\Local\Temp\is-G8G6V.tmp\Setup.tmpexecutable
MD5:74D1ED8EC351C94F7788CF548162E292
SHA256:62BBBE03B6C4A600FAD73D2301668C0056C02EFDB3987196A76C1EC3AB8F71B0
4140Setup.tmpC:\Users\admin\AppData\Local\Temp\is-S7QUQ.tmp\_isetup\_iscrypt.dllexecutable
MD5:A69559718AB506675E907FE49DEB71E9
SHA256:2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
4140Setup.tmpC:\Users\admin\AppData\Local\UN_Writer\config\tdrfyg.rarcompressed
MD5:2AEFE05B99CEA70AF791E87BFF66D92B
SHA256:E1FC1E36130998C6024ED553AF45A4B2672520E881B5C35AF00799E91A60E6BF
1720identity_helper.exeC:\Users\admin\AppData\Roaming\UploadMon\bistro.txtbinary
MD5:9EECE5CE9AAB4DBE80C1C3D44C728F5E
SHA256:4B91F45EF006660953D2C71DB41336F9CBEBCDF68FC6074631E72406533C7B15
4140Setup.tmpC:\Users\admin\AppData\Local\Temp\is-S7QUQ.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
4140Setup.tmpC:\Users\admin\AppData\Local\UN_Writer\config\is-6U9EQ.tmpcompressed
MD5:2AEFE05B99CEA70AF791E87BFF66D92B
SHA256:E1FC1E36130998C6024ED553AF45A4B2672520E881B5C35AF00799E91A60E6BF
4140Setup.tmpC:\Users\admin\AppData\Local\Temp\is-S7QUQ.tmp\is-7NOQ0.tmpexecutable
MD5:98CCD44353F7BC5BAD1BC6BA9AE0CD68
SHA256:E51021F6CB20EFBD2169F2A2DA10CE1ABCA58B4F5F30FBF4BAE931E4ECAAC99B
4500UnRAR.exeC:\Users\admin\AppData\Local\UN_Writer\config\bistro.txtbinary
MD5:9EECE5CE9AAB4DBE80C1C3D44C728F5E
SHA256:4B91F45EF006660953D2C71DB41336F9CBEBCDF68FC6074631E72406533C7B15
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
37
DNS requests
8
Threats
32

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5952
svchost.exe
GET
200
2.16.164.106:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
3652
explorer.exe
POST
200
45.152.112.146:80
http://proresupdate.com/h9fmdW5/index.php
unknown
—
—
unknown
5140
MoUsoCoreWorker.exe
GET
200
2.16.164.106:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
5256
RUXIMICS.exe
GET
200
2.16.164.106:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
5952
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
2920
MSBuild.exe
POST
200
135.181.22.88:80
http://135.181.22.88/COCACOLA.php
unknown
—
—
unknown
—
—
POST
—
null:443
https://specialadventurousw.shop/api
unknown
—
—
—
—
—
POST
200
null:443
https://specialadventurousw.shop/api
unknown
text
16 b
—
—
—
POST
200
null:443
https://specialadventurousw.shop/api
unknown
text
16 b
—
—
—
POST
200
null:443
https://specialadventurousw.shop/api
unknown
—
16 b
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
unknown
5952
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4364
svchost.exe
239.255.255.250:1900
—
—
—
unknown
5256
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5140
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5952
svchost.exe
2.16.164.106:80
crl.microsoft.com
Akamai International B.V.
NL
unknown
5256
RUXIMICS.exe
2.16.164.106:80
crl.microsoft.com
Akamai International B.V.
NL
unknown
5140
MoUsoCoreWorker.exe
2.16.164.106:80
crl.microsoft.com
Akamai International B.V.
NL
unknown
5952
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5456
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.16.164.106
  • 2.16.164.72
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
specialadventurousw.shop
  • 172.67.193.197
  • 104.21.90.30
malicious
businessdownloads.ltd
  • 104.21.16.123
  • 172.67.212.123
unknown
i.imgur.com
  • 199.232.192.193
  • 199.232.196.193
shared
self.events.data.microsoft.com
  • 20.189.173.2
whitelisted
proresupdate.com
  • 45.152.112.146
unknown

Threats

PID
Process
Class
Message
5180
coml.au3
A Network Trojan was detected
STEALER [ANY.RUN] Lumma Stealer TLS Connection
2184
svchost.exe
A Network Trojan was detected
ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (specialadventurousw .shop)
5180
coml.au3
A Network Trojan was detected
ET MALWARE Observed Lumma Stealer Domain (specialadventurousw .shop) in TLS SNI
—
—
A Network Trojan was detected
ET MALWARE Lumma Stealer Related Activity
—
—
Malware Command and Control Activity Detected
STEALER [ANY.RUN] Win32/Lumma Stealer Check-In
—
—
A Network Trojan was detected
ET MALWARE Lumma Stealer Related Activity M2
—
—
Malware Command and Control Activity Detected
ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration
—
—
Malware Command and Control Activity Detected
STEALER [ANY.RUN] Win32/Lumma Stealer Exfiltration
5180
coml.au3
A Network Trojan was detected
ET MALWARE Observed Lumma Stealer Domain (specialadventurousw .shop) in TLS SNI
5180
coml.au3
A Network Trojan was detected
ET MALWARE Observed Lumma Stealer Domain (specialadventurousw .shop) in TLS SNI
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Setup.exe