File name:

Gxtuum.exe

Full analysis: https://app.any.run/tasks/725af1c9-62e1-4f9c-abd7-aeea85bc6404
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: October 18, 2024, 22:57:56
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
amadey
botnet
stealer
rdp
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

4DBA58C6E9F435C1CCA607525760D0FD

SHA1:

FF8D2AFD9D7F0A828592FEE34CA55D1A3542F7ED

SHA256:

D2886D86EF67A3550A4AADCF623AA785FDDCD3AF754B3035229647F186005B1C

SSDEEP:

6144:uh+qpGOcf7Coo7yr59HD9ntjVhmX/WksAqFc7QjaSXeY:eDQCbaTHD9nNrmXekqFzteY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AMADEY has been detected (SURICATA)

      • rundll32.exe (PID: 3824)
      • Gxtuum.exe (PID: 6432)

    • Connects to the CnC server

      • Gxtuum.exe (PID: 6432)
      • rundll32.exe (PID: 3824)

    • AMADEY has been detected (YARA)

      • Gxtuum.exe (PID: 6432)
      • rundll32.exe (PID: 3824)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Gxtuum.exe (PID: 1156)
      • Gxtuum.exe (PID: 6432)

    • Starts itself from another location

      • Gxtuum.exe (PID: 1156)

    • Executable content was dropped or overwritten

      • Gxtuum.exe (PID: 1156)
      • Gxtuum.exe (PID: 6432)

    • Process requests binary or script from the Internet

      • Gxtuum.exe (PID: 6432)

    • Potential Corporate Privacy Violation

      • Gxtuum.exe (PID: 6432)

    • Contacting a server suspected of hosting an CnC

      • Gxtuum.exe (PID: 6432)

    • Connects to the server without a host name

      • Gxtuum.exe (PID: 6432)
      • rundll32.exe (PID: 3824)

    • There is functionality for enable RDP (YARA)

      • Gxtuum.exe (PID: 6432)

    • The process executes via Task Scheduler

      • Gxtuum.exe (PID: 2684)
      • Gxtuum.exe (PID: 5284)
      • Gxtuum.exe (PID: 6196)

  • INFO

    • Checks supported languages

      • Gxtuum.exe (PID: 1156)
      • Gxtuum.exe (PID: 6432)

    • Reads the computer name

      • Gxtuum.exe (PID: 1156)
      • Gxtuum.exe (PID: 6432)

    • Create files in a temporary directory

      • Gxtuum.exe (PID: 1156)

    • The process uses the downloaded file

      • Gxtuum.exe (PID: 1156)
      • Gxtuum.exe (PID: 6432)

    • Process checks computer location settings

      • Gxtuum.exe (PID: 1156)
      • Gxtuum.exe (PID: 6432)

    • Reads security settings of Internet Explorer

      • rundll32.exe (PID: 3824)

    • Checks proxy server information

      • Gxtuum.exe (PID: 6432)
      • rundll32.exe (PID: 3824)

    • Creates files or folders in the user directory

      • Gxtuum.exe (PID: 6432)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(6432) Gxtuum.exe
C2176.111.174.140
URLhttp://176.111.174.140/t9bdjZsL2/index.php
Version5.03
Options
Drop directory87d87ee084
Drop nameGxtuum.exe
Strings (125)Kaspersky Lab
ProductName
------
POST
ESET
random
bi:
0000043f
S-%lu-
Doctor Web
GET
Bitdefender
-unicode-
#
ar:
/Plugins/
cred.dll
VideoID
/quiet
wb
&&
e3
Powershell.exe
"
00000422
\
cmd /C RMDIR /s/q
00000423
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
un:
cred.dll|clip.dll|
e2
Programs
msi
av:
r=
DefaultSettings.YResolution
AVG
dm:
rb
Panda Security
" && timeout 1 && del
Main
zip
5.03
SOFTWARE\Microsoft\Windows NT\CurrentVersion
%-lu
Norton
/t9bdjZsL2/index.php
Comodo
e1
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
2016
CurrentBuild
Sophos
<d>
ComputerName
pc:
GetNativeSystemInfo
abcdefghijklmnopqrstuvwxyz0123456789-_
d1
lv:
AVAST Software
:::
Rem
exe
|
vs:
--
https://
WinDefender
st=s
&unit=
Startup
=
kernel32.dll
ProgramData\
rundll32.exe
id:
sd:
" && ren
Keyboard Layout\Preload
00000419
/k
87d87ee084
.jpg
+++
-executionpolicy remotesigned -File "
"taskkill /f /im "
cmd
?scr=1
360TotalSecurity
0123456789
dll
shell32.dll
Content-Type: multipart/form-data; boundary=----
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Content-Disposition: form-data; name="data"; filename="
-%lu
------
\0000
ps1
Avira
clip.dll
2019
&& Exit"
rundll32
SYSTEM\ControlSet001\Services\BasicDisplay\Video
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
\App
http://
%USERPROFILE%
shutdown -s -t 0
" Content-Type: application/octet-stream
Content-Type: application/x-www-form-urlencoded
Gxtuum.exe
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
og:
<c>
DefaultSettings.XResolution
os:
2025
2022
176.111.174.140
(PID) Process(3824) rundll32.exe
C2176.111.174.140
URLhttp://176.111.174.140/t9bdjZsL2/index.php
Version5.03
Options
Drop directorySOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched
Drop nameElectrum.exe
Strings (90)\Mozilla\Firefox\Profiles\
_Armory
\SputnikLab\Sputnik\User Data\Local State
\Comodo\Dragon\User Data\Default\Login Data
xlsx
DashCore\wallets\
Electrum\wallets
folder=
\Google\Chrome\User Data\Local State
S-%lu-
electrum_data\wallets
Chedot
Telegram.exe
doc
Electrum.exe
_Exodus
Chromium
Dogecoin\
Taskkill /IM litecoin-qt.exe /F
tdata\
\Chromium\User Data\Default\Login Data
_Telegram(
\Microsoft\Edge\User Data\Local State
\CentBrowser\User Data\Local State
_Dogecoin
SELECT origin_url, username_value, password_value FROM logins
tdata
\SputnikLab\Sputnik\User Data\Default\Login Data
\user_data
\Orbitum\User Data\Default\Login Data
Edge
\CocCoc\Browser\User Data\Default\Login Data
Litecoin\wallets
configs
Sputnik
\Chromium\User Data\Local State
\dictionaries
Telegram
CentBrowser
\Vivaldi\User Data\Local State
CocCoc
txt
\logins.json
5.03
%-lu
\Microsoft\Edge\User Data\Default\Login Data
/t9bdjZsL2/index.php
docx
_Files_\
Comodo
Taskkill /IM ArmoryQt.exe /F
\Opera Software\Opera Stable\Login Data
Armory\
xls
*.dat
Electrum
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched
\Comodo\Dragon\User Data\Local State
Opera
Taskkill /IM dash-qt.exe /F
_Litecoin
\Vivaldi\User Data\Default\Login Data
netsh wlan export profile name=
key_datas
\Opera Software\Opera Stable\Local State
_Electrum(
Orbitum
\emoji
).zip
\CentBrowser\User Data\Default\Login Data
_Atomic
maps
_Dashcore
\CocCoc\Browser\User Data\Local State
\Chedot\User Data\Default\Login Data
\Google\Chrome\User Data\Default\Login Data
.zip
Taskkill /IM "Atomic Wallet.exe" /F
key=clear
Vivaldi
_Desktop.zip
atomic\Local Storage\
-%lu
\Orbitum\User Data\Local State
tdata\key_datas
Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Chrome
\Chedot\User Data\Local State
Exodus\exodus.wallet\
176.111.174.140
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:10:17 10:16:33+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 323584
InitializedDataSize: 131072
UninitializedDataSize: -
EntryPoint: 0x2a097
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
9
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start gxtuum.exe #AMADEY gxtuum.exe #AMADEY rundll32.exe sppextcomobj.exe no specs slui.exe gxtuum.exe no specs slui.exe gxtuum.exe no specs gxtuum.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1156"C:\Users\admin\AppData\Local\Temp\Gxtuum.exe" C:\Users\admin\AppData\Local\Temp\Gxtuum.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\gxtuum.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2376"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2684"C:\Users\admin\AppData\Local\Temp\87d87ee084\Gxtuum.exe"C:\Users\admin\AppData\Local\Temp\87d87ee084\Gxtuum.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\87d87ee084\gxtuum.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
3824"C:\Windows\System32\rundll32.exe" C:\Users\admin\AppData\Roaming\43266f2abbf198\clip64.dll, MainC:\Windows\SysWOW64\rundll32.exe
Gxtuum.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Amadey
(PID) Process(3824) rundll32.exe
C2176.111.174.140
URLhttp://176.111.174.140/t9bdjZsL2/index.php
Version5.03
Options
Drop directorySOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched
Drop nameElectrum.exe
Strings (90)\Mozilla\Firefox\Profiles\
_Armory
\SputnikLab\Sputnik\User Data\Local State
\Comodo\Dragon\User Data\Default\Login Data
xlsx
DashCore\wallets\
Electrum\wallets
folder=
\Google\Chrome\User Data\Local State
S-%lu-
electrum_data\wallets
Chedot
Telegram.exe
doc
Electrum.exe
_Exodus
Chromium
Dogecoin\
Taskkill /IM litecoin-qt.exe /F
tdata\
\Chromium\User Data\Default\Login Data
_Telegram(
\Microsoft\Edge\User Data\Local State
\CentBrowser\User Data\Local State
_Dogecoin
SELECT origin_url, username_value, password_value FROM logins
tdata
\SputnikLab\Sputnik\User Data\Default\Login Data
\user_data
\Orbitum\User Data\Default\Login Data
Edge
\CocCoc\Browser\User Data\Default\Login Data
Litecoin\wallets
configs
Sputnik
\Chromium\User Data\Local State
\dictionaries
Telegram
CentBrowser
\Vivaldi\User Data\Local State
CocCoc
txt
\logins.json
5.03
%-lu
\Microsoft\Edge\User Data\Default\Login Data
/t9bdjZsL2/index.php
docx
_Files_\
Comodo
Taskkill /IM ArmoryQt.exe /F
\Opera Software\Opera Stable\Login Data
Armory\
xls
*.dat
Electrum
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched
\Comodo\Dragon\User Data\Local State
Opera
Taskkill /IM dash-qt.exe /F
_Litecoin
\Vivaldi\User Data\Default\Login Data
netsh wlan export profile name=
key_datas
\Opera Software\Opera Stable\Local State
_Electrum(
Orbitum
\emoji
).zip
\CentBrowser\User Data\Default\Login Data
_Atomic
maps
_Dashcore
\CocCoc\Browser\User Data\Local State
\Chedot\User Data\Default\Login Data
\Google\Chrome\User Data\Default\Login Data
.zip
Taskkill /IM "Atomic Wallet.exe" /F
key=clear
Vivaldi
_Desktop.zip
atomic\Local Storage\
-%lu
\Orbitum\User Data\Local State
tdata\key_datas
Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Chrome
\Chedot\User Data\Local State
Exodus\exodus.wallet\
176.111.174.140
4408C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5284"C:\Users\admin\AppData\Local\Temp\87d87ee084\Gxtuum.exe"C:\Users\admin\AppData\Local\Temp\87d87ee084\Gxtuum.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\87d87ee084\gxtuum.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
6196"C:\Users\admin\AppData\Local\Temp\87d87ee084\Gxtuum.exe"C:\Users\admin\AppData\Local\Temp\87d87ee084\Gxtuum.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\87d87ee084\gxtuum.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
6392C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6432"C:\Users\admin\AppData\Local\Temp\87d87ee084\Gxtuum.exe" C:\Users\admin\AppData\Local\Temp\87d87ee084\Gxtuum.exe
Gxtuum.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\87d87ee084\gxtuum.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Amadey
(PID) Process(6432) Gxtuum.exe
C2176.111.174.140
URLhttp://176.111.174.140/t9bdjZsL2/index.php
Version5.03
Options
Drop directory87d87ee084
Drop nameGxtuum.exe
Strings (125)Kaspersky Lab
ProductName
------
POST
ESET
random
bi:
0000043f
S-%lu-
Doctor Web
GET
Bitdefender
-unicode-
#
ar:
/Plugins/
cred.dll
VideoID
/quiet
wb
&&
e3
Powershell.exe
"
00000422
\
cmd /C RMDIR /s/q
00000423
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
un:
cred.dll|clip.dll|
e2
Programs
msi
av:
r=
DefaultSettings.YResolution
AVG
dm:
rb
Panda Security
" && timeout 1 && del
Main
zip
5.03
SOFTWARE\Microsoft\Windows NT\CurrentVersion
%-lu
Norton
/t9bdjZsL2/index.php
Comodo
e1
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
2016
CurrentBuild
Sophos
<d>
ComputerName
pc:
GetNativeSystemInfo
abcdefghijklmnopqrstuvwxyz0123456789-_
d1
lv:
AVAST Software
:::
Rem
exe
|
vs:
--
https://
WinDefender
st=s
&unit=
Startup
=
kernel32.dll
ProgramData\
rundll32.exe
id:
sd:
" && ren
Keyboard Layout\Preload
00000419
/k
87d87ee084
.jpg
+++
-executionpolicy remotesigned -File "
"taskkill /f /im "
cmd
?scr=1
360TotalSecurity
0123456789
dll
shell32.dll
Content-Type: multipart/form-data; boundary=----
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Content-Disposition: form-data; name="data"; filename="
-%lu
------
\0000
ps1
Avira
clip.dll
2019
&& Exit"
rundll32
SYSTEM\ControlSet001\Services\BasicDisplay\Video
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
\App
http://
%USERPROFILE%
shutdown -s -t 0
" Content-Type: application/octet-stream
Content-Type: application/x-www-form-urlencoded
Gxtuum.exe
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
og:
<c>
DefaultSettings.XResolution
os:
2025
2022
176.111.174.140
Total events
2 325
Read events
2 319
Write events
6
Delete events
0

Modification events

(PID) Process:(6432) Gxtuum.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6432) Gxtuum.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6432) Gxtuum.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3824) rundll32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3824) rundll32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3824) rundll32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
3
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6432Gxtuum.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\clip64[1].dllexecutable
MD5:FC4FAAA0D820E943DBF1235A84AE165E
SHA256:A06F2283F9DB8322C1FB8603553F3DCF6592D41072707CABD4934FFA64C4C1AA
1156Gxtuum.exeC:\Users\admin\AppData\Local\Temp\87d87ee084\Gxtuum.exeexecutable
MD5:4DBA58C6E9F435C1CCA607525760D0FD
SHA256:D2886D86EF67A3550A4AADCF623AA785FDDCD3AF754B3035229647F186005B1C
1156Gxtuum.exeC:\Windows\Tasks\Gxtuum.jobbinary
MD5:00BF9F9BFDB218718237E544A5357930
SHA256:0385572D16CF1CFFB9C4D3473C02A2814D23B876CCECECD79F2FB9E13F7357AC
6432Gxtuum.exeC:\Users\admin\AppData\Roaming\43266f2abbf198\clip64.dllexecutable
MD5:FC4FAAA0D820E943DBF1235A84AE165E
SHA256:A06F2283F9DB8322C1FB8603553F3DCF6592D41072707CABD4934FFA64C4C1AA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
62
DNS requests
23
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6432
Gxtuum.exe
GET
200
176.111.174.140:80
http://176.111.174.140/t9bdjZsL2/Plugins/clip64.dll
unknown
—
—
unknown
6432
Gxtuum.exe
POST
200
176.111.174.140:80
http://176.111.174.140/t9bdjZsL2/index.php
unknown
—
—
malicious
6432
Gxtuum.exe
POST
200
176.111.174.140:80
http://176.111.174.140/t9bdjZsL2/index.php
unknown
—
—
malicious
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1552
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3824
rundll32.exe
POST
200
176.111.174.140:80
http://176.111.174.140/t9bdjZsL2/index.php
unknown
—
—
malicious
6944
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6432
Gxtuum.exe
POST
200
176.111.174.140:80
http://176.111.174.140/t9bdjZsL2/index.php
unknown
—
—
malicious
6944
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5940
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5488
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3396
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4360
SearchApp.exe
104.126.37.131:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4360
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6432
Gxtuum.exe
176.111.174.140:80
—
Chang Way Technologies Co. Limited
RU
malicious
1552
svchost.exe
40.126.32.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1552
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
  • 20.73.194.208
whitelisted
www.bing.com
  • 104.126.37.131
  • 104.126.37.139
  • 104.126.37.128
  • 104.126.37.176
  • 104.126.37.163
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
google.com
  • 216.58.206.78
whitelisted
login.live.com
  • 40.126.32.68
  • 40.126.32.136
  • 40.126.32.72
  • 40.126.32.74
  • 20.190.160.17
  • 20.190.160.20
  • 40.126.32.140
  • 20.190.160.14
whitelisted
th.bing.com
  • 104.126.37.128
  • 104.126.37.176
  • 104.126.37.131
  • 104.126.37.163
whitelisted
go.microsoft.com
  • 184.30.17.189
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted

Threats

PID
Process
Class
Message
6432
Gxtuum.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 30
6432
Gxtuum.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
6432
Gxtuum.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
6432
Gxtuum.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
6432
Gxtuum.exe
A Network Trojan was detected
BOTNET [ANY.RUN] Amadey Clipper plugin download request
6432
Gxtuum.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
5 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Gxtuum.exe