File name:

splwow64.exe

Full analysis: https://app.any.run/tasks/264bda92-63de-45bd-9dbf-405326e5b3d7
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: September 23, 2024, 20:10:44
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
amadey
botnet
stealer
loader
metastealer
redline
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

2B01C9B0C69F13DA5EE7889A4B17C45E

SHA1:

27F0C1AE0DDEDDC9EFAC38BC473476B103FEF043

SHA256:

D5526528363CEEB718D30BC669038759C4CD80A1D3E9C8C661B12B261DCC9E29

SSDEEP:

49152:xbJ5NYRgPOau6akedLowwEoE62lde2gje64fzvlTgR/LLiWaBWoKpl7mXLLiA6+0:xbJ5MgdZakcA1E6Gc7jgfcZaLM7mHiTh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 736)

    • AMADEY has been detected (SURICATA)

      • Waters.pif (PID: 6184)

    • Connects to the CnC server

      • Waters.pif (PID: 6184)
      • ZusYB3MdCO.exe (PID: 6384)

    • REDLINE has been detected (YARA)

      • ZusYB3MdCO.exe (PID: 6384)

    • REDLINE has been detected (SURICATA)

      • ZusYB3MdCO.exe (PID: 6384)

    • METASTEALER has been detected (SURICATA)

      • ZusYB3MdCO.exe (PID: 6384)
      • Aw9ir134T1.exe (PID: 5160)

    • Stealers network behavior

      • ZusYB3MdCO.exe (PID: 6384)
      • Aw9ir134T1.exe (PID: 5160)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • splwow64.exe (PID: 4476)

    • Starts CMD.EXE for commands execution

      • splwow64.exe (PID: 4476)
      • cmd.exe (PID: 2892)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 2892)

    • Get information on the list of running processes

      • cmd.exe (PID: 2892)

    • Executing commands from a ".bat" file

      • splwow64.exe (PID: 4476)

    • Application launched itself

      • cmd.exe (PID: 2892)

    • Executable content was dropped or overwritten

      • cmd.exe (PID: 2892)
      • Waters.pif (PID: 6184)
      • RegAsm.exe (PID: 6352)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2892)
      • wscript.exe (PID: 4520)

    • Drops a file with a rarely used extension (PIF)

      • cmd.exe (PID: 2892)

    • The executable file from the user directory is run by the CMD process

      • Waters.pif (PID: 6184)

    • Connects to unusual port

      • ZusYB3MdCO.exe (PID: 6384)
      • Aw9ir134T1.exe (PID: 5160)

    • Contacting a server suspected of hosting an CnC

      • Waters.pif (PID: 6184)
      • Aw9ir134T1.exe (PID: 5160)

    • Potential Corporate Privacy Violation

      • Waters.pif (PID: 6184)

    • The process executes via Task Scheduler

      • wscript.exe (PID: 4520)

  • INFO

    • Checks supported languages

      • splwow64.exe (PID: 4476)

    • The process uses the downloaded file

      • splwow64.exe (PID: 4476)

    • Create files in a temporary directory

      • splwow64.exe (PID: 4476)

    • Reads the computer name

      • splwow64.exe (PID: 4476)

    • Process checks computer location settings

      • splwow64.exe (PID: 4476)

    • Manual execution by a user

      • cmd.exe (PID: 736)
      • cmd.exe (PID: 6680)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

RedLine

(PID) Process(6384) ZusYB3MdCO.exe
C2 (1)65.21.18.51:45580
Botnet@LOGSCLOUDYT_BOT
Options
ErrorMessage
Keys
XorBackswords
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:02:24 19:19:43+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 28672
InitializedDataSize: 4120064
UninitializedDataSize: 16896
EntryPoint: 0x3899
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 10.0.22621.3672
ProductVersionNumber: 10.0.22621.3672
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Print driver host for applications
FileVersion: 10.0.22621.3672 (WinBuild.160101.0800)
InternalName: splwow64.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: splwow64.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 10.0.22621.3672
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
27
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start splwow64.exe no specs cmd.exe conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs #AMADEY waters.pif choice.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs 12dsvc.exe no specs conhost.exe no specs regasm.exe no specs regasm.exe no specs regasm.exe #METASTEALER aw9ir134t1.exe conhost.exe no specs #REDLINE zusyb3mdco.exe wscript.exe no specs quantumflow.scr no specs

Process information

PID
CMD
Path
Indicators
Parent process
376\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
736cmd /c schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /FC:\Windows\SysWOW64\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
740tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1048schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /FC:\Windows\SysWOW64\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1076cmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2472\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Aw9ir134T1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2892"C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.batC:\Windows\SysWOW64\cmd.exe
splwow64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3140findstr /I "wrsa opssvc" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3324"C:\Users\admin\AppData\Local\Temp\1000434001\12dsvc.exe" C:\Users\admin\AppData\Local\Temp\1000434001\12dsvc.exe—Waters.pif
User:
admin
Company:
Production subsumption
Integrity Level:
MEDIUM
Description:
protestations wonk separationist
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\1000434001\12dsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
4280\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—12dsvc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
10 550
Read events
10 546
Write events
4
Delete events
0

Modification events

(PID) Process:(6184) Waters.pifKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6184) Waters.pifKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6184) Waters.pifKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4520) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wscript.exe
Operation:writeName:JScriptSetScriptStateStarted
Value:
6F88230000000000
Executable files
6
Suspicious files
18
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
4476splwow64.exeC:\Users\admin\AppData\Local\Temp\Temperaturebinary
MD5:249D56CBE275C2258CCD964F0C6241D9
SHA256:7C16E21E29D442BF0B459D083198B22EE9C6D9926E3AA61F43DC3A1EE3ECB731
2892cmd.exeC:\Users\admin\AppData\Local\Temp\607698\Waters.pifexecutable
MD5:71E28D40E99E3136459D1A310748A687
SHA256:141E3E9EDF7943E768B146BA6AB8B4A6A79F162B5054EF9AFA0D11E236DB07E1
4476splwow64.exeC:\Users\admin\AppData\Local\Temp\Languagebinary
MD5:5DE7106DF85E2F96F46F642D98433AD1
SHA256:9201319C9C07E4312717845E59C9FE3A987F70575CD63E4C042DB778EBE4D5E9
4476splwow64.exeC:\Users\admin\AppData\Local\Temp\Virusesbinary
MD5:7C9DD6F9FA719321B72805DF762A82DA
SHA256:98232A6528BEB079D8FA9D77751722159D4974E6859DF867EFB3BA7A3EEC4BEC
4476splwow64.exeC:\Users\admin\AppData\Local\Temp\Ashleybinary
MD5:E522956891659C41BD8550B8D5E16231
SHA256:DDB7F60AB5F8957955DD20F2DC270E3EF833D3727F374A8C4C444634BD05609D
4476splwow64.exeC:\Users\admin\AppData\Local\Temp\Flabinary
MD5:E139E52F93AE3E19AB47F437CBE8B3DE
SHA256:E0C1C46FA4582A3826F7AED2F7FB454D3EE42A425F214321910C25CC1D8879D5
4476splwow64.exeC:\Users\admin\AppData\Local\Temp\Navybinary
MD5:D4EB107CFD9FC38ED7E7B253562E155A
SHA256:68E9A8D57BA2A484DD28A1AFED5262A86AFF4D81467B93B4072F329FAB984F4C
4476splwow64.exeC:\Users\admin\AppData\Local\Temp\Widthbinary
MD5:12D9AD507C856D833101C9E367466555
SHA256:8E7415ED2D0D5C6E69D6A02BC3928C9ADF685A43932E4543084B917946361974
6184Waters.pifC:\Users\admin\AppData\Local\QuantumDynamics Lab\Wbinary
MD5:7B5632DCD418BCBAE2A9009DBAF85F37
SHA256:361E9C3B62719B79BC280420B5F710E160FD55F2250BF605911DED7162483DB4
4476splwow64.exeC:\Users\admin\AppData\Local\Temp\Participantsbinary
MD5:F0E725ADDF4EC15A56AA0BDE5BD8B2A7
SHA256:7CBD6810CB4DD516EEB75DF79D1DB55F74471C11594333AC225F24BFC0FCA7CA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
42
DNS requests
16
Threats
41

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6184
Waters.pif
POST
200
185.215.113.19:80
http://185.215.113.19/CoreOPT/index.php
unknown
—
—
unknown
6184
Waters.pif
GET
200
194.116.215.195:80
http://194.116.215.195/12dsvc.exe
unknown
—
—
suspicious
6184
Waters.pif
POST
200
185.215.113.19:80
http://185.215.113.19/CoreOPT/index.php
unknown
—
—
unknown
936
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2340
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2120
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6184
Waters.pif
POST
200
185.215.113.19:80
http://185.215.113.19/CoreOPT/index.php?scr=1
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
52.167.17.97:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
2120
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
936
svchost.exe
40.126.32.74:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
936
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
5104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5336
SearchApp.exe
20.189.173.7:443
browser.pipe.aria.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5336
SearchApp.exe
2.23.209.143:443
www.bing.com
Akamai International B.V.
GB
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 52.167.17.97
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.238
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 88.221.169.152
whitelisted
login.live.com
  • 40.126.32.74
  • 40.126.32.140
  • 40.126.32.76
  • 20.190.160.22
  • 40.126.32.133
  • 40.126.32.72
  • 20.190.160.14
  • 40.126.32.138
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
HAYtAoQHDCIZfrnmkrkib.HAYtAoQHDCIZfrnmkrkib
  • —
unknown
browser.pipe.aria.microsoft.com
  • 20.189.173.7
whitelisted
www.bing.com
  • 2.23.209.143
  • 2.23.209.150
  • 2.23.209.130
  • 2.23.209.187
  • 2.23.209.183
  • 2.23.209.135
  • 2.23.209.154
  • 2.23.209.189
  • 2.23.209.133
whitelisted
slscr.update.microsoft.com
  • 52.165.165.26
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

PID
Process
Class
Message
6184
Waters.pif
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
6184
Waters.pif
A Network Trojan was detected
ET MALWARE Amadey Bot Activity (POST) M1
6184
Waters.pif
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
6184
Waters.pif
A Network Trojan was detected
ET MALWARE Amadey Bot Activity (POST)
6184
Waters.pif
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
6184
Waters.pif
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
6184
Waters.pif
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
6184
Waters.pif
A Network Trojan was detected
ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2
5160
Aw9ir134T1.exe
Malware Command and Control Activity Detected
ET MALWARE [ANY.RUN] MetaStealer v.5 (MC-NMF TLS Server Certificate)
5160
Aw9ir134T1.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] MetaStealer v.5 TLS Certificate
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
splwow64.exe