File name:

db5e1f211e4989246fb82f9eaf04a521be5a6322ae6e8b4d0430fc78139b79cb.exe

Full analysis: https://app.any.run/tasks/85e12077-0b9a-4cc5-b2c5-fb060411f6d6
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: November 05, 2024, 04:27:39
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
lumma
stealer
exfiltration
loader
stealc
amadey
botnet
themida
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

22855D02FCD9DD28C0C47DEFCD45BAF6

SHA1:

EE0ECF0CC237907E9F8CB835E423B710CCF98B7D

SHA256:

DB5E1F211E4989246FB82F9EAF04A521BE5A6322AE6E8B4D0430FC78139B79CB

SSDEEP:

98304:Un2mXCPJmSSadYa15fYvB2h47Zzl9AqknTIVucsbCeWIVnsom4HCA4PqwBH0rKpH:zj+LJ4fYF/E+QQy0q

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • LUMMA has been detected (YARA)

      • 2l7025.exe (PID: 5196)
      • a792b66409.exe (PID: 5524)
    • Connects to the CnC server

      • 3C12L.exe (PID: 4080)
      • 2l7025.exe (PID: 5196)
      • svchost.exe (PID: 2172)
      • 113bf88fca.exe (PID: 6780)
      • skotes.exe (PID: 1172)
      • a792b66409.exe (PID: 5524)
    • STEALC has been detected (SURICATA)

      • 2l7025.exe (PID: 5196)
      • 3C12L.exe (PID: 4080)
      • 113bf88fca.exe (PID: 6780)
      • a792b66409.exe (PID: 5524)
    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2172)
      • 2l7025.exe (PID: 5196)
      • a792b66409.exe (PID: 5524)
    • AMADEY has been detected (SURICATA)

      • skotes.exe (PID: 1172)
    • AMADEY has been detected (YARA)

      • skotes.exe (PID: 1172)
    • Possible tool for stealing has been detected

      • firefox.exe (PID: 6908)
      • c0956a93d5.exe (PID: 1764)
  • SUSPICIOUS

    • Process drops legitimate windows executable

      • db5e1f211e4989246fb82f9eaf04a521be5a6322ae6e8b4d0430fc78139b79cb.exe (PID: 6708)
    • Starts a Microsoft application from unusual location

      • db5e1f211e4989246fb82f9eaf04a521be5a6322ae6e8b4d0430fc78139b79cb.exe (PID: 6708)
      • L2n14.exe (PID: 6828)
    • Executable content was dropped or overwritten

      • db5e1f211e4989246fb82f9eaf04a521be5a6322ae6e8b4d0430fc78139b79cb.exe (PID: 6708)
      • L2n14.exe (PID: 6828)
      • 4e702J.exe (PID: 7020)
      • skotes.exe (PID: 1172)
    • Reads the BIOS version

      • 2l7025.exe (PID: 5196)
    • Connects to the server without a host name

      • 2l7025.exe (PID: 5196)
      • 3C12L.exe (PID: 4080)
      • 113bf88fca.exe (PID: 6780)
      • skotes.exe (PID: 1172)
      • a792b66409.exe (PID: 5524)
    • Process requests binary or script from the Internet

      • 2l7025.exe (PID: 5196)
      • skotes.exe (PID: 1172)
      • a792b66409.exe (PID: 5524)
    • Contacting a server suspected of hosting an CnC

      • 3C12L.exe (PID: 4080)
      • svchost.exe (PID: 2172)
      • 2l7025.exe (PID: 5196)
      • a792b66409.exe (PID: 5524)
      • 113bf88fca.exe (PID: 6780)
      • skotes.exe (PID: 1172)
    • Potential Corporate Privacy Violation

      • 2l7025.exe (PID: 5196)
      • skotes.exe (PID: 1172)
      • a792b66409.exe (PID: 5524)
    • Uses TASKKILL.EXE to kill Browsers

      • c0956a93d5.exe (PID: 1764)
    • Starts itself from another location

      • 4e702J.exe (PID: 7020)
    • The process executes via Task Scheduler

      • skotes.exe (PID: 7268)
      • skotes.exe (PID: 8040)
    • Uses TASKKILL.EXE to kill process

      • c0956a93d5.exe (PID: 1764)
  • INFO

    • Create files in a temporary directory

      • db5e1f211e4989246fb82f9eaf04a521be5a6322ae6e8b4d0430fc78139b79cb.exe (PID: 6708)
      • L2n14.exe (PID: 6828)
    • Checks supported languages

      • db5e1f211e4989246fb82f9eaf04a521be5a6322ae6e8b4d0430fc78139b79cb.exe (PID: 6708)
      • L2n14.exe (PID: 6828)
      • 2l7025.exe (PID: 5196)
    • Sends debugging messages

      • 2l7025.exe (PID: 5196)
    • Reads the computer name

      • 2l7025.exe (PID: 5196)
    • Reads the software policy settings

      • 2l7025.exe (PID: 5196)
    • Reads the machine GUID from the registry

      • 2l7025.exe (PID: 5196)
    • Themida protector has been detected

      • 2l7025.exe (PID: 5196)
      • skotes.exe (PID: 1172)
      • a792b66409.exe (PID: 5524)
    • Application launched itself

      • firefox.exe (PID: 944)
      • firefox.exe (PID: 6908)
    • Executable content was dropped or overwritten

      • firefox.exe (PID: 944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:05:24 22:49:06+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.13
CodeSize: 25600
InitializedDataSize: 5789184
UninitializedDataSize: -
EntryPoint: 0x6a60
OSVersion: 10
ImageVersion: 10
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 11.0.17763.1
ProductVersionNumber: 11.0.17763.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor
FileVersion: 11.00.17763.1 (WinBuild.160101.0800)
InternalName: Wextract
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: WEXTRACT.EXE .MUI
ProductName: Internet Explorer
ProductVersion: 11.00.17763.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
158
Monitored processes
36
Malicious processes
10
Suspicious processes
1

Behavior graph

Click at the process to see the details
start db5e1f211e4989246fb82f9eaf04a521be5a6322ae6e8b4d0430fc78139b79cb.exe l2n14.exe #LUMMA 2l7025.exe #LUMMA svchost.exe #STEALC 3c12l.exe 4e702j.exe #AMADEY skotes.exe #LUMMA a792b66409.exe #STEALC 113bf88fca.exe THREAT c0956a93d5.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs THREAT firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs 577ea44605.exe skotes.exe firefox.exe no specs firefox.exe no specs skotes.exe

Process information

PID
CMD
Path
Indicators
Parent process
944"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blockingC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1008\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exetaskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1172"C:\Users\admin\AppData\Local\Temp\abc3bc1985\skotes.exe" C:\Users\admin\AppData\Local\Temp\abc3bc1985\skotes.exe
4e702J.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\abc3bc1985\skotes.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1200"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1856 -parentBuildID 20240213221259 -prefsHandle 1784 -prefMapHandle 1776 -prefsLen 30705 -prefMapSize 244343 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e0f91390-5392-4fdc-aab3-a966711a37d1} 944 "\\.\pipe\gecko-crash-server-pipe.944" 244e8ebc810 gpuC:\Program Files\Mozilla Firefox\firefox.exefirefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1732\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exetaskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1764"C:\Users\admin\AppData\Local\Temp\1004019001\c0956a93d5.exe" C:\Users\admin\AppData\Local\Temp\1004019001\c0956a93d5.exe
skotes.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\1004019001\c0956a93d5.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2172C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3020"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6128 -childID 6 -isForBrowser -prefsHandle 6048 -prefMapHandle 6052 -prefsLen 31108 -prefMapSize 244343 -jsInitHandle 1112 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1152e3c2-47eb-49a1-96c1-0854ee9c8f7d} 944 "\\.\pipe\gecko-crash-server-pipe.944" 244f3c70310 tabC:\Program Files\Mozilla Firefox\firefox.exefirefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3568"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2932 -childID 1 -isForBrowser -prefsHandle 2928 -prefMapHandle 2924 -prefsLen 26798 -prefMapSize 244343 -jsInitHandle 1112 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {82dc9b06-9589-4488-ab70-5f20445af530} 944 "\\.\pipe\gecko-crash-server-pipe.944" 244eeb8f150 tabC:\Program Files\Mozilla Firefox\firefox.exefirefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3644"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5868 -childID 5 -isForBrowser -prefsHandle 5480 -prefMapHandle 5484 -prefsLen 31108 -prefMapSize 244343 -jsInitHandle 1112 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {971ed453-f770-47f1-9864-cfaab285c2d1} 944 "\\.\pipe\gecko-crash-server-pipe.944" 244f0ed04d0 tabC:\Program Files\Mozilla Firefox\firefox.exefirefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
23 240
Read events
23 220
Write events
20
Delete events
0

Modification events

(PID) Process:(5196) 2l7025.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5196) 2l7025.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5196) 2l7025.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4080) 3C12L.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4080) 3C12L.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4080) 3C12L.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1172) skotes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1172) skotes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1172) skotes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1172) skotes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:a792b66409.exe
Value:
C:\Users\admin\AppData\Local\Temp\1004017001\a792b66409.exe
Executable files
15
Suspicious files
163
Text files
64
Unknown types
1

Dropped files

PID
Process
Filename
Type
944firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin
MD5:
SHA256:
6828L2n14.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\2l7025.exeexecutable
MD5:94F7FD12C529BC5D28BE7319B857E96B
SHA256:2367242EDE5C10E68FDB4A893D23A8257BBE5E78347E6E24676CBE36139E25EE
6828L2n14.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\3C12L.exeexecutable
MD5:5C4E5D818A24CB9D69FC18CE0DBBD9BE
SHA256:C2295F41E3E74394823EBC9F99265D4021DE67F36E3C257600D610781E2F4FFB
70204e702J.exeC:\Windows\Tasks\skotes.jobbinary
MD5:C65FE552FEAEAE6FC9F2E2F0C23B3237
SHA256:73F048D4C533ABC101BACAE094A699C862FE6E1794D069455AF8B6ADE1B4E874
944firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.jsonbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
1172skotes.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\random[1].exeexecutable
MD5:E9FD4BECFD9B49F223D2FD97CFB1902B
SHA256:E76DD541C5CBE86AE033519A325658848102F7F2A0B2B1866EC80BD9F0E8BAC4
944firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\urlCache-current.binbinary
MD5:C09FF302D57C404B61E6A89B0B9F36E7
SHA256:6A5B4F82595799346D0E501FE6CC8629E0FD6ED27B74D0E6CB5073DDB2E3C40B
6708db5e1f211e4989246fb82f9eaf04a521be5a6322ae6e8b4d0430fc78139b79cb.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\L2n14.exeexecutable
MD5:9C6484EE43B103F6D28C96CC9DBBE612
SHA256:C676483C04388A44C33648542699CDA4A54048AF8E0FD186E00D76DE5C5E84D3
1172skotes.exeC:\Users\admin\AppData\Local\Temp\1004017001\a792b66409.exeexecutable
MD5:E9FD4BECFD9B49F223D2FD97CFB1902B
SHA256:E76DD541C5CBE86AE033519A325658848102F7F2A0B2B1866EC80BD9F0E8BAC4
6708db5e1f211e4989246fb82f9eaf04a521be5a6322ae6e8b4d0430fc78139b79cb.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\4e702J.exeexecutable
MD5:9D1AA74DAFD0FEEE66682C1D23C0C038
SHA256:646A778B6A1BE550A37A9A2AC948E5DB5CD4A9FF4A2E4956040513EFEFE2D349
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
346
TCP/UDP connections
168
DNS requests
164
Threats
76

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6944
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
3396
RUXIMICS.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
6944
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
3396
RUXIMICS.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
5196
2l7025.exe
GET
200
185.215.113.206:80
http://185.215.113.206/
unknown
malicious
5196
2l7025.exe
GET
200
185.215.113.16:80
http://185.215.113.16/steam/random.exe
unknown
malicious
4080
3C12L.exe
POST
200
185.215.113.206:80
http://185.215.113.206/6c4adf523b719729.php
unknown
malicious
4080
3C12L.exe
GET
200
185.215.113.206:80
http://185.215.113.206/
unknown
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
6944
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3396
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5488
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
92.123.104.38:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
whitelisted
6944
svchost.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5488
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3396
RUXIMICS.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6944
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
www.bing.com
  • 92.123.104.38
  • 92.123.104.32
  • 92.123.104.34
whitelisted
google.com
  • 172.217.16.206
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
presticitpo.store
unknown
crisiwarny.store
malicious
fadehairucw.store
unknown
thumbystriw.store
malicious
necklacedmny.store
malicious

Threats

PID
Process
Class
Message
2172
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)
2172
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)
2172
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)
2172
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)
2172
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)
2172
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)
5196
2l7025.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)
A Network Trojan was detected
ET MALWARE Lumma Stealer Related Activity
A Network Trojan was detected
ET MALWARE Lumma Stealer CnC Host Checkin
A Network Trojan was detected
ET MALWARE Lumma Stealer Related Activity M2
6 ETPRO signatures available at the full report
Process
Message
2l7025.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
2l7025.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
3C12L.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
4e702J.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
skotes.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
a792b66409.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
113bf88fca.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
577ea44605.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
skotes.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
a792b66409.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------