File name:

random.exe

Full analysis: https://app.any.run/tasks/14ab12a2-a3cf-4a7f-8024-7d1322b7a72b
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: May 20, 2025, 01:37:41
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
auto-sch
amadey
botnet
stealer
telegram
lumma
vidar
auto-reg
gcleaner
rdp
github
rat
dcrat
remote
darkcrystal
auto
generic
screenconnect
themida
evasion
miner
arch-exec
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

572C2EF520F73C55A1A75CBF57D466C1

SHA1:

DAA81B7B9E86EE8CB5BF8790B6B4683A40914655

SHA256:

E04FD3D23B9BFC7E468BE3E70D244C763777B7CDB9C8523B76E0C66BFBCA7186

SSDEEP:

49152:kPPkzemqoSut3Jh4+QQ/btosJwIA4hHmZlKH2Tw/Pq83zw0bCjvk9G661QGtBEXo:OP/mp7t3T4+B/btosJwIA4hHmZlKH2TE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 6036)
      • cmd.exe (PID: 5344)
    • Run PowerShell with an invisible window

      • powershell.exe (PID: 7224)
      • powershell.exe (PID: 7816)
      • powershell.exe (PID: 7628)
      • powershell.exe (PID: 7696)
    • Script downloads file (POWERSHELL)

      • powershell.exe (PID: 7224)
      • powershell.exe (PID: 7816)
    • AMADEY mutex has been found

      • TempJTJ33BDQIHTUAIBYKMYHZB9HVRCUNGQV.EXE (PID: 7772)
      • ramez.exe (PID: 8140)
      • ramez.exe (PID: 7976)
      • TempJTJ33BDQIHTUAIBYKMYHZB9HVRCUNGQV.EXE (PID: 2140)
    • Request from PowerShell that ran from MSHTA.EXE

      • powershell.exe (PID: 7224)
      • powershell.exe (PID: 7816)
      • powershell.exe (PID: 7628)
    • AMADEY has been detected (SURICATA)

      • ramez.exe (PID: 7976)
    • Connects to the CnC server

      • ramez.exe (PID: 7976)
      • svchost.exe (PID: 2196)
      • dwm.exe (PID: 3760)
      • dwm.exe (PID: 8448)
      • cmd.exe (PID: 8608)
      • explorer.exe (PID: 5492)
    • Executing a file with an untrusted certificate

      • 07c099764d.exe (PID: 7236)
      • 8RypWDs.exe (PID: 9604)
      • 8RypWDs.exe (PID: 8628)
      • XEIxGFE.exe (PID: 8812)
      • cSyRrCk.exe (PID: 9856)
      • HRnxr8j.exe (PID: 5728)
    • AMADEY has been detected (YARA)

      • ramez.exe (PID: 7976)
    • VIDAR mutex has been found

      • MSBuild.exe (PID: 6644)
    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)
      • 22993beae5.exe (PID: 5256)
      • 22993beae5.exe (PID: 4212)
      • MSBuild.exe (PID: 8592)
    • Actions looks like stealing of personal data

      • MSBuild.exe (PID: 6644)
      • 22993beae5.exe (PID: 5256)
    • Changes the autorun value in the registry

      • ramez.exe (PID: 7976)
    • Steals credentials from Web Browsers

      • MSBuild.exe (PID: 6644)
    • VIDAR has been detected (YARA)

      • MSBuild.exe (PID: 6644)
    • LUMMA mutex has been found

      • 22993beae5.exe (PID: 5256)
    • GCLEANER has been detected (SURICATA)

      • cvtres.exe (PID: 4920)
    • Adds path to the Windows Defender exclusion list

      • cmd.exe (PID: 6324)
      • cmd.exe (PID: 5800)
      • NSudoLG.exe (PID: 7996)
      • NSudoLG.exe (PID: 7900)
    • Changes Windows Defender settings

      • NSudoLG.exe (PID: 7900)
      • NSudoLG.exe (PID: 7996)
      • WinTemp-v4.exe (PID: 9180)
    • LUMMA has been detected (YARA)

      • 22993beae5.exe (PID: 5256)
    • Known privilege escalation attack

      • dllhost.exe (PID: 9412)
      • dllhost.exe (PID: 744)
    • DARKCRYSTAL has been detected (SURICATA)

      • dwm.exe (PID: 3760)
      • dwm.exe (PID: 8448)
    • GENERIC has been found (auto)

      • cvtres.exe (PID: 4920)
    • Adds process to the Windows Defender exclusion list

      • WinTemp-v4.exe (PID: 9180)
    • Starts SC.EXE for service management

      • cmd.exe (PID: 6324)
      • cmd.exe (PID: 5800)
    • SCREENCONNECT has been detected (SURICATA)

      • ScreenConnect.ClientService.exe (PID: 8668)
    • MINER has been detected (SURICATA)

      • cmd.exe (PID: 8608)
    • Starts REAGENTC.EXE to disable the Windows Recovery Environment

      • ReAgentc.exe (PID: 7736)
  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • random.exe (PID: 2320)
      • cmd.exe (PID: 7428)
      • 649f5ebdb0.exe (PID: 7632)
      • nircmd.exe (PID: 7964)
      • cmd.exe (PID: 7876)
      • f855b79cb5.exe (PID: 7224)
      • cmd.exe (PID: 7916)
      • 649f5ebdb0.exe (PID: 5216)
      • nircmd.exe (PID: 2908)
      • cmd.exe (PID: 7732)
      • NSudoLG.exe (PID: 6192)
      • cmd.exe (PID: 5544)
      • NSudoLG.exe (PID: 7792)
      • cmd.exe (PID: 3024)
      • cmd.exe (PID: 5800)
      • cmd.exe (PID: 6324)
      • Unlocker.exe (PID: 8072)
      • Unlocker.exe (PID: 920)
      • 8RypWDs.exe (PID: 9604)
      • Unlocker.exe (PID: 9292)
      • Unlocker.exe (PID: 8976)
      • Unlocker.exe (PID: 7600)
      • wscript.exe (PID: 744)
      • Unlocker.exe (PID: 2664)
      • Comreviewdriver.exe (PID: 4284)
      • Unlocker.exe (PID: 8680)
      • Unlocker.exe (PID: 8892)
      • Unlocker.exe (PID: 9020)
      • Unlocker.exe (PID: 9036)
      • WinTemp-v4.exe (PID: 9180)
    • Probably download files using WebClient

      • mshta.exe (PID: 3332)
      • mshta.exe (PID: 7708)
      • mshta.exe (PID: 6372)
      • mshta.exe (PID: 7084)
    • Found IP address in command line

      • powershell.exe (PID: 7224)
      • powershell.exe (PID: 7816)
      • powershell.exe (PID: 7628)
      • powershell.exe (PID: 7696)
    • Starts process via Powershell

      • powershell.exe (PID: 7224)
      • powershell.exe (PID: 7816)
      • powershell.exe (PID: 7628)
      • powershell.exe (PID: 7696)
    • Manipulates environment variables

      • powershell.exe (PID: 7224)
      • powershell.exe (PID: 7816)
      • powershell.exe (PID: 7628)
      • powershell.exe (PID: 7696)
    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 3332)
      • mshta.exe (PID: 7708)
      • mshta.exe (PID: 6372)
      • MSBuild.exe (PID: 6644)
      • mshta.exe (PID: 7084)
      • NSudoLG.exe (PID: 7900)
      • NSudoLG.exe (PID: 7996)
      • WinTemp-v4.exe (PID: 9180)
    • Executable content was dropped or overwritten

      • powershell.exe (PID: 7224)
      • TempJTJ33BDQIHTUAIBYKMYHZB9HVRCUNGQV.EXE (PID: 7772)
      • ramez.exe (PID: 7976)
      • 97a61b4446.exe (PID: 744)
      • 97a61b4446.tmp (PID: 1764)
      • 649f5ebdb0.exe (PID: 7632)
      • csc.exe (PID: 3140)
      • powershell.exe (PID: 7628)
      • csc.exe (PID: 9392)
      • csc.exe (PID: 9536)
      • csc.exe (PID: 10008)
      • csc.exe (PID: 9996)
      • csc.exe (PID: 10088)
      • 22993beae5.exe (PID: 5256)
      • csc.exe (PID: 9292)
      • csc.exe (PID: 10184)
      • csc.exe (PID: 9508)
      • csc.exe (PID: 7956)
      • csc.exe (PID: 9628)
      • csc.exe (PID: 9692)
      • csc.exe (PID: 7912)
      • csc.exe (PID: 6080)
      • csc.exe (PID: 10012)
      • L7m5WH3.exe (PID: 7220)
      • 7z.exe (PID: 9536)
      • 22993beae5.exe (PID: 4212)
      • 8RypWDs.exe (PID: 9604)
      • Comreviewdriver.exe (PID: 4284)
      • csc.exe (PID: 9996)
      • csc.exe (PID: 9092)
      • csc.exe (PID: 9640)
      • csc.exe (PID: 7156)
      • dwm.exe (PID: 3760)
      • Unlocker.exe (PID: 8680)
      • dfsvc.exe (PID: 7272)
      • dwm.exe (PID: 8448)
      • cvtres.exe (PID: 4920)
      • oxDU0MW.exe (PID: 8244)
      • cmd.exe (PID: 6324)
      • WinTemp-v4.exe (PID: 9180)
      • explorer.exe (PID: 5492)
    • Potential Corporate Privacy Violation

      • powershell.exe (PID: 7224)
      • powershell.exe (PID: 7816)
      • ramez.exe (PID: 7976)
      • powershell.exe (PID: 7628)
      • 22993beae5.exe (PID: 5256)
      • 22993beae5.exe (PID: 4212)
      • cvtres.exe (PID: 4920)
      • ScreenConnect.ClientService.exe (PID: 8668)
      • cmd.exe (PID: 8608)
    • Connects to the server without a host name

      • powershell.exe (PID: 7224)
      • powershell.exe (PID: 7816)
      • ramez.exe (PID: 7976)
      • cvtres.exe (PID: 4920)
      • powershell.exe (PID: 7628)
      • powershell.exe (PID: 7696)
      • 22993beae5.exe (PID: 5256)
      • 22993beae5.exe (PID: 4212)
      • MSBuild.exe (PID: 9072)
      • dwm.exe (PID: 3760)
      • dwm.exe (PID: 8448)
    • Process requests binary or script from the Internet

      • powershell.exe (PID: 7224)
      • powershell.exe (PID: 7816)
      • ramez.exe (PID: 7976)
      • powershell.exe (PID: 7628)
      • powershell.exe (PID: 7696)
      • 22993beae5.exe (PID: 5256)
      • 22993beae5.exe (PID: 4212)
    • Reads security settings of Internet Explorer

      • TempJTJ33BDQIHTUAIBYKMYHZB9HVRCUNGQV.EXE (PID: 7772)
      • ramez.exe (PID: 7976)
      • 97a61b4446.tmp (PID: 1764)
      • MSBuild.exe (PID: 6644)
      • cvtres.exe (PID: 4920)
      • 649f5ebdb0.exe (PID: 7632)
      • nircmd.exe (PID: 7964)
    • Starts itself from another location

      • TempJTJ33BDQIHTUAIBYKMYHZB9HVRCUNGQV.EXE (PID: 7772)
    • The process executes via Task Scheduler

      • ramez.exe (PID: 8140)
      • ramez.exe (PID: 6248)
    • Contacting a server suspected of hosting an CnC

      • ramez.exe (PID: 7976)
      • svchost.exe (PID: 2196)
      • 22993beae5.exe (PID: 5256)
      • 22993beae5.exe (PID: 4212)
      • MSBuild.exe (PID: 8592)
      • explorer.exe (PID: 5492)
    • There is functionality for enable RDP (YARA)

      • ramez.exe (PID: 7976)
    • Reads the Windows owner or organization settings

      • 97a61b4446.tmp (PID: 1764)
    • There is functionality for taking screenshot (YARA)

      • ramez.exe (PID: 7976)
      • MSBuild.exe (PID: 6644)
    • Reads the BIOS version

      • 22993beae5.exe (PID: 5256)
      • 22993beae5.exe (PID: 4212)
    • Executes application which crashes

      • core.exe (PID: 5800)
      • Unlocker.exe (PID: 920)
      • Unlocker.exe (PID: 8976)
      • Unlocker.exe (PID: 2664)
      • Win-v42.exe (PID: 5232)
    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • MSBuild.exe (PID: 6644)
      • MSBuild.exe (PID: 7188)
      • MSBuild.exe (PID: 7680)
    • Searches for installed software

      • MSBuild.exe (PID: 6644)
    • Drops 7-zip archiver for unpacking

      • 649f5ebdb0.exe (PID: 7632)
    • The process creates files with name similar to system file names

      • 649f5ebdb0.exe (PID: 7632)
    • Executing commands from a ".bat" file

      • 649f5ebdb0.exe (PID: 7632)
      • cmd.exe (PID: 7428)
      • nircmd.exe (PID: 7964)
      • cmd.exe (PID: 7876)
      • 649f5ebdb0.exe (PID: 5216)
      • cmd.exe (PID: 7916)
      • nircmd.exe (PID: 2908)
      • cmd.exe (PID: 7732)
      • NSudoLG.exe (PID: 6192)
      • NSudoLG.exe (PID: 7792)
      • cmd.exe (PID: 5544)
      • cmd.exe (PID: 3024)
      • wscript.exe (PID: 744)
      • Comreviewdriver.exe (PID: 4284)
    • Application launched itself

      • cmd.exe (PID: 7428)
      • cmd.exe (PID: 7876)
      • cmd.exe (PID: 7916)
      • cmd.exe (PID: 7732)
      • cmd.exe (PID: 5544)
      • cmd.exe (PID: 3024)
      • cmd.exe (PID: 5800)
      • cmd.exe (PID: 6324)
      • 8RypWDs.exe (PID: 9604)
    • The process hide an interactive prompt from the user

      • MSBuild.exe (PID: 6644)
    • The process bypasses the loading of PowerShell profile settings

      • MSBuild.exe (PID: 6644)
    • The executable file from the user directory is run by the CMD process

      • nircmd.exe (PID: 7964)
      • nircmd.exe (PID: 2908)
      • NSudoLG.exe (PID: 7792)
      • NSudoLG.exe (PID: 6192)
      • NSudoLG.exe (PID: 7996)
      • NSudoLG.exe (PID: 7900)
      • 7z.exe (PID: 9536)
      • 7z.exe (PID: 6044)
      • Unlocker.exe (PID: 9292)
      • Unlocker.exe (PID: 8072)
      • Unlocker.exe (PID: 920)
      • Unlocker.exe (PID: 8976)
      • Unlocker.exe (PID: 7600)
      • Comreviewdriver.exe (PID: 4284)
      • Unlocker.exe (PID: 2664)
      • Unlocker.exe (PID: 8680)
      • Unlocker.exe (PID: 8892)
      • Unlocker.exe (PID: 9020)
      • Unlocker.exe (PID: 9036)
    • Reads the date of Windows installation

      • nircmd.exe (PID: 7964)
    • Starts application with an unusual extension

      • cmd.exe (PID: 7800)
      • cmd.exe (PID: 6488)
      • cmd.exe (PID: 7964)
      • cmd.exe (PID: 5344)
      • cmd.exe (PID: 5800)
      • cmd.exe (PID: 6324)
      • cmd.exe (PID: 8308)
    • Base64-obfuscated command line is found

      • MSBuild.exe (PID: 6644)
    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 7912)
    • Multiple wallet extension IDs have been found

      • MSBuild.exe (PID: 6644)
    • BASE64 encoded PowerShell command has been detected

      • MSBuild.exe (PID: 6644)
    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 3140)
      • csc.exe (PID: 9536)
      • csc.exe (PID: 9392)
      • csc.exe (PID: 9628)
      • csc.exe (PID: 9692)
      • csc.exe (PID: 10008)
      • csc.exe (PID: 10184)
      • csc.exe (PID: 10088)
      • csc.exe (PID: 9292)
      • csc.exe (PID: 9508)
      • csc.exe (PID: 7956)
      • csc.exe (PID: 6080)
      • csc.exe (PID: 9996)
      • csc.exe (PID: 10012)
      • csc.exe (PID: 7912)
    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 6488)
      • cmd.exe (PID: 5800)
      • cmd.exe (PID: 5344)
      • cmd.exe (PID: 6324)
    • Get information on the list of running processes

      • cmd.exe (PID: 7296)
      • cmd.exe (PID: 5800)
      • cmd.exe (PID: 6324)
      • cmd.exe (PID: 7752)
    • PowerShell delay command usage (probably sleep evasion)

      • powershell.exe (PID: 8056)
      • powershell.exe (PID: 7708)
    • Script adds exclusion path to Windows Defender

      • NSudoLG.exe (PID: 7900)
      • NSudoLG.exe (PID: 7996)
      • WinTemp-v4.exe (PID: 9180)
    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 6324)
      • cmd.exe (PID: 5800)
    • Windows service management via SC.EXE

      • sc.exe (PID: 1568)
      • sc.exe (PID: 7956)
      • sc.exe (PID: 9628)
      • sc.exe (PID: 1116)
      • sc.exe (PID: 6960)
      • sc.exe (PID: 6724)
      • sc.exe (PID: 8312)
      • sc.exe (PID: 1128)
      • sc.exe (PID: 2908)
      • sc.exe (PID: 6228)
      • sc.exe (PID: 8916)
      • sc.exe (PID: 8076)
      • sc.exe (PID: 7940)
      • sc.exe (PID: 7268)
      • sc.exe (PID: 7844)
      • sc.exe (PID: 9460)
      • sc.exe (PID: 1660)
      • sc.exe (PID: 2616)
      • sc.exe (PID: 9788)
      • sc.exe (PID: 7544)
      • sc.exe (PID: 7416)
      • sc.exe (PID: 8524)
      • sc.exe (PID: 1128)
      • sc.exe (PID: 5736)
      • sc.exe (PID: 2580)
      • sc.exe (PID: 2144)
      • sc.exe (PID: 672)
      • sc.exe (PID: 7224)
      • sc.exe (PID: 8956)
      • sc.exe (PID: 10036)
      • sc.exe (PID: 8884)
      • sc.exe (PID: 7888)
      • sc.exe (PID: 3848)
      • sc.exe (PID: 5892)
      • sc.exe (PID: 10152)
      • sc.exe (PID: 6184)
      • sc.exe (PID: 7904)
      • sc.exe (PID: 1580)
      • sc.exe (PID: 6640)
      • sc.exe (PID: 10164)
      • sc.exe (PID: 1132)
      • sc.exe (PID: 8836)
      • sc.exe (PID: 6388)
      • sc.exe (PID: 9804)
      • sc.exe (PID: 8916)
      • sc.exe (PID: 9916)
      • sc.exe (PID: 5176)
      • sc.exe (PID: 10132)
      • sc.exe (PID: 8016)
      • sc.exe (PID: 9628)
      • sc.exe (PID: 5740)
      • sc.exe (PID: 8624)
      • sc.exe (PID: 9972)
      • sc.exe (PID: 6148)
      • sc.exe (PID: 9884)
      • sc.exe (PID: 7280)
      • sc.exe (PID: 3192)
      • sc.exe (PID: 1276)
      • sc.exe (PID: 9576)
      • sc.exe (PID: 1616)
      • sc.exe (PID: 4212)
      • sc.exe (PID: 7220)
      • sc.exe (PID: 7208)
      • sc.exe (PID: 7204)
      • sc.exe (PID: 8984)
      • sc.exe (PID: 7000)
      • sc.exe (PID: 7316)
      • sc.exe (PID: 8372)
      • sc.exe (PID: 7780)
      • sc.exe (PID: 5344)
      • sc.exe (PID: 7696)
      • sc.exe (PID: 900)
      • sc.exe (PID: 4284)
      • sc.exe (PID: 7840)
      • sc.exe (PID: 8724)
      • sc.exe (PID: 7844)
      • sc.exe (PID: 5260)
      • sc.exe (PID: 9080)
      • sc.exe (PID: 2444)
      • sc.exe (PID: 7860)
      • sc.exe (PID: 8508)
      • sc.exe (PID: 4200)
      • sc.exe (PID: 640)
      • sc.exe (PID: 7732)
      • sc.exe (PID: 8148)
      • sc.exe (PID: 8636)
    • Starts SC.EXE for service management

      • cmd.exe (PID: 9072)
      • cmd.exe (PID: 9064)
      • cmd.exe (PID: 6324)
      • cmd.exe (PID: 6576)
      • cmd.exe (PID: 9972)
      • cmd.exe (PID: 5800)
      • cmd.exe (PID: 7524)
      • cmd.exe (PID: 10196)
      • cmd.exe (PID: 8452)
      • cmd.exe (PID: 9020)
      • cmd.exe (PID: 8652)
      • cmd.exe (PID: 1272)
      • cmd.exe (PID: 9412)
      • cmd.exe (PID: 5868)
    • Uses WMIC.EXE to obtain BIOS management information

      • cmd.exe (PID: 8616)
    • Uses WMIC.EXE to obtain physical disk drive information

      • cmd.exe (PID: 8532)
    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 6644)
      • cmd.exe (PID: 9140)
      • cmd.exe (PID: 9980)
      • cmd.exe (PID: 10192)
      • cmd.exe (PID: 3016)
      • cmd.exe (PID: 8300)
      • cmd.exe (PID: 5188)
    • Uses WMIC.EXE to obtain CPU information

      • cmd.exe (PID: 4220)
    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 6324)
      • cmd.exe (PID: 5800)
    • Executed via WMI

      • schtasks.exe (PID: 9016)
      • schtasks.exe (PID: 10108)
      • schtasks.exe (PID: 8756)
      • schtasks.exe (PID: 5408)
      • schtasks.exe (PID: 10204)
      • schtasks.exe (PID: 7644)
      • schtasks.exe (PID: 7584)
      • schtasks.exe (PID: 6828)
      • schtasks.exe (PID: 7560)
      • schtasks.exe (PID: 9344)
      • schtasks.exe (PID: 5020)
      • schtasks.exe (PID: 3176)
      • schtasks.exe (PID: 4428)
      • schtasks.exe (PID: 2616)
      • schtasks.exe (PID: 6032)
      • schtasks.exe (PID: 4212)
      • schtasks.exe (PID: 7264)
      • schtasks.exe (PID: 5600)
    • Likely accesses (executes) a file from the Public directory

      • schtasks.exe (PID: 9016)
      • schtasks.exe (PID: 8756)
      • schtasks.exe (PID: 10108)
      • schtasks.exe (PID: 5408)
      • schtasks.exe (PID: 10204)
      • schtasks.exe (PID: 7584)
      • schtasks.exe (PID: 2616)
      • schtasks.exe (PID: 6032)
      • schtasks.exe (PID: 4428)
      • dwm.exe (PID: 3760)
      • dllhost.exe (PID: 7620)
      • cvtres.exe (PID: 2064)
      • dwm.exe (PID: 8448)
    • Process drops legitimate windows executable

      • Comreviewdriver.exe (PID: 4284)
      • cmd.exe (PID: 6324)
      • ramez.exe (PID: 7976)
      • explorer.exe (PID: 5492)
    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 8308)
    • Drops a system driver (possible attempt to evade defenses)

      • Unlocker.exe (PID: 8680)
    • Stops a currently running service

      • sc.exe (PID: 8312)
      • sc.exe (PID: 9620)
      • sc.exe (PID: 4112)
      • sc.exe (PID: 9384)
      • sc.exe (PID: 8620)
      • sc.exe (PID: 10124)
      • sc.exe (PID: 3364)
      • sc.exe (PID: 2488)
      • sc.exe (PID: 9608)
      • sc.exe (PID: 8264)
      • sc.exe (PID: 2772)
      • sc.exe (PID: 9896)
      • sc.exe (PID: 8076)
      • sc.exe (PID: 4528)
      • sc.exe (PID: 2400)
      • sc.exe (PID: 7504)
      • sc.exe (PID: 140)
      • sc.exe (PID: 856)
      • sc.exe (PID: 1600)
      • sc.exe (PID: 8060)
      • sc.exe (PID: 10024)
      • sc.exe (PID: 7104)
      • sc.exe (PID: 9992)
      • sc.exe (PID: 5124)
      • sc.exe (PID: 8460)
      • sc.exe (PID: 6620)
      • sc.exe (PID: 8572)
      • sc.exe (PID: 9692)
      • sc.exe (PID: 7500)
      • sc.exe (PID: 8064)
      • sc.exe (PID: 8340)
      • sc.exe (PID: 8428)
      • sc.exe (PID: 2420)
      • sc.exe (PID: 10040)
    • Script adds exclusion process to Windows Defender

      • WinTemp-v4.exe (PID: 9180)
    • Executes as Windows Service

      • ScreenConnect.ClientService.exe (PID: 8668)
    • Connects to unusual port

      • ScreenConnect.ClientService.exe (PID: 8668)
      • WinTemp-v4.exe (PID: 9180)
      • cmd.exe (PID: 8608)
    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 456)
      • schtasks.exe (PID: 3620)
      • schtasks.exe (PID: 8788)
      • schtasks.exe (PID: 1012)
      • schtasks.exe (PID: 6248)
      • schtasks.exe (PID: 7644)
      • schtasks.exe (PID: 1544)
      • schtasks.exe (PID: 2632)
      • schtasks.exe (PID: 3804)
      • schtasks.exe (PID: 9428)
    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 2088)
      • cmd.exe (PID: 3176)
    • Takes ownership (TAKEOWN.EXE)

      • cmd.exe (PID: 3956)
    • Starts a Microsoft application from unusual location

      • HRnxr8j.exe (PID: 5728)
    • Checks for external IP

      • WinTemp-v4.exe (PID: 9180)
      • svchost.exe (PID: 2196)
    • Uses powercfg.exe to modify the power settings

      • WinTemp-v4.exe (PID: 9180)
    • Hides command output

      • cmd.exe (PID: 976)
  • INFO

    • Auto-launch of the file from Task Scheduler

      • cmd.exe (PID: 6036)
      • cmd.exe (PID: 5344)
    • Reads the computer name

      • random.exe (PID: 2320)
      • TempJTJ33BDQIHTUAIBYKMYHZB9HVRCUNGQV.EXE (PID: 7772)
      • ramez.exe (PID: 7976)
      • 97a61b4446.tmp (PID: 1764)
      • 07c099764d.exe (PID: 7236)
      • MSBuild.exe (PID: 6644)
      • 22993beae5.exe (PID: 5256)
      • cvtres.exe (PID: 4920)
      • 649f5ebdb0.exe (PID: 7632)
      • nircmd.exe (PID: 7964)
      • f855b79cb5.exe (PID: 7224)
      • 649f5ebdb0.exe (PID: 5216)
    • Reads mouse settings

      • random.exe (PID: 2320)
      • f855b79cb5.exe (PID: 7224)
    • Create files in a temporary directory

      • random.exe (PID: 2320)
      • TempJTJ33BDQIHTUAIBYKMYHZB9HVRCUNGQV.EXE (PID: 7772)
      • ramez.exe (PID: 7976)
      • 97a61b4446.exe (PID: 744)
      • 97a61b4446.tmp (PID: 1764)
      • 649f5ebdb0.exe (PID: 7632)
      • powershell.exe (PID: 7912)
      • MSBuild.exe (PID: 6644)
      • f855b79cb5.exe (PID: 7224)
      • 649f5ebdb0.exe (PID: 5216)
    • The sample compiled with english language support

      • random.exe (PID: 2320)
      • ramez.exe (PID: 7976)
      • 649f5ebdb0.exe (PID: 7632)
      • 8RypWDs.exe (PID: 9604)
      • Comreviewdriver.exe (PID: 4284)
      • Unlocker.exe (PID: 8680)
      • cmd.exe (PID: 6324)
      • explorer.exe (PID: 5492)
    • Checks supported languages

      • random.exe (PID: 2320)
      • TempJTJ33BDQIHTUAIBYKMYHZB9HVRCUNGQV.EXE (PID: 7772)
      • ramez.exe (PID: 7976)
      • ramez.exe (PID: 8140)
      • 07c099764d.exe (PID: 7236)
      • 97a61b4446.exe (PID: 744)
      • TempJTJ33BDQIHTUAIBYKMYHZB9HVRCUNGQV.EXE (PID: 2140)
      • info.exe (PID: 5124)
      • core.exe (PID: 5800)
      • 22993beae5.exe (PID: 5256)
      • 97a61b4446.tmp (PID: 1764)
      • MSBuild.exe (PID: 6644)
      • cvtres.exe (PID: 4920)
      • 649f5ebdb0.exe (PID: 7632)
      • nircmd.exe (PID: 7964)
      • chcp.com (PID: 7724)
      • f855b79cb5.exe (PID: 7224)
      • 22993beae5.exe (PID: 4212)
      • 649f5ebdb0.exe (PID: 5216)
    • Reads Internet Explorer settings

      • mshta.exe (PID: 3332)
      • mshta.exe (PID: 7708)
      • mshta.exe (PID: 6372)
    • Disables trace logs

      • powershell.exe (PID: 7224)
      • powershell.exe (PID: 7816)
    • Checks proxy server information

      • powershell.exe (PID: 7224)
      • powershell.exe (PID: 7816)
      • ramez.exe (PID: 7976)
      • MSBuild.exe (PID: 6644)
      • cvtres.exe (PID: 4920)
    • Manual execution by a user

      • mshta.exe (PID: 7708)
      • cvtres.exe (PID: 4920)
      • 22993beae5.exe (PID: 4212)
      • 649f5ebdb0.exe (PID: 5216)
      • mshta.exe (PID: 7084)
      • Comreviewdriver.exe (PID: 7508)
      • fPbjy1Q.exe (PID: 8420)
      • fontdrvhost.exe (PID: 8500)
      • dwm.exe (PID: 3760)
      • dllhost.exe (PID: 7620)
      • cvtres.exe (PID: 2064)
      • Win-v42.exe (PID: 5232)
    • The executable file from the user directory is run by the Powershell process

      • TempJTJ33BDQIHTUAIBYKMYHZB9HVRCUNGQV.EXE (PID: 7772)
      • TempJTJ33BDQIHTUAIBYKMYHZB9HVRCUNGQV.EXE (PID: 2140)
      • Temp02TNIN0ANV4TH9XT9HCW0CMUBVHFW7KB.EXE (PID: 6816)
      • Temp02TNIN0ANV4TH9XT9HCW0CMUBVHFW7KB.EXE (PID: 8788)
    • Process checks computer location settings

      • TempJTJ33BDQIHTUAIBYKMYHZB9HVRCUNGQV.EXE (PID: 7772)
      • ramez.exe (PID: 7976)
      • 97a61b4446.tmp (PID: 1764)
      • 649f5ebdb0.exe (PID: 7632)
      • nircmd.exe (PID: 7964)
    • Creates files or folders in the user directory

      • ramez.exe (PID: 7976)
      • 97a61b4446.tmp (PID: 1764)
      • MSBuild.exe (PID: 6644)
      • WerFault.exe (PID: 1240)
      • cvtres.exe (PID: 4920)
    • Creates a software uninstall entry

      • 97a61b4446.tmp (PID: 1764)
    • Reads the machine GUID from the registry

      • 07c099764d.exe (PID: 7236)
      • 22993beae5.exe (PID: 5256)
      • cvtres.exe (PID: 4920)
      • MSBuild.exe (PID: 6644)
    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 5492)
      • powershell.exe (PID: 7912)
    • Creates files in the program directory

      • MSBuild.exe (PID: 6644)
      • svchost.exe (PID: 6676)
    • Reads the software policy settings

      • MSBuild.exe (PID: 6644)
      • cvtres.exe (PID: 4920)
      • 22993beae5.exe (PID: 5256)
      • powershell.exe (PID: 7912)
    • Auto-launch of the file from Registry key

      • ramez.exe (PID: 7976)
    • Reads product name

      • MSBuild.exe (PID: 6644)
    • Reads CPU info

      • MSBuild.exe (PID: 6644)
    • Reads Environment values

      • MSBuild.exe (PID: 6644)
    • Changes the display of characters in the console

      • cmd.exe (PID: 7800)
      • cmd.exe (PID: 6488)
      • cmd.exe (PID: 7964)
      • cmd.exe (PID: 5344)
      • cmd.exe (PID: 5800)
      • cmd.exe (PID: 6324)
      • cmd.exe (PID: 8308)
    • NirSoft software is detected

      • nircmd.exe (PID: 7964)
      • nircmd.exe (PID: 2908)
    • Application launched itself

      • chrome.exe (PID: 7712)
      • chrome.exe (PID: 7228)
      • chrome.exe (PID: 8900)
      • chrome.exe (PID: 8212)
      • chrome.exe (PID: 8364)
      • chrome.exe (PID: 8544)
      • chrome.exe (PID: 8700)
      • chrome.exe (PID: 9204)
      • chrome.exe (PID: 7300)
      • chrome.exe (PID: 8504)
      • chrome.exe (PID: 8196)
      • chrome.exe (PID: 8740)
      • chrome.exe (PID: 8792)
      • chrome.exe (PID: 8444)
      • chrome.exe (PID: 8112)
    • Starts MODE.COM to configure console settings

      • mode.com (PID: 6516)
      • mode.com (PID: 6824)
    • Checks operating system version

      • cmd.exe (PID: 5800)
      • cmd.exe (PID: 6324)
    • Attempting to use instant messaging service

      • MSBuild.exe (PID: 7188)
      • MSBuild.exe (PID: 7680)
    • Themida protector has been detected

      • 22993beae5.exe (PID: 5256)
    • Uses Task Scheduler to autorun other applications (AUTOMATE)

      • WinTemp-v4.exe (PID: 9180)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(7976) ramez.exe
C2185.156.72.96
URLhttp://185.156.72.96/te4h2nus/index.php
Version5.34
Options
Drop directoryd610cf342e
Drop nameramez.exe
Strings (125)lv:
msi
Kaspersky Lab
av:
|
#
"
\App
00000422
dm:
Powershell.exe
ProgramData\
ps1
rundll32
http://
Content-Disposition: form-data; name="data"; filename="
SOFTWARE\Microsoft\Windows NT\CurrentVersion
dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
id:
VideoID
cred.dll|clip.dll|
0000043f
cmd
00000423
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
-executionpolicy remotesigned -File "
2022
------
2016
og:
\0000
CurrentBuild
2019
:::
S-%lu-
" && timeout 1 && del
ProductName
Panda Security
ESET
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
/k
+++
?scr=1
Doctor Web
GET
SYSTEM\ControlSet001\Services\BasicDisplay\Video
/quiet
.jpg
d610cf342e
vs:
sd:
rundll32.exe
"taskkill /f /im "
pc:
random
=
360TotalSecurity
<d>
wb
Content-Type: multipart/form-data; boundary=----
Startup
Norton
&& Exit"
os:
https://
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
2025
Avira
%-lu
zip
POST
" Content-Type: application/octet-stream
Rem
/te4h2nus/index.php
------
5.34
<c>
clip.dll
AVAST Software
\
shell32.dll
" && ren
e3
ramez.exe
kernel32.dll
DefaultSettings.XResolution
d1
DefaultSettings.YResolution
185.156.72.96
r=
cred.dll
--
GetNativeSystemInfo
-%lu
ComputerName
&unit=
Keyboard Layout\Preload
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
ar:
Sophos
%USERPROFILE%
exe
e1
e2
st=s
Programs
0123456789
un:
rb
bi:
abcdefghijklmnopqrstuvwxyz0123456789-_
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
cmd /C RMDIR /s/q
Bitdefender
-unicode-
AVG
WinDefender
&&
shutdown -s -t 0
Comodo
00000419
Content-Type: application/x-www-form-urlencoded
/Plugins/
Main

Vidar

(PID) Process(6644) MSBuild.exe
C2https://t.me/eom25h
URLhttps://steamcommunity.com/profiles/76561199855598339
RC43333333333333333UUUUUUUUUUUUUUUU
Strings (1)

Lumma

(PID) Process(5256) 22993beae5.exe
C2 (10)btcgeared.live/lbak
clarmodq.top/qoxo
buzzarddf.live/ktnt
techguidet.digital/apdo
timertvey.top/ldak
bearjk.live/benj
parakehjet.run/kewk
zenithcorde.top/auid
techsyncq.run/riid
fishgh.digital/tequ
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:20 01:03:48+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 633856
InitializedDataSize: 326144
UninitializedDataSize: -
EntryPoint: 0x20577
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
807
Monitored processes
665
Malicious processes
49
Suspicious processes
22

Behavior graph

Click at the process to see the details
start random.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs schtasks.exe no specs powershell.exe conhost.exe no specs sppextcomobj.exe no specs slui.exe mshta.exe no specs tempjtj33bdqihtuaibykmyhzb9hvrcungqv.exe powershell.exe conhost.exe no specs #AMADEY ramez.exe ramez.exe no specs tempjtj33bdqihtuaibykmyhzb9hvrcungqv.exe no specs 07c099764d.exe no specs 97a61b4446.exe 97a61b4446.tmp info.exe conhost.exe no specs core.exe #VIDAR msbuild.exe #LUMMA 22993beae5.exe #GCLEANER cvtres.exe svchost.exe no specs werfault.exe no specs #LUMMA svchost.exe svchost.exe no specs 649f5ebdb0.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs chrome.exe reg.exe no specs powershell.exe no specs conhost.exe no specs nircmd.exe no specs cmd.exe conhost.exe no specs chrome.exe no specs #LUMMA 22993beae5.exe cmd.exe no specs conhost.exe no specs f855b79cb5.exe no specs cmd.exe no specs mshta.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs 649f5ebdb0.exe no specs powershell.exe conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs chrome.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs csc.exe chcp.com no specs reg.exe no specs nircmd.exe no specs cvtres.exe no specs reg.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs nsudolg.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs nsudolg.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe conhost.exe no specs chcp.com no specs reg.exe no specs cmd.exe conhost.exe no specs mshta.exe no specs reg.exe no specs mode.com no specs chcp.com no specs reg.exe no specs cmd.exe no specs reg.exe no specs find.exe no specs reg.exe no specs powershell.exe cmd.exe no specs conhost.exe no specs tasklist.exe no specs mode.com no specs a768082633.exe no specs conhost.exe no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs tasklist.exe no specs temp02tnin0anv4th9xt9hcw0cmubvhfw7kb.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs find.exe no specs nsudolg.exe no specs reg.exe no specs find.exe no specs nsudolg.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs msbuild.exe chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs chrome.exe no specs conhost.exe no specs temp02tnin0anv4th9xt9hcw0cmubvhfw7kb.exe no specs 57b2aa6d64.exe no specs chrome.exe no specs powershell.exe no specs chrome.exe no specs conhost.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs chrome.exe no specs conhost.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs csc.exe csc.exe cvtres.exe no specs csc.exe csc.exe cvtres.exe no specs cvtres.exe no specs cvtres.exe no specs csc.exe csc.exe csc.exe cvtres.exe no specs cvtres.exe no specs csc.exe cvtres.exe no specs ssa-7005-sm-33102519.exe no specs cvtres.exe no specs CMSTPLUA csc.exe zxy99drjsdobcw0hpfd8g.exe no specs dfsvc.exe csc.exe cvtres.exe no specs cvtres.exe no specs csc.exe cvtres.exe no specs 57b2aa6d64.exe no specs csc.exe csc.exe cvtres.exe no specs cvtres.exe no specs csc.exe cvtres.exe no specs l7m5wh3.exe wscript.exe no specs reg.exe no specs find.exe no specs reg.exe no specs cmd.exe no specs find.exe no specs findstr.exe no specs 7z.exe cmd.exe no specs findstr.exe no specs 7z.exe no specs unlocker.exe no specs unlocker.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs find.exe no specs sc.exe no specs sc.exe no specs unlocker.exe cmd.exe no specs conhost.exe no specs sc.exe no specs werfault.exe no specs 8rypwds.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs slui.exe no specs c5riw3xc3pz746yj1g1somjpv1sssk.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs timeout.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs 8rypwds.exe unlocker.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs taskkill.exe no specs werfault.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs find.exe no specs sc.exe no specs sc.exe no specs unlocker.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs fpbjy1q.exe no specs conhost.exe no specs cmd.exe no specs ramez.exe no specs conhost.exe no specs comreviewdriver.exe timeout.exe no specs unlocker.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs csc.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cvtres.exe no specs csc.exe conhost.exe no specs werfault.exe no specs cvtres.exe no specs csc.exe conhost.exe no specs cvtres.exe no specs msbuild.exe csc.exe conhost.exe no specs cvtres.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs timeout.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs xeixgfe.exe no specs chcp.com no specs timeout.exe no specs conhost.exe no specs ping.exe no specs #DARKCRYSTAL dwm.exe dllhost.exe no specs cvtres.exe no specs comreviewdriver.exe no specs fpbjy1q.exe no specs fontdrvhost.exe no specs unlocker.exe cmd.exe no specs conhost.exe no specs sc.exe no specs iobitunlocker.exe no specs unlocker.exe no specs svchost.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs msbuild.exe iobitunlocker.exe no specs iobitunlocker.exe no specs oxdu0mw.exe CMSTPLUA wintemp-v4.exe powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs svchost.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs 08iyoof.exe no specs conhost.exe no specs #DARKCRYSTAL dwm.exe powershell.exe no specs conhost.exe no specs msbuild.exe sc.exe no specs sc.exe no specs sc.exe no specs screenconnect.windowsclient.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs screenconnect.clientservice.exe sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs #SCREENCONNECT screenconnect.clientservice.exe sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs csyrrck.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs screenconnect.windowsclient.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs powershell.exe no specs reg.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs schtasks.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs schtasks.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs schtasks.exe no specs sc.exe no specs sc.exe no specs schtasks.exe no specs sc.exe no specs reg.exe no specs schtasks.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs msbuild.exe no specs reg.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs schtasks.exe no specs reg.exe no specs reg.exe no specs schtasks.exe no specs reg.exe no specs unlocker.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs taskkill.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs xlp1too.exe no specs conhost.exe no specs reg.exe no specs unlocker.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs taskkill.exe no specs sc.exe no specs sc.exe no specs schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reagentc.exe no specs win-v42.exe #LUMMA msbuild.exe werfault.exe no specs hrnxr8j.exe no specs cmd.exe no specs conhost.exe no specs takeown.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs #MINER cmd.exe explorer.exe svchost.exe no specs svchost.exe no specs iobitunlocker.exe no specs iobitunlocker.exe explorer.exe no specs openwith.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
140sc stop "SgrmAgent" C:\Windows\System32\sc.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
456C:\WINDOWS\system32\WerFault.exe -u -p 920 -s 1464C:\Windows\System32\WerFault.exeUnlocker.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
456schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /fC:\Windows\System32\schtasks.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Task Scheduler Configuration Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
616reg query "HKLM\System\CurrentControlSet\Services\MsSecWfp" C:\Windows\System32\reg.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
640sc query IObitUnlockerC:\Windows\System32\sc.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
660reg delete "HKLM\System\CurrentControlset\Control\WMI\Autologger\DefenderApiLogger" /fC:\Windows\System32\reg.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
668timeout /t 2 /nobreak C:\Windows\System32\timeout.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
672sc config "webthreatdefusersvc" start= disabled C:\Windows\System32\sc.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
684"C:\Users\admin\AppData\Local\Apps\2.0\5LKPAQRT.N4P\6HYHP8OH.M65\scre..tion_25b0fbb6ef7eb094_0019.0002_c67b0b62bbccb71f\ScreenConnect.WindowsClient.exe" C:\Users\admin\AppData\Local\Apps\2.0\5LKPAQRT.N4P\6HYHP8OH.M65\scre..tion_25b0fbb6ef7eb094_0019.0002_c67b0b62bbccb71f\ScreenConnect.WindowsClient.exedfsvc.exe
User:
admin
Company:
ScreenConnect Software
Integrity Level:
MEDIUM
Description:
ScreenConnect Client
Version:
25.2.4.9229
Modules
Images
c:\users\admin\appdata\local\apps\2.0\5lkpaqrt.n4p\6hyhp8oh.m65\scre..tion_25b0fbb6ef7eb094_0019.0002_c67b0b62bbccb71f\screenconnect.windowsclient.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
744"C:\Users\admin\AppData\Local\Temp\10154530101\97a61b4446.exe" C:\Users\admin\AppData\Local\Temp\10154530101\97a61b4446.exe
ramez.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
MyApp Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\10154530101\97a61b4446.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\comctl32.dll
c:\windows\syswow64\advapi32.dll
Total events
311 420
Read events
310 733
Write events
425
Delete events
262

Modification events

(PID) Process:(3332) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3332) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3332) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5\ApplicationViewManagement\W32:0000000000050294
Operation:writeName:VirtualDesktop
Value:
1000000030304456BFA0DB55E4278845B426357D5B5F97B3
(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5\ApplicationViewManagement\W32:0000000000050294
Operation:delete keyName:(default)
Value:
(PID) Process:(7224) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7224) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7224) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(7224) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(7224) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
Executable files
125
Suspicious files
164
Text files
194
Unknown types
1

Dropped files

PID
Process
Filename
Type
7772TempJTJ33BDQIHTUAIBYKMYHZB9HVRCUNGQV.EXEC:\Windows\Tasks\ramez.jobbinary
MD5:1C098D0946ABDECFAD49B6FC833731E9
SHA256:12ABAEAF8971270220BA79D1918C39F3866BB58157B9F4AF2BAF55BAF89150BF
5492explorer.exeC:\Users\admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.datbinary
MD5:E49C56350AEDF784BFE00E444B879672
SHA256:A8BD235303668981563DFB5AAE338CB802817C4060E2C199B7C84901D57B7E1E
176497a61b4446.tmpC:\Users\admin\AppData\Roaming\MyApp\unins000.exeexecutable
MD5:4134EC81A9D645602B1FA265F98FBF35
SHA256:69966257CE41717F2121EA1F03F8BFA1486423ACECFCC977DD9F1E157C911AD4
7224powershell.exeC:\Users\admin\AppData\Local\TempJTJ33BDQIHTUAIBYKMYHZB9HVRCUNGQV.EXEexecutable
MD5:26CC5A6CFD8E8ECC433337413C14CDDB
SHA256:2D904D576B46236BAF504DBA21775F6EBBBD0F65272A9C2FCA1C6798184FA4E8
7976ramez.exeC:\Users\admin\AppData\Local\Temp\10154520101\07c099764d.exeexecutable
MD5:ECE1D1507B62C20327E999C6936A95A7
SHA256:8EB08322033F193A5E7EA16D83C0CD324EFAAAB628FB245BDB27F6977C2A6D86
7976ramez.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\random[1].exeexecutable
MD5:ECE1D1507B62C20327E999C6936A95A7
SHA256:8EB08322033F193A5E7EA16D83C0CD324EFAAAB628FB245BDB27F6977C2A6D86
7224powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_34bktumv.jqe.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7224powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:EEB9D818B8044D606F0DD4929D7AF543
SHA256:15FC1AD8E2DF2AF33957AD8845C632F854C650C8029A88B472AB1CA3AF959969
7816powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_v2ekscl2.tza.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7816powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_isoxacim.k3a.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
124
TCP/UDP connections
129
DNS requests
62
Threats
130

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
7224
powershell.exe
GET
200
185.156.72.2:80
http://185.156.72.2/testmine/random.exe
unknown
unknown
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
7976
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
unknown
7816
powershell.exe
GET
200
185.156.72.2:80
http://185.156.72.2/testmine/random.exe
unknown
unknown
7976
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
unknown
7976
ramez.exe
GET
200
185.156.72.2:80
http://185.156.72.2/files/unique2/random.exe
unknown
unknown
5124
info.exe
GET
45.155.69.47:80
http://pub-stat-999.twilightparadox.com/api/record?t=p3
unknown
unknown
7976
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
7224
powershell.exe
185.156.72.2:80
Tov Vaiz Partner
RU
unknown
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
  • 4.231.128.59
whitelisted
google.com
  • 172.217.18.14
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.159.131
  • 40.126.31.67
  • 40.126.31.130
  • 40.126.31.129
  • 40.126.31.69
  • 40.126.31.131
  • 40.126.31.0
  • 20.190.159.130
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
t.me
  • 149.154.167.99
whitelisted

Threats

PID
Process
Class
Message
7224
powershell.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7224
powershell.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7224
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
7224
powershell.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
7224
powershell.exe
Misc activity
ET INFO Packed Executable Download
7976
ramez.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
7816
powershell.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7816
powershell.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7816
powershell.exe
Misc activity
ET INFO Packed Executable Download
7816
powershell.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
1 ETPRO signatures available at the full report
No debug info