File name:

2025-05-20_3f4ecdde62ac7dc5d23a3890801bd369_amadey_elex_smoke-loader

Full analysis: https://app.any.run/tasks/c3c1d89f-b835-41e6-abda-21e174cb45c5
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 20, 2025, 15:43:01
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
api-base64
loader
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

3F4ECDDE62AC7DC5D23A3890801BD369

SHA1:

42A6B267D4FE4E9EE0E96E6CA08C8B94B63781D7

SHA256:

E07CB7CDF465FEA9A9ACB4F1BE7BDD83D3C9E6CB8BB5801DCE722851679CF37B

SSDEEP:

49152:1bEaIRwuRVdbBB/NNIfBGHgCpqJUaB/CG4DWuO9I+HOrnu0GOpocE0kL8l2Wlnsi:+a0Vdf7G4Db

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • instloffer.exe (PID: 7936)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 2025-05-20_3f4ecdde62ac7dc5d23a3890801bd369_amadey_elex_smoke-loader.exe (PID: 7508)
      • 4d29Installer.exe (PID: 7568)
      • instloffer.exe (PID: 7936)

    • Reads security settings of Internet Explorer

      • 2025-05-20_3f4ecdde62ac7dc5d23a3890801bd369_amadey_elex_smoke-loader.exe (PID: 7508)
      • 4d29Installer.exe (PID: 7568)
      • instloffer.exe (PID: 7936)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • 4d29Installer.exe (PID: 7568)

    • The process creates files with name similar to system file names

      • 4d29Installer.exe (PID: 7568)

    • Reads the BIOS version

      • 4d29Installer.exe (PID: 7568)

    • There is functionality for taking screenshot (YARA)

      • 4d29Installer.exe (PID: 7568)
      • instloffer.exe (PID: 7936)

    • Reads Microsoft Outlook installation path

      • 4d29Installer.exe (PID: 7568)

    • Reads Internet Explorer settings

      • 4d29Installer.exe (PID: 7568)

    • Process requests binary or script from the Internet

      • instloffer.exe (PID: 7936)

  • INFO

    • Checks supported languages

      • 2025-05-20_3f4ecdde62ac7dc5d23a3890801bd369_amadey_elex_smoke-loader.exe (PID: 7508)
      • 4d29Installer.exe (PID: 7568)
      • instloffer.exe (PID: 7936)

    • Create files in a temporary directory

      • 2025-05-20_3f4ecdde62ac7dc5d23a3890801bd369_amadey_elex_smoke-loader.exe (PID: 7508)
      • 4d29Installer.exe (PID: 7568)
      • instloffer.exe (PID: 7936)

    • Process checks computer location settings

      • 2025-05-20_3f4ecdde62ac7dc5d23a3890801bd369_amadey_elex_smoke-loader.exe (PID: 7508)
      • instloffer.exe (PID: 7936)

    • Reads the computer name

      • 2025-05-20_3f4ecdde62ac7dc5d23a3890801bd369_amadey_elex_smoke-loader.exe (PID: 7508)
      • 4d29Installer.exe (PID: 7568)
      • instloffer.exe (PID: 7936)

    • Checks proxy server information

      • 2025-05-20_3f4ecdde62ac7dc5d23a3890801bd369_amadey_elex_smoke-loader.exe (PID: 7508)
      • 4d29Installer.exe (PID: 7568)
      • instloffer.exe (PID: 7936)
      • slui.exe (PID: 8184)

    • The sample compiled with english language support

      • 4d29Installer.exe (PID: 7568)

    • Potential library load (Base64 Encoded 'LoadLibrary')

      • 2025-05-20_3f4ecdde62ac7dc5d23a3890801bd369_amadey_elex_smoke-loader.exe (PID: 7508)

    • Reads CPU info

      • 4d29Installer.exe (PID: 7568)

    • Potential access to remote process (Base64 Encoded 'OpenProcess')

      • 2025-05-20_3f4ecdde62ac7dc5d23a3890801bd369_amadey_elex_smoke-loader.exe (PID: 7508)

    • Creates files or folders in the user directory

      • 4d29Installer.exe (PID: 7568)

    • UPX packer has been detected

      • 4d29Installer.exe (PID: 7568)

    • Reads the software policy settings

      • slui.exe (PID: 8184)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2014:06:27 10:03:42+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 431616
InitializedDataSize: 267776
UninitializedDataSize: -
EntryPoint: 0x3ffe0
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 2025-05-20_3f4ecdde62ac7dc5d23a3890801bd369_amadey_elex_smoke-loader.exe 4d29installer.exe instloffer.exe slui.exe svchost.exe 2025-05-20_3f4ecdde62ac7dc5d23a3890801bd369_amadey_elex_smoke-loader.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
7400"C:\Users\admin\Desktop\2025-05-20_3f4ecdde62ac7dc5d23a3890801bd369_amadey_elex_smoke-loader.exe" C:\Users\admin\Desktop\2025-05-20_3f4ecdde62ac7dc5d23a3890801bd369_amadey_elex_smoke-loader.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\2025-05-20_3f4ecdde62ac7dc5d23a3890801bd369_amadey_elex_smoke-loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7508"C:\Users\admin\Desktop\2025-05-20_3f4ecdde62ac7dc5d23a3890801bd369_amadey_elex_smoke-loader.exe" C:\Users\admin\Desktop\2025-05-20_3f4ecdde62ac7dc5d23a3890801bd369_amadey_elex_smoke-loader.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\2025-05-20_3f4ecdde62ac7dc5d23a3890801bd369_amadey_elex_smoke-loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
7568"C:\Users\admin\AppData\Local\temp\4d29Installer.exe" /KEYWORD=4d29 "/PATHFILES=C:\Users\admin\AppData\Local\temp\"C:\Users\admin\AppData\Local\Temp\4d29Installer.exe
2025-05-20_3f4ecdde62ac7dc5d23a3890801bd369_amadey_elex_smoke-loader.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\4d29installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7936C:\Users\admin\AppData\Local\Temp\instloffer.exe "/CT=v920140627113635" "/SLEEP=5000" "/A2=UNDEFINED" "/SENDREPORTS=1" "/REPORTURL=http://www.instseo.com/insts/listener.php" "/APIURL=http://www.instseo.com/insts/instapi.php" "/PARTNERID=WALLSAVECOM" "/OFFERID=2515" "/PROGRAMURLENCODED=Wallpaper%20Woman%20Masked%20Gas%20Mask%20Girl%20Black%20Dark%20Light%20Smoke%20Girls%20339438%20" "/ORIGEN=SEO" "/OFFERKEYWORD=softwareupdater" "/OFFERURL=http://www.instseo.com/installers/software/updater/softwareupdater.exe" "/OFFERPARAMS=/partner=WALLSAVECOM /sem=0 /language=" "/OFFERPARAMSURLENCODED=%2fpartner%3dWALLSAVECOM++%2fsem%3d0+%2flanguage%3d" "/CHANNEL=WALLSAVECOM" "/CONVERSIONMODE=" "/CONVERSIONURL=" "/INSTTYPE=lp" "/ADGENCIA=" "/CAMPAIGN_KEYWORD=" "/UA=msie" "/PMD5="C:\Users\admin\AppData\Local\Temp\instloffer.exe
4d29Installer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\instloffer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
8184C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
6 254
Read events
6 240
Write events
12
Delete events
2

Modification events

(PID) Process:(7568) 4d29Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7568) 4d29Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7568) 4d29Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7568) 4d29Installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Vittalia\AxtanInstaller\versions\na
Operation:writeName:Name
Value:
Wallpaper Woman Masked Gas Mask Girl Black Dark Light Smoke Girls 339438
(PID) Process:(7568) 4d29Installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Vittalia\AxtanInstaller\versions\na
Operation:writeName:Version
Value:
(PID) Process:(7568) 4d29Installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Vittalia\AxtanInstaller\versions\na
Operation:writeName:DatetimeInstall
Value:
2025-05-20 15:43:20
(PID) Process:(7568) 4d29Installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Vittalia\AxtanInstaller\versions\na
Operation:writeName:DatetimeUpdated
Value:
0000-00-00 00:00:00
(PID) Process:(7568) 4d29Installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Vittalia\AxtanInstaller\versions\na
Operation:writeName:PartnerKeyword
Value:
WALLSAVECOM
(PID) Process:(7568) 4d29Installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Vittalia\AxtanInstaller\versions\na
Operation:writeName:LogoUrl
Value:
http://media.sftvit.com/
(PID) Process:(7936) instloffer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
22
Suspicious files
2
Text files
73
Unknown types
0

Dropped files

PID
Process
Filename
Type
75082025-05-20_3f4ecdde62ac7dc5d23a3890801bd369_amadey_elex_smoke-loader.exeC:\Users\admin\Desktop\loader.bmpimage
MD5:502FFE8B0FBAD126FE15E22D96A9B382
SHA256:7D5B97590D5A6AD3E0A0C3BC2774EB77CC5DCB9C6DDDC9A5A6AED9E8B8BFDE30
75684d29Installer.exeC:\Users\admin\AppData\Local\Temp\mysearchdial_chrome_image1.bmpimage
MD5:D693A7BC1BF535F0E6BD3A8DF556D8B3
SHA256:5FC4935FFB8302607D75FCC2A6DCAE81242F99F365D73BA2A36359CF39F6C8AF
75684d29Installer.exeC:\Users\admin\AppData\Local\Temp\nsqDDFF.tmp\tkDecript.dllexecutable
MD5:86A2A4CEDA4D7C0A126C8C9619126BB3
SHA256:BE40D5C9593EBCB2331B22CC4C8F9E87CF08266827BC6AD1C2ECDB2D52F9C2DF
75684d29Installer.exeC:\Users\admin\AppData\Local\Temp\widdit_big_image.bmpimage
MD5:B04483D38BB6924C567779EB51C3B329
SHA256:CD39B9B0CC254DD3D80504EAC801B2187BD58230831E8E44E5593D92EFFA0664
75684d29Installer.exeC:\Users\admin\AppData\Local\Temp\instloffer.exeexecutable
MD5:4A41A531E238DB6B0F8B3B76255CF059
SHA256:A430F62AC908A4A1EBCD4B6CF91222DC7AABF9F930F8B4013447462895CC9BCA
75684d29Installer.exeC:\Users\admin\AppData\Local\Temp\snapdov2_terms.rtftext
MD5:396FC4E87732D27F95739C6554CE533D
SHA256:1163D72ECD25A7AD85E13DE20D5338E12E0126F415404FA1E7C14E680B9CC628
75684d29Installer.exeC:\Users\admin\AppData\Local\Temp\mysearchdial_msie_firefox_image.bmpimage
MD5:2900886AAC92524B1592A15339BC3DDA
SHA256:C287EE1E773D8B76C7B742ED5494D3CDE4689CE9D0566F138A0B2FF28E0BECDF
75684d29Installer.exeC:\Users\admin\AppData\Local\Temp\hao123_image1.bmpimage
MD5:BB86080E9DE6569B00CCFBBEF215D6DD
SHA256:CFD0F18EAEB33279817D4AE52AD0FCA950169176EC6B7A68DB797E312D5E1BE7
75684d29Installer.exeC:\Users\admin\AppData\Local\Temp\ajax_loader.gifimage
MD5:60D1F98DBB5A6EA9AC747C3E46C0C628
SHA256:3D0580226138C9673AADAAF64D97C2A7C720D538F146C51C2C722D34E7FFA500
75684d29Installer.exeC:\Users\admin\AppData\Local\Temp\nsqDDFF.tmp\version.dllexecutable
MD5:EBC5BB904CDAC1C67ADA3FA733229966
SHA256:3EBA921EF649B71F98D9378DEE8105B38D2464C9CCDE37A694E4A0CD77D22A75
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
56
TCP/UDP connections
47
DNS requests
29
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7568
4d29Installer.exe
GET
404
185.47.13.93:80
http://www.instseo.com/insts/country.php?idMk=20250520154318700
unknown
—
—
unknown
7568
4d29Installer.exe
GET
404
185.47.13.93:80
http://www.instseo.com/insts/instapi.php?idMk=20250520154318700&state=timegeo_1&idTime=610&idA2=<!DOCTYPE%20HTML%20PUBLIC%20"-//IETF//DTD%20HTML%202.0//EN"><html><head><title>404%20Not%20Found</title></head><body><h1>Not%20Found</h1><p>The%20requested%20URL%20was%20not%20found%20on%20this%20server.</p><hr><address>Apache%20Server%20at%20www.instseo.com%20Port%2080</address></body></html>&xVal=UNDEFINED
unknown
—
—
unknown
7568
4d29Installer.exe
GET
404
185.47.13.93:80
http://www.instseo.com/insts/instapi.php?idMk=20250520154318700&state=timegeo_2&idTime=16&idA2=&xVal=UNDEFINED
unknown
—
—
unknown
7568
4d29Installer.exe
GET
404
185.47.13.93:80
http://www.instseo.com/insts/instapi.php?idMk=20250520154318700&state=get_offers_order_unique
unknown
—
—
unknown
7508
2025-05-20_3f4ecdde62ac7dc5d23a3890801bd369_amadey_elex_smoke-loader.exe
GET
—
157.180.9.209:80
http://xmlinstcp.ddbbvt.eu/cmd/precompiled.html?q=1&mayor=6&minor=2&spack=0
unknown
—
—
malicious
7568
4d29Installer.exe
GET
404
185.47.13.93:80
http://www.instseo.com/insts/instapi.php?idMk=20250520154318700&state=newenduser
unknown
—
—
unknown
7568
4d29Installer.exe
GET
404
185.47.13.93:80
http://www.instseo.com/insts/instapi.php?idMk=20250520154318700&state=get_availability&ypo=7924&idA2=UNDEFINED
unknown
—
—
unknown
7568
4d29Installer.exe
GET
404
185.47.13.93:80
http://www.instseo.com/insts/instapi.php?idMk=20250520154318700&state=get_availability&ypo=12178&idA2=UNDEFINED
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5496
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
5496
MoUsoCoreWorker.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5496
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7568
4d29Installer.exe
185.47.13.93:80
www.instseo.com
ServiHosting Networks S.L.
ES
unknown
7508
2025-05-20_3f4ecdde62ac7dc5d23a3890801bd369_amadey_elex_smoke-loader.exe
157.180.9.209:80
xmlinstcp.ddbbvt.eu
—
DE
unknown
6544
svchost.exe
20.190.159.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
  • 51.104.136.2
whitelisted
client.wns.windows.com
  • 172.211.123.249
  • 172.211.123.248
whitelisted
google.com
  • 172.217.18.14
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
  • 23.216.77.35
  • 23.216.77.21
  • 23.216.77.20
  • 23.216.77.32
  • 23.216.77.38
  • 23.216.77.37
  • 23.216.77.25
  • 23.216.77.31
  • 23.216.77.30
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
xmlinstcp.ddbbvt.eu
  • 157.180.9.209
malicious
www.instseo.com
  • 185.47.13.93
unknown
www.dlgeovt.com
  • —
unknown
login.live.com
  • 20.190.159.2
  • 20.190.159.68
  • 40.126.31.73
  • 40.126.31.130
  • 40.126.31.71
  • 40.126.31.0
  • 20.190.159.71
  • 40.126.31.128
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-05-20_3f4ecdde62ac7dc5d23a3890801bd369_amadey_elex_smoke-loader