File name:

186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.zip

Full analysis: https://app.any.run/tasks/ddc9dcd4-c9fe-4a5a-9eba-1b5ed0cbe7c3
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: May 18, 2025, 05:11:45
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
lumma
stealer
loader
amadey
botnet
themida
rdp
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

E3D3E45DB37C7387668B1C39E5CEAFF8

SHA1:

4A56CFBECB66675B76D8FEE442E53B56B32F2E38

SHA256:

E1702005AF6308B5B8CA50B339D4E1AB453314DFB81F4C58D3A1B0DB932A4033

SSDEEP:

98304:5HAsY/WPpCqzK4NOq358w2IVyKFxoCCUNqWnA4Zbh5olQ/wySkUhyIijS7V6iGzt:sa

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 3096)
    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)
      • 186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe (PID: 664)
    • LUMMA mutex has been found

      • 186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe (PID: 664)
    • Actions looks like stealing of personal data

      • 186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe (PID: 664)
    • Connects to the CnC server

      • svchost.exe (PID: 2196)
      • ramez.exe (PID: 6752)
    • Steals credentials from Web Browsers

      • 186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe (PID: 664)
    • LUMMA has been detected (YARA)

      • 186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe (PID: 664)
    • AMADEY mutex has been found

      • HJPHOYDHI5DGA6SJ.exe (PID: 4740)
      • ramez.exe (PID: 4228)
      • ramez.exe (PID: 6752)
      • ramez.exe (PID: 2984)
    • AMADEY has been detected (YARA)

      • ramez.exe (PID: 6752)
    • AMADEY has been detected (SURICATA)

      • ramez.exe (PID: 6752)
  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 3096)
      • HJPHOYDHI5DGA6SJ.exe (PID: 4740)
      • ramez.exe (PID: 6752)
    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2196)
      • 186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe (PID: 664)
      • ramez.exe (PID: 6752)
    • Connects to the server without a host name

      • 186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe (PID: 664)
      • ramez.exe (PID: 6752)
    • Reads the BIOS version

      • 186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe (PID: 664)
      • ramez.exe (PID: 6752)
      • HJPHOYDHI5DGA6SJ.exe (PID: 4740)
      • ramez.exe (PID: 4228)
      • ramez.exe (PID: 2984)
    • Searches for installed software

      • 186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe (PID: 664)
    • Process requests binary or script from the Internet

      • 186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe (PID: 664)
    • Multiple wallet extension IDs have been found

      • 186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe (PID: 664)
    • Starts itself from another location

      • HJPHOYDHI5DGA6SJ.exe (PID: 4740)
    • Executable content was dropped or overwritten

      • 186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe (PID: 664)
      • HJPHOYDHI5DGA6SJ.exe (PID: 4740)
    • Potential Corporate Privacy Violation

      • 186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe (PID: 664)
    • There is functionality for enable RDP (YARA)

      • ramez.exe (PID: 6752)
    • The process executes via Task Scheduler

      • ramez.exe (PID: 4228)
      • ramez.exe (PID: 2984)
  • INFO

    • Checks supported languages

      • 186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe (PID: 664)
      • ramez.exe (PID: 6752)
      • HJPHOYDHI5DGA6SJ.exe (PID: 4740)
      • ramez.exe (PID: 4228)
      • ramez.exe (PID: 2984)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3096)
    • Reads the computer name

      • 186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe (PID: 664)
      • HJPHOYDHI5DGA6SJ.exe (PID: 4740)
      • ramez.exe (PID: 6752)
    • Themida protector has been detected

      • 186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe (PID: 664)
      • ramez.exe (PID: 6752)
    • Reads the software policy settings

      • 186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe (PID: 664)
      • slui.exe (PID: 6028)
      • slui.exe (PID: 3132)
    • Create files in a temporary directory

      • HJPHOYDHI5DGA6SJ.exe (PID: 4740)
      • 186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe (PID: 664)
    • Process checks computer location settings

      • HJPHOYDHI5DGA6SJ.exe (PID: 4740)
    • Checks proxy server information

      • slui.exe (PID: 3132)
      • ramez.exe (PID: 6752)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Lumma

(PID) Process(664) 186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe
C2 (9)emphatakpn.bet/ladk
featurlyin.top/pdal
overcovtcg.top/juhd
laminaflbx.shop/twoq
cornerdurv.top/adwq
testcawepr.run/dsap
saxecocnak.live/manj
posseswsnc.top/akds
blackswmxc.top/bgry

Amadey

(PID) Process(6752) ramez.exe
C2185.156.72.96
URLhttp://185.156.72.96/te4h2nus/index.php
Version5.34
Options
Drop directoryd610cf342e
Drop nameramez.exe
Strings (125)lv:
msi
Kaspersky Lab
av:
|
#
"
\App
00000422
dm:
Powershell.exe
ProgramData\
ps1
rundll32
http://
Content-Disposition: form-data; name="data"; filename="
SOFTWARE\Microsoft\Windows NT\CurrentVersion
dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
id:
VideoID
cred.dll|clip.dll|
0000043f
cmd
00000423
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
-executionpolicy remotesigned -File "
2022
------
2016
og:
\0000
CurrentBuild
2019
:::
S-%lu-
" && timeout 1 && del
ProductName
Panda Security
ESET
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
/k
+++
?scr=1
Doctor Web
GET
SYSTEM\ControlSet001\Services\BasicDisplay\Video
/quiet
.jpg
d610cf342e
vs:
sd:
rundll32.exe
"taskkill /f /im "
pc:
random
=
360TotalSecurity
<d>
wb
Content-Type: multipart/form-data; boundary=----
Startup
Norton
&& Exit"
os:
https://
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
2025
Avira
%-lu
zip
POST
" Content-Type: application/octet-stream
Rem
/te4h2nus/index.php
------
5.34
<c>
clip.dll
AVAST Software
\
shell32.dll
" && ren
e3
ramez.exe
kernel32.dll
DefaultSettings.XResolution
d1
DefaultSettings.YResolution
185.156.72.96
r=
cred.dll
--
GetNativeSystemInfo
-%lu
ComputerName
&unit=
Keyboard Layout\Preload
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
ar:
Sophos
%USERPROFILE%
exe
e1
e2
st=s
Programs
0123456789
un:
rb
bi:
abcdefghijklmnopqrstuvwxyz0123456789-_
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
cmd /C RMDIR /s/q
Bitdefender
-unicode-
AVG
WinDefender
&&
shutdown -s -t 0
Comodo
00000419
Content-Type: application/x-www-form-urlencoded
/Plugins/
Main
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2025:05:18 05:11:16
ZipCRC: 0xd774439b
ZipCompressedSize: 1903137
ZipUncompressedSize: 1928192
ZipFileName: 186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
10
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe #LUMMA 186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe #LUMMA svchost.exe hjphoydhi5dga6sj.exe #AMADEY ramez.exe slui.exe ramez.exe no specs ramez.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
664"C:\Users\admin\AppData\Local\Temp\Rar$EXb3096.42663\186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb3096.42663\186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb3096.42663\186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Lumma
(PID) Process(664) 186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe
C2 (9)emphatakpn.bet/ladk
featurlyin.top/pdal
overcovtcg.top/juhd
laminaflbx.shop/twoq
cornerdurv.top/adwq
testcawepr.run/dsap
saxecocnak.live/manj
posseswsnc.top/akds
blackswmxc.top/bgry
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2984"C:\Users\admin\AppData\Local\Temp\d610cf342e\ramez.exe"C:\Users\admin\AppData\Local\Temp\d610cf342e\ramez.exesvchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\d610cf342e\ramez.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
3096"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3132C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4228"C:\Users\admin\AppData\Local\Temp\d610cf342e\ramez.exe"C:\Users\admin\AppData\Local\Temp\d610cf342e\ramez.exesvchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\d610cf342e\ramez.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
4740"C:\Users\admin\AppData\Local\Temp\HJPHOYDHI5DGA6SJ.exe"C:\Users\admin\AppData\Local\Temp\HJPHOYDHI5DGA6SJ.exe
186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\hjphoydhi5dga6sj.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6028"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6752"C:\Users\admin\AppData\Local\Temp\d610cf342e\ramez.exe" C:\Users\admin\AppData\Local\Temp\d610cf342e\ramez.exe
HJPHOYDHI5DGA6SJ.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\d610cf342e\ramez.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Amadey
(PID) Process(6752) ramez.exe
C2185.156.72.96
URLhttp://185.156.72.96/te4h2nus/index.php
Version5.34
Options
Drop directoryd610cf342e
Drop nameramez.exe
Strings (125)lv:
msi
Kaspersky Lab
av:
|
#
"
\App
00000422
dm:
Powershell.exe
ProgramData\
ps1
rundll32
http://
Content-Disposition: form-data; name="data"; filename="
SOFTWARE\Microsoft\Windows NT\CurrentVersion
dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
id:
VideoID
cred.dll|clip.dll|
0000043f
cmd
00000423
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
-executionpolicy remotesigned -File "
2022
------
2016
og:
\0000
CurrentBuild
2019
:::
S-%lu-
" && timeout 1 && del
ProductName
Panda Security
ESET
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
/k
+++
?scr=1
Doctor Web
GET
SYSTEM\ControlSet001\Services\BasicDisplay\Video
/quiet
.jpg
d610cf342e
vs:
sd:
rundll32.exe
"taskkill /f /im "
pc:
random
=
360TotalSecurity
<d>
wb
Content-Type: multipart/form-data; boundary=----
Startup
Norton
&& Exit"
os:
https://
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
2025
Avira
%-lu
zip
POST
" Content-Type: application/octet-stream
Rem
/te4h2nus/index.php
------
5.34
<c>
clip.dll
AVAST Software
\
shell32.dll
" && ren
e3
ramez.exe
kernel32.dll
DefaultSettings.XResolution
d1
DefaultSettings.YResolution
185.156.72.96
r=
cred.dll
--
GetNativeSystemInfo
-%lu
ComputerName
&unit=
Keyboard Layout\Preload
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
ar:
Sophos
%USERPROFILE%
exe
e1
e2
st=s
Programs
0123456789
un:
rb
bi:
abcdefghijklmnopqrstuvwxyz0123456789-_
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
cmd /C RMDIR /s/q
Bitdefender
-unicode-
AVG
WinDefender
&&
shutdown -s -t 0
Comodo
00000419
Content-Type: application/x-www-form-urlencoded
/Plugins/
Main
6944C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exesvchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
4 018
Read events
4 006
Write events
12
Delete events
0

Modification events

(PID) Process:(3096) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(3096) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(3096) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(3096) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.zip
(PID) Process:(3096) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3096) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3096) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3096) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3096) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(6752) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
3
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3096WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3096.42663\186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exeexecutable
MD5:981F6077B7BBD3C39D69FA5A740A6D24
SHA256:186FF54556FC88758FA7D80C8A2D901011EA59A2740D2F5CC793B5CD29A897AF
4740HJPHOYDHI5DGA6SJ.exeC:\Windows\Tasks\ramez.jobbinary
MD5:016E5F798288F9B1B33679202437D3D9
SHA256:C36FDD37536AC8E68AB41D600EB655863A8D7AF58C2744E733F796F6B98AC983
664186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exeC:\Users\admin\AppData\Local\Temp\HJPHOYDHI5DGA6SJ.exeexecutable
MD5:7D75047F45919AD45581E8ED1E2A6FF7
SHA256:6D9F399024E5E703BE50543ACE0C0B6A8F8EC7987C2911B16AA87780A6DF3546
4740HJPHOYDHI5DGA6SJ.exeC:\Users\admin\AppData\Local\Temp\d610cf342e\ramez.exeexecutable
MD5:7D75047F45919AD45581E8ED1E2A6FF7
SHA256:6D9F399024E5E703BE50543ACE0C0B6A8F8EC7987C2911B16AA87780A6DF3546
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
29
DNS requests
16
Threats
15

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
4464
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
4464
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
664
186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe
GET
200
185.156.72.2:80
http://185.156.72.2/mine/random.exe
unknown
unknown
6752
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
malicious
6752
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
664
186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe
104.21.48.1:443
cornerdurv.top
CLOUDFLARENET
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 2.23.246.101
whitelisted
google.com
  • 142.250.186.46
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.159.4
  • 40.126.31.73
  • 20.190.159.2
  • 20.190.159.71
  • 20.190.159.0
  • 20.190.159.73
  • 40.126.31.131
  • 20.190.159.64
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
cornerdurv.top
  • 104.21.48.1
  • 104.21.16.1
  • 104.21.32.1
  • 104.21.112.1
  • 104.21.80.1
  • 104.21.64.1
  • 104.21.96.1
unknown
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
664
186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (cornerdurv .top) in TLS SNI
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cornerdurv .top)
664
186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (cornerdurv .top) in TLS SNI
664
186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (cornerdurv .top) in TLS SNI
664
186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (cornerdurv .top) in TLS SNI
664
186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (cornerdurv .top) in TLS SNI
664
186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (cornerdurv .top) in TLS SNI
664
186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
664
186ff54556fc88758fa7d80c8a2d901011ea59a2740d2f5cc793b5cd29a897af.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
No debug info