File name:

random.exe

Full analysis: https://app.any.run/tasks/d81604be-d942-4e7e-b4bc-48b29f8c809f
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: June 18, 2024, 02:39:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
amadey
botnet
stealer
loader
redline
meta
metastealer
exfiltration
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

77DDB7264BCCD00910D07ADE2F33A90D

SHA1:

26E5256854040A0DCADA7746CE9479B9755B12DD

SHA256:

E2A01FD1E2DC81C6EBFBF79BFB243932CBA16C163DBF48A14DBBEAAA0F151CBD

SSDEEP:

98304:M2KeDTqVgey8C+mwa4JHSNRa3x+ATxIC4Esu3A5sWKRimBTNFQofxKuxHJi4befJ:VQu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • random.exe (PID: 3968)
      • axplong.exe (PID: 2104)
      • NewLatest.exe (PID: 2020)
      • Hkbsse.exe (PID: 992)
      • bin.exe (PID: 2612)
      • Hkbsse.exe (PID: 2504)
      • b2c2c1.exe (PID: 1888)

    • Connects to the CnC server

      • axplong.exe (PID: 2104)
      • redline123123.exe (PID: 588)
      • Hkbsse.exe (PID: 992)
      • Hkbsse.exe (PID: 2504)

    • AMADEY has been detected (SURICATA)

      • axplong.exe (PID: 2104)
      • Hkbsse.exe (PID: 992)
      • Hkbsse.exe (PID: 2504)
      • Dctooux.exe (PID: 2876)

    • AMADEY has been detected (YARA)

      • axplong.exe (PID: 2104)
      • Hkbsse.exe (PID: 2504)
      • Hkbsse.exe (PID: 992)

    • REDLINE has been detected (SURICATA)

      • redline123123.exe (PID: 588)

    • METASTEALER has been detected (SURICATA)

      • redline123123.exe (PID: 588)

    • Steals credentials from Web Browsers

      • redline123123.exe (PID: 588)

    • Amadey has been detected

      • Hkbsse.exe (PID: 992)
      • NewLatest.exe (PID: 2020)

    • Actions looks like stealing of personal data

      • redline123123.exe (PID: 588)

    • REDLINE has been detected (YARA)

      • redline123123.exe (PID: 588)
      • gold.exe (PID: 284)
      • upd.exe (PID: 1604)

  • SUSPICIOUS

    • Reads the BIOS version

      • random.exe (PID: 3968)
      • axplong.exe (PID: 2104)

    • Starts itself from another location

      • random.exe (PID: 3968)
      • NewLatest.exe (PID: 2020)
      • bin.exe (PID: 2612)
      • b2c2c1.exe (PID: 1888)

    • Executable content was dropped or overwritten

      • random.exe (PID: 3968)
      • axplong.exe (PID: 2104)
      • NewLatest.exe (PID: 2020)
      • Hkbsse.exe (PID: 992)
      • bin.exe (PID: 2612)
      • Hkbsse.exe (PID: 2504)
      • b2c2c1.exe (PID: 1888)

    • Reads security settings of Internet Explorer

      • random.exe (PID: 3968)
      • axplong.exe (PID: 2104)
      • NewLatest.exe (PID: 2020)
      • Hkbsse.exe (PID: 992)
      • bin.exe (PID: 2612)
      • Hkbsse.exe (PID: 2504)
      • Dctooux.exe (PID: 2876)
      • b2c2c1.exe (PID: 1888)

    • Reads the Internet Settings

      • random.exe (PID: 3968)
      • axplong.exe (PID: 2104)
      • NewLatest.exe (PID: 2020)
      • Hkbsse.exe (PID: 992)
      • redline123123.exe (PID: 588)
      • bin.exe (PID: 2612)
      • Hkbsse.exe (PID: 2504)
      • Dctooux.exe (PID: 2876)
      • b2c2c1.exe (PID: 1888)

    • Potential Corporate Privacy Violation

      • axplong.exe (PID: 2104)
      • Hkbsse.exe (PID: 992)
      • Hkbsse.exe (PID: 2504)

    • Contacting a server suspected of hosting an CnC

      • axplong.exe (PID: 2104)
      • Hkbsse.exe (PID: 992)
      • Hkbsse.exe (PID: 2504)
      • Dctooux.exe (PID: 2876)

    • Connects to the server without a host name

      • axplong.exe (PID: 2104)
      • Hkbsse.exe (PID: 992)

    • Process requests binary or script from the Internet

      • axplong.exe (PID: 2104)
      • Hkbsse.exe (PID: 992)
      • Hkbsse.exe (PID: 2504)

    • Process drops legitimate windows executable

      • axplong.exe (PID: 2104)

    • Connects to unusual port

      • redline123123.exe (PID: 588)

    • Reads browser cookies

      • redline123123.exe (PID: 588)

    • The process connected to a server suspected of theft

      • redline123123.exe (PID: 588)

    • Searches for installed software

      • redline123123.exe (PID: 588)

  • INFO

    • Checks supported languages

      • random.exe (PID: 3968)
      • axplong.exe (PID: 2104)
      • wmpnscfg.exe (PID: 1056)
      • redline123123.exe (PID: 588)
      • upd.exe (PID: 1604)
      • lummac2.exe (PID: 2008)
      • gold.exe (PID: 284)
      • drivermanager.exe (PID: 1928)
      • MSBuild.exe (PID: 1940)
      • NewLatest.exe (PID: 2020)
      • Hkbsse.exe (PID: 992)
      • b2c2c1.exe (PID: 1888)
      • bin.exe (PID: 2612)
      • Hkbsse.exe (PID: 2504)
      • legs.exe (PID: 2764)
      • Dctooux.exe (PID: 2876)

    • Reads the computer name

      • random.exe (PID: 3968)
      • axplong.exe (PID: 2104)
      • wmpnscfg.exe (PID: 1056)
      • redline123123.exe (PID: 588)
      • drivermanager.exe (PID: 1928)
      • NewLatest.exe (PID: 2020)
      • Hkbsse.exe (PID: 992)
      • Hkbsse.exe (PID: 2504)
      • bin.exe (PID: 2612)
      • b2c2c1.exe (PID: 1888)
      • Dctooux.exe (PID: 2876)

    • Create files in a temporary directory

      • random.exe (PID: 3968)
      • axplong.exe (PID: 2104)
      • NewLatest.exe (PID: 2020)
      • Hkbsse.exe (PID: 992)
      • redline123123.exe (PID: 588)
      • bin.exe (PID: 2612)
      • Hkbsse.exe (PID: 2504)
      • b2c2c1.exe (PID: 1888)
      • Dctooux.exe (PID: 2876)

    • Reads the machine GUID from the registry

      • random.exe (PID: 3968)
      • axplong.exe (PID: 2104)
      • redline123123.exe (PID: 588)
      • drivermanager.exe (PID: 1928)
      • NewLatest.exe (PID: 2020)
      • Hkbsse.exe (PID: 992)
      • bin.exe (PID: 2612)
      • Hkbsse.exe (PID: 2504)
      • b2c2c1.exe (PID: 1888)
      • Dctooux.exe (PID: 2876)

    • Checks proxy server information

      • axplong.exe (PID: 2104)
      • Hkbsse.exe (PID: 992)
      • Hkbsse.exe (PID: 2504)
      • Dctooux.exe (PID: 2876)

    • Creates files or folders in the user directory

      • axplong.exe (PID: 2104)
      • Hkbsse.exe (PID: 992)
      • Hkbsse.exe (PID: 2504)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1056)

    • Reads product name

      • redline123123.exe (PID: 588)

    • Reads Environment values

      • redline123123.exe (PID: 588)

    • Disables trace logs

      • redline123123.exe (PID: 588)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(2104) axplong.exe
C277.91.77.81
URLhttp://77.91.77.81/Kiru9gu/index.php
Version4.30
Options
Drop directory8254624243
Drop nameaxplong.exe
Strings (113)Main
cmd /C RMDIR /s/q
/Plugins/
ESET
" && timeout 1 && del
&& Exit"
lv:
av:
SOFTWARE\Microsoft\Windows NT\CurrentVersion
st=s
Doctor Web
https://
Norton
Content-Type: application/x-www-form-urlencoded
ProductName
/k
Content-Type: multipart/form-data; boundary=----
?scr=1
cred.dll|clip.dll|
vs:
4.30
<d>
exe
8254624243
ComputerName
2019
id:
" && ren
ar:
:::
Sophos
77.91.77.81
sd:
#
Bitdefender
Panda Security
2016
abcdefghijklmnopqrstuvwxyz0123456789-_
-unicode-
Programs
Startup
d1
VideoID
bi:
&&
S-%lu-
Content-Disposition: form-data; name="data"; filename="
rb
Rem
\App
rundll32.exe
SYSTEM\ControlSet001\Services\BasicDisplay\Video
------
\0000
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
=
Avira
%USERPROFILE%
og:
un:
pc:
WinDefender
r=
+++
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
e0
axplong.exe
random
|
&unit=
DefaultSettings.YResolution
GetNativeSystemInfo
360TotalSecurity
-%lu
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
ps1
------
/Kiru9gu/index.php
Comodo
AVAST Software
wb
\
AVG
GET
-executionpolicy remotesigned -File "
Powershell.exe
" Content-Type: application/octet-stream
shutdown -s -t 0
kernel32.dll
shell32.dll
dll
"taskkill /f /im "
ProgramData\
CurrentBuild
cmd
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
POST
0123456789
os:
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
"
rundll32
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
<c>
dm:
e1
http://
--
%-lu
.jpg
Kaspersky Lab
2022
DefaultSettings.XResolution
(PID) Process(2504) Hkbsse.exe
C2o7labs.top
URLhttp://o7labs.top/visual/skins/index.php
Version4.30
Options
Drop directory5641a448ac
Drop nameHkbsse.exe
Strings (113)Main
cmd /C RMDIR /s/q
/Plugins/
ESET
" && timeout 1 && del
&& Exit"
lv:
av:
SOFTWARE\Microsoft\Windows NT\CurrentVersion
st=s
Doctor Web
https://
Norton
Content-Type: application/x-www-form-urlencoded
ProductName
/k
Content-Type: multipart/form-data; boundary=----
?scr=1
cred.dll|clip.dll|
vs:
4.30
<d>
exe
ComputerName
2019
id:
" && ren
ar:
:::
Sophos
sd:
#
Bitdefender
Panda Security
2016
abcdefghijklmnopqrstuvwxyz0123456789-_
-unicode-
Programs
Startup
d1
VideoID
bi:
&&
S-%lu-
Content-Disposition: form-data; name="data"; filename="
rb
Rem
\App
rundll32.exe
SYSTEM\ControlSet001\Services\BasicDisplay\Video
------
\0000
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
=
Avira
%USERPROFILE%
og:
o7labs.top
un:
pc:
WinDefender
r=
+++
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
e0
random
|
&unit=
DefaultSettings.YResolution
GetNativeSystemInfo
360TotalSecurity
-%lu
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
ps1
------
5641a448ac
Comodo
AVAST Software
wb
\
AVG
GET
-executionpolicy remotesigned -File "
Powershell.exe
" Content-Type: application/octet-stream
shutdown -s -t 0
kernel32.dll
shell32.dll
dll
"taskkill /f /im "
/visual/skins/index.php
ProgramData\
CurrentBuild
cmd
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
POST
0123456789
os:
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
"
rundll32
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
<c>
dm:
e1
Hkbsse.exe
http://
--
%-lu
.jpg
Kaspersky Lab
2022
DefaultSettings.XResolution
(PID) Process(992) Hkbsse.exe
C2185.172.128.116
URLhttp://185.172.128.116/Mb3GvQs8/index.php
Version4.30
Options
Drop directoryb66a8ae076
Drop nameHkbsse.exe
Strings (113)Main
cmd /C RMDIR /s/q
/Plugins/
ESET
185.172.128.116
" && timeout 1 && del
&& Exit"
lv:
av:
SOFTWARE\Microsoft\Windows NT\CurrentVersion
st=s
Doctor Web
https://
Norton
Content-Type: application/x-www-form-urlencoded
ProductName
/k
Content-Type: multipart/form-data; boundary=----
?scr=1
cred.dll|clip.dll|
vs:
4.30
<d>
exe
ComputerName
2019
id:
" && ren
ar:
:::
Sophos
sd:
#
Bitdefender
Panda Security
2016
abcdefghijklmnopqrstuvwxyz0123456789-_
-unicode-
Programs
Startup
d1
VideoID
bi:
&&
S-%lu-
Content-Disposition: form-data; name="data"; filename="
rb
Rem
\App
rundll32.exe
SYSTEM\ControlSet001\Services\BasicDisplay\Video
------
\0000
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
=
Avira
%USERPROFILE%
og:
un:
pc:
WinDefender
r=
+++
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
/Mb3GvQs8/index.php
e0
random
|
&unit=
DefaultSettings.YResolution
GetNativeSystemInfo
360TotalSecurity
-%lu
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
ps1
------
Comodo
AVAST Software
wb
\
AVG
GET
-executionpolicy remotesigned -File "
Powershell.exe
" Content-Type: application/octet-stream
shutdown -s -t 0
kernel32.dll
shell32.dll
dll
"taskkill /f /im "
ProgramData\
CurrentBuild
cmd
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
POST
0123456789
os:
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
"
rundll32
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
<c>
dm:
b66a8ae076
e1
Hkbsse.exe
http://
--
%-lu
.jpg
Kaspersky Lab
2022
DefaultSettings.XResolution

RedLine

(PID) Process(588) redline123123.exe
C2 (1)185.215.113.67:40960
Botnetnewbild
Options
ErrorMessage
Keys
XorOsteogeny
(PID) Process(1604) upd.exe
C2 (1)185.172.128.33:8970
Botnet@LOGSCLOUDYT_BOT
Options
ErrorMessage
Keys
XorLevins
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:06:04 08:24:10+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.24
CodeSize: 320512
InitializedDataSize: 116224
UninitializedDataSize: -
EntryPoint: 0x4c2000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
16
Malicious processes
11
Suspicious processes
0

Behavior graph

Click at the process to see the details
start random.exe #AMADEY axplong.exe wmpnscfg.exe no specs #REDLINE redline123123.exe #REDLINE upd.exe #REDLINE gold.exe lummac2.exe no specs drivermanager.exe no specs msbuild.exe no specs newlatest.exe #AMADEY hkbsse.exe b2c2c1.exe bin.exe #AMADEY hkbsse.exe legs.exe #AMADEY dctooux.exe

Process information

PID
CMD
Path
Indicators
Parent process
284"C:\Users\admin\AppData\Local\Temp\1000035001\gold.exe" C:\Users\admin\AppData\Local\Temp\1000035001\gold.exe
axplong.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\1000035001\gold.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
588"C:\Users\admin\AppData\Local\Temp\1000007001\redline123123.exe" C:\Users\admin\AppData\Local\Temp\1000007001\redline123123.exe
axplong.exe
User:
admin
Integrity Level:
MEDIUM
Description:
XHP
Exit code:
0
Version:
12.9.1.22
Modules
Images
c:\users\admin\appdata\local\temp\1000007001\redline123123.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
RedLine
(PID) Process(588) redline123123.exe
C2 (1)185.215.113.67:40960
Botnetnewbild
Options
ErrorMessage
Keys
XorOsteogeny
992"C:\Users\admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe" C:\Users\admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
NewLatest.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\b66a8ae076\hkbsse.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
Amadey
(PID) Process(992) Hkbsse.exe
C2185.172.128.116
URLhttp://185.172.128.116/Mb3GvQs8/index.php
Version4.30
Options
Drop directoryb66a8ae076
Drop nameHkbsse.exe
Strings (113)Main
cmd /C RMDIR /s/q
/Plugins/
ESET
185.172.128.116
" && timeout 1 && del
&& Exit"
lv:
av:
SOFTWARE\Microsoft\Windows NT\CurrentVersion
st=s
Doctor Web
https://
Norton
Content-Type: application/x-www-form-urlencoded
ProductName
/k
Content-Type: multipart/form-data; boundary=----
?scr=1
cred.dll|clip.dll|
vs:
4.30
<d>
exe
ComputerName
2019
id:
" && ren
ar:
:::
Sophos
sd:
#
Bitdefender
Panda Security
2016
abcdefghijklmnopqrstuvwxyz0123456789-_
-unicode-
Programs
Startup
d1
VideoID
bi:
&&
S-%lu-
Content-Disposition: form-data; name="data"; filename="
rb
Rem
\App
rundll32.exe
SYSTEM\ControlSet001\Services\BasicDisplay\Video
------
\0000
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
=
Avira
%USERPROFILE%
og:
un:
pc:
WinDefender
r=
+++
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
/Mb3GvQs8/index.php
e0
random
|
&unit=
DefaultSettings.YResolution
GetNativeSystemInfo
360TotalSecurity
-%lu
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
ps1
------
Comodo
AVAST Software
wb
\
AVG
GET
-executionpolicy remotesigned -File "
Powershell.exe
" Content-Type: application/octet-stream
shutdown -s -t 0
kernel32.dll
shell32.dll
dll
"taskkill /f /im "
ProgramData\
CurrentBuild
cmd
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
POST
0123456789
os:
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
"
rundll32
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
<c>
dm:
b66a8ae076
e1
Hkbsse.exe
http://
--
%-lu
.jpg
Kaspersky Lab
2022
DefaultSettings.XResolution
1056"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1604"C:\Users\admin\AppData\Local\Temp\1000008001\upd.exe" C:\Users\admin\AppData\Local\Temp\1000008001\upd.exe
axplong.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\1000008001\upd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
RedLine
(PID) Process(1604) upd.exe
C2 (1)185.172.128.33:8970
Botnet@LOGSCLOUDYT_BOT
Options
ErrorMessage
Keys
XorLevins
1888"C:\Users\admin\AppData\Local\Temp\1000003001\b2c2c1.exe" C:\Users\admin\AppData\Local\Temp\1000003001\b2c2c1.exe
Hkbsse.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\1000003001\b2c2c1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msimg32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1928"C:\Users\admin\AppData\Local\Temp\1000063001\drivermanager.exe" C:\Users\admin\AppData\Local\Temp\1000063001\drivermanager.exe—axplong.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WTTLogger_COM_GitEnlistment(sscpbld01)
Exit code:
0
Version:
2.7.3483.0 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\1000063001\drivermanager.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1940"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe—drivermanager.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
0
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2008"C:\Users\admin\AppData\Local\Temp\1000047001\lummac2.exe" C:\Users\admin\AppData\Local\Temp\1000047001\lummac2.exe—axplong.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\1000047001\lummac2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2020"C:\Users\admin\AppData\Local\Temp\1000064001\NewLatest.exe" C:\Users\admin\AppData\Local\Temp\1000064001\NewLatest.exe
axplong.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\1000064001\newlatest.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
Total events
21 680
Read events
21 463
Write events
178
Delete events
39

Modification events

(PID) Process:(3968) random.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3968) random.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3968) random.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3968) random.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2104) axplong.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2104) axplong.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2104) axplong.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2104) axplong.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2104) axplong.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyServer
Value:
(PID) Process:(2104) axplong.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyOverride
Value:
Executable files
32
Suspicious files
4
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
3968random.exeC:\Windows\Tasks\axplong.jobbinary
MD5:AA2E05A705CED4F59452DC83F4C21C6B
SHA256:29741D671B274F7189B31B53CDCE348056284C48C3FDE5506929C6E1D2CD77AD
3968random.exeC:\Users\admin\AppData\Local\Temp\8254624243\axplong.exeexecutable
MD5:77DDB7264BCCD00910D07ADE2F33A90D
SHA256:E2A01FD1E2DC81C6EBFBF79BFB243932CBA16C163DBF48A14DBBEAAA0F151CBD
2104axplong.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\NewLatest[1].exeexecutable
MD5:07101CAC5B9477BA636CD8CA7B9932CB
SHA256:488385CD54D14790B03FA7C7DC997EBEA3F7B2A8499E5927EB437A3791102A77
2020NewLatest.exeC:\Windows\Tasks\Hkbsse.jobbinary
MD5:464396F9979FEC3626362B448978E988
SHA256:D7B46AA535BAFFF7EF85D6874BA2C8094FC071D51915E5F55051FBC2F78004F2
2104axplong.exeC:\Users\admin\AppData\Local\Temp\1000047001\lummac2.exeexecutable
MD5:6E3D83935C7A0810F75DFA9BADC3F199
SHA256:DC4F0A8E3D12C98EAC09A42BD976579CCC1851056D9DE447495E8BE7519760ED
2104axplong.exeC:\Users\admin\AppData\Local\Temp\1000035001\gold.exeexecutable
MD5:70A578F7F58456E475FACD69469CF20A
SHA256:5C8D556E39269B22E63BA9C941FF306BB043BC35125BA08787617577231B381A
2104axplong.exeC:\Users\admin\AppData\Local\Temp\1000064001\NewLatest.exeexecutable
MD5:07101CAC5B9477BA636CD8CA7B9932CB
SHA256:488385CD54D14790B03FA7C7DC997EBEA3F7B2A8499E5927EB437A3791102A77
2104axplong.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\drivermanager[1].exeexecutable
MD5:C28A2D0A008788B49690B333D501E3F3
SHA256:F61712DCCCCF8F19C6DBF0DFB7C7C0BE9EB2F13D3381EE94E4CB6CB70FFB5F5A
2104axplong.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\redline123123[1].exeexecutable
MD5:0EFD5136528869A8EA1A37C5059D706E
SHA256:7C21C1F3063BA963818542036A50F62AC7494AD422E7088897B55C61306EC74E
2104axplong.exeC:\Users\admin\AppData\Local\Temp\1000063001\drivermanager.exeexecutable
MD5:C28A2D0A008788B49690B333D501E3F3
SHA256:F61712DCCCCF8F19C6DBF0DFB7C7C0BE9EB2F13D3381EE94E4CB6CB70FFB5F5A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
45
TCP/UDP connections
24
DNS requests
21
Threats
102

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
axplong.exe
POST
200
77.91.77.81:80
http://77.91.77.81/Kiru9gu/index.php
unknown
—
—
unknown
2104
axplong.exe
GET
200
77.91.77.81:80
http://77.91.77.81/lend/gold.exe
unknown
—
—
unknown
2104
axplong.exe
POST
200
77.91.77.81:80
http://77.91.77.81/Kiru9gu/index.php
unknown
—
—
unknown
2104
axplong.exe
GET
200
77.91.77.81:80
http://77.91.77.81/lend/drivermanager.exe
unknown
—
—
unknown
2104
axplong.exe
POST
200
77.91.77.81:80
http://77.91.77.81/Kiru9gu/index.php
unknown
—
—
unknown
2104
axplong.exe
POST
200
77.91.77.81:80
http://77.91.77.81/Kiru9gu/index.php
unknown
—
—
unknown
2104
axplong.exe
GET
200
77.91.77.81:80
http://77.91.77.81/lend/judit.exe
unknown
—
—
unknown
2104
axplong.exe
POST
200
77.91.77.81:80
http://77.91.77.81/Kiru9gu/index.php
unknown
—
—
unknown
2104
axplong.exe
GET
200
77.91.77.81:80
http://77.91.77.81/lend/upd.exe
unknown
—
—
unknown
2104
axplong.exe
POST
200
77.91.77.81:80
http://77.91.77.81/Kiru9gu/index.php
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
axplong.exe
77.91.77.81:80
—
Foton Telecom CJSC
RU
malicious
588
redline123123.exe
185.215.113.67:40960
—
1337team Limited
SC
malicious
2104
axplong.exe
185.172.128.116:80
—
OOO Nadym Svyaz Service
RU
malicious
992
Hkbsse.exe
185.172.128.116:80
—
OOO Nadym Svyaz Service
RU
malicious
992
Hkbsse.exe
185.172.128.19:80
—
OOO Nadym Svyaz Service
RU
malicious
588
redline123123.exe
49.13.77.253:443
kmsandallapp.ru
Hetzner Online GmbH
DE
unknown
2104
axplong.exe
91.92.240.234:80
o7labs.top
Natskovi & Sie Ltd.
BG
unknown

DNS requests

Domain
IP
Reputation
kmsandallapp.ru
  • 49.13.77.253
malicious
o7labs.top
  • 91.92.240.234
unknown
osdhs.in.ne
  • 49.13.77.253
unknown
jkshb.su
  • 200.63.106.141
  • 190.98.23.157
  • 58.151.148.90
  • 187.152.17.215
  • 187.156.104.208
  • 190.220.21.28
  • 190.224.203.37
  • 211.171.233.129
  • 211.119.84.112
  • 201.119.28.195
malicious
greendag.ru
  • —
unknown
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
2104
axplong.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2104
axplong.exe
Misc activity
ET INFO Packed Executable Download
2104
axplong.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2104
axplong.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
2104
axplong.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2104
axplong.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
2104
axplong.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2104
axplong.exe
A Network Trojan was detected
ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2
2104
axplong.exe
Potentially Bad Traffic
ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
2104
axplong.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
5 ETPRO signatures available at the full report
Process
Message
random.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
axplong.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
random.exe