File name:

random.exe

Full analysis: https://app.any.run/tasks/209daf40-4f12-48d5-82ad-4765ff8ccbcd
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: May 24, 2025, 05:48:07
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-sch
loader
amadey
botnet
stealer
telegram
lumma
xmrig
prysmax
uac
stealc
auto-reg
rdp
evasion
miner
rat
dcrat
remote
darkcrystal
antivm
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

186236B04F93F9EA29EEAC7EF107E1AA

SHA1:

7670F3471A8074BEB50CA8C42B6DB016533C4509

SHA256:

E7F5658761CD69AEB43ED801606E94843644CD3BC824ADD3D6756175F91BD5C5

SSDEEP:

49152:kPPkzemqoSut3Jh4+QQ/btosJwIA4hHmZlKH2Tw/Pq83zw0bCjvk9G661QGtfqXg:OP/mp7t3T4+B/btosJwIA4hHmZlKH2Tk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Script downloads file (POWERSHELL)

      • powershell.exe (PID: 6108)
      • powershell.exe (PID: 7804)
    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 5668)
    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6108)
      • powershell.exe (PID: 7804)
      • powershell.exe (PID: 7924)
      • powershell.exe (PID: 7436)
    • Request from PowerShell that ran from MSHTA.EXE

      • powershell.exe (PID: 6108)
      • powershell.exe (PID: 7804)
    • AMADEY mutex has been found

      • TempJJJGMEHHHO9OP6VIZDXJYHILLEV5I58P.EXE (PID: 7856)
      • TempJJJGMEHHHO9OP6VIZDXJYHILLEV5I58P.EXE (PID: 8148)
      • ramez.exe (PID: 8020)
    • AMADEY has been detected (SURICATA)

      • ramez.exe (PID: 8020)
    • AMADEY has been detected (YARA)

      • ramez.exe (PID: 8020)
    • Connects to the CnC server

      • ramez.exe (PID: 8020)
      • svchost.exe (PID: 2196)
      • cmd.exe (PID: 7624)
      • powershell.exe (PID: 7376)
    • LUMMA mutex has been found

      • MSBuild.exe (PID: 6048)
    • XMRig has been detected

      • oxDU0MW.exe (PID: 4120)
      • WinTemp-v4.exe (PID: 4724)
      • Win-v43.exe (PID: 7408)
      • Win-v42.exe (PID: 7320)
    • Steals credentials from Web Browsers

      • MSBuild.exe (PID: 6048)
      • itdkwtq.exe (PID: 4428)
      • itdkwtq.exe (PID: 7840)
    • Actions looks like stealing of personal data

      • MSBuild.exe (PID: 6048)
      • itdkwtq.exe (PID: 4428)
      • itdkwtq.exe (PID: 7840)
    • Known privilege escalation attack

      • dllhost.exe (PID: 5116)
      • dllhost.exe (PID: 7352)
    • Changes Windows Defender settings

      • WinTemp-v4.exe (PID: 4724)
      • dFM0zy0.exe (PID: 3676)
    • Adds process to the Windows Defender exclusion list

      • WinTemp-v4.exe (PID: 4724)
    • Scans artifacts that could help determine the target

      • itdkwtq.exe (PID: 4428)
      • itdkwtq.exe (PID: 7840)
    • LUMMA has been detected (YARA)

      • MSBuild.exe (PID: 6048)
    • Bypass User Account Control (Modify registry)

      • TGKnlhM.exe (PID: 7516)
    • PRYSMAX mutex has been found

      • TGKnlhM.exe (PID: 7516)
      • TGKnlhM.exe (PID: 6080)
    • Bypass User Account Control (ComputerDefaults)

      • ComputerDefaults.exe (PID: 6656)
    • Changes the autorun value in the registry

      • WinTemp-v4.exe (PID: 4724)
    • Modifies registry (POWERSHELL)

      • powershell.exe (PID: 7172)
    • Starts REAGENTC.EXE to disable the Windows Recovery Environment

      • ReAgentc.exe (PID: 2140)
    • STEALC has been detected

      • MSBuild.exe (PID: 1452)
    • Adds path to the Windows Defender exclusion list

      • dFM0zy0.exe (PID: 3676)
    • Executing a file with an untrusted certificate

      • 1GJEEz3.exe (PID: 8188)
    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)
      • MSBuild.exe (PID: 7196)
    • MINER has been detected (SURICATA)

      • cmd.exe (PID: 7624)
    • DARKCRYSTAL has been detected (SURICATA)

      • powershell.exe (PID: 7376)
    • Suspicious browser debugging (Possible cookie theft)

      • chrome.exe (PID: 8164)
  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • random.exe (PID: 1760)
      • TGKnlhM.exe (PID: 7516)
      • WinTemp-v4.exe (PID: 4724)
      • dFM0zy0.exe (PID: 4628)
      • dFM0zy0.exe (PID: 3676)
      • Idle.exe (PID: 2564)
      • net.exe (PID: 7888)
      • ramez.exe (PID: 8020)
      • cmd.exe (PID: 1056)
    • Executable content was dropped or overwritten

      • powershell.exe (PID: 6108)
      • TempJJJGMEHHHO9OP6VIZDXJYHILLEV5I58P.EXE (PID: 7856)
      • ramez.exe (PID: 8020)
      • oxDU0MW.exe (PID: 4120)
      • itdkwtq.exe (PID: 4428)
      • WinTemp-v4.exe (PID: 4724)
      • dFM0zy0.exe (PID: 4628)
      • TGKnlhM.exe (PID: 7516)
      • dFM0zy0.exe (PID: 3676)
      • Idle.exe (PID: 2564)
      • 4iIxuqz.exe (PID: 5084)
      • powershell.exe (PID: 7376)
      • powershell.exe (PID: 7436)
      • 25c81835.exe (PID: 8012)
    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 2140)
      • mshta.exe (PID: 7708)
      • WinTemp-v4.exe (PID: 4724)
      • itdkwtq.exe (PID: 4428)
      • TGKnlhM.exe (PID: 7516)
      • dFM0zy0.exe (PID: 3676)
      • cmd.exe (PID: 7820)
      • 4iIxuqz.exe (PID: 5084)
      • cmd.exe (PID: 4528)
    • Manipulates environment variables

      • powershell.exe (PID: 6108)
      • powershell.exe (PID: 7804)
    • Probably download files using WebClient

      • mshta.exe (PID: 2140)
      • mshta.exe (PID: 7708)
      • cmd.exe (PID: 4528)
    • Starts process via Powershell

      • powershell.exe (PID: 6108)
      • powershell.exe (PID: 7804)
    • Found IP address in command line

      • powershell.exe (PID: 6108)
      • powershell.exe (PID: 7804)
    • Potential Corporate Privacy Violation

      • powershell.exe (PID: 6108)
      • powershell.exe (PID: 7804)
      • ramez.exe (PID: 8020)
      • cmd.exe (PID: 7624)
    • Process requests binary or script from the Internet

      • powershell.exe (PID: 6108)
      • ramez.exe (PID: 8020)
      • powershell.exe (PID: 7804)
    • Connects to the server without a host name

      • powershell.exe (PID: 6108)
      • powershell.exe (PID: 7804)
      • ramez.exe (PID: 8020)
      • MSBuild.exe (PID: 1452)
      • net.exe (PID: 7888)
      • MSBuild.exe (PID: 2064)
      • powershell.exe (PID: 7376)
    • Reads security settings of Internet Explorer

      • TempJJJGMEHHHO9OP6VIZDXJYHILLEV5I58P.EXE (PID: 7856)
      • ramez.exe (PID: 8020)
      • MSBuild.exe (PID: 1452)
    • Contacting a server suspected of hosting an CnC

      • ramez.exe (PID: 8020)
      • svchost.exe (PID: 2196)
      • MSBuild.exe (PID: 7196)
    • Starts itself from another location

      • TempJJJGMEHHHO9OP6VIZDXJYHILLEV5I58P.EXE (PID: 7856)
    • There is functionality for taking screenshot (YARA)

      • ramez.exe (PID: 8020)
      • MSBuild.exe (PID: 6048)
    • There is functionality for enable RDP (YARA)

      • ramez.exe (PID: 8020)
    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • MSBuild.exe (PID: 6048)
    • Connects to unusual port

      • itdkwtq.exe (PID: 4428)
      • itdkwtq.exe (PID: 7840)
      • WinTemp-v4.exe (PID: 4724)
      • 4iIxuqz.exe (PID: 5084)
      • cmd.exe (PID: 7624)
    • Script adds exclusion process to Windows Defender

      • WinTemp-v4.exe (PID: 4724)
    • Searches for installed software

      • MSBuild.exe (PID: 6048)
    • Script adds exclusion path to Windows Defender

      • WinTemp-v4.exe (PID: 4724)
      • dFM0zy0.exe (PID: 3676)
    • Changes default file association

      • TGKnlhM.exe (PID: 7516)
    • Creates new registry property (POWERSHELL)

      • powershell.exe (PID: 7172)
      • powershell.exe (PID: 6728)
    • Reads the BIOS version

      • 30152dcba5.exe (PID: 5392)
    • There is functionality for VM detection VirtualBox (YARA)

      • WinTemp-v4.exe (PID: 4724)
    • There is functionality for VM detection VMWare (YARA)

      • WinTemp-v4.exe (PID: 4724)
    • Takes ownership (TAKEOWN.EXE)

      • cmd.exe (PID: 4068)
    • Executes application which crashes

      • Win-v42.exe (PID: 7320)
      • Win-v43.exe (PID: 7408)
      • Win-v41.exe (PID: 7944)
      • 25c81835.exe (PID: 8012)
    • Uses ATTRIB.EXE to modify file attributes

      • TGKnlhM.exe (PID: 7516)
    • Get information on the list of running processes

      • TGKnlhM.exe (PID: 7516)
    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 7960)
      • cmd.exe (PID: 6080)
    • Probably obfuscated PowerShell command line is found

      • TGKnlhM.exe (PID: 7516)
      • cmd.exe (PID: 7820)
    • Checks for external IP

      • svchost.exe (PID: 2196)
      • WinTemp-v4.exe (PID: 4724)
    • Hides command output

      • cmd.exe (PID: 3020)
    • Uses TASKKILL.EXE to kill Browsers

      • TGKnlhM.exe (PID: 7516)
    • Executed via WMI

      • schtasks.exe (PID: 7928)
      • schtasks.exe (PID: 6344)
      • schtasks.exe (PID: 4200)
      • schtasks.exe (PID: 6388)
      • schtasks.exe (PID: 7204)
      • schtasks.exe (PID: 6404)
      • schtasks.exe (PID: 1616)
      • schtasks.exe (PID: 6744)
      • schtasks.exe (PID: 3032)
      • schtasks.exe (PID: 4784)
      • schtasks.exe (PID: 4164)
      • schtasks.exe (PID: 7904)
      • schtasks.exe (PID: 3888)
      • schtasks.exe (PID: 7520)
      • schtasks.exe (PID: 7324)
    • Uses TASKKILL.EXE to kill process

      • TGKnlhM.exe (PID: 7516)
    • Uses powercfg.exe to modify the power settings

      • WinTemp-v4.exe (PID: 4724)
    • The executable file from the user directory is run by the CMD process

      • dFM0zy0.exe (PID: 3676)
      • Idle.exe (PID: 7700)
    • The process executes via Task Scheduler

      • ramez.exe (PID: 1056)
      • ramez.exe (PID: 4696)
    • Executing commands from a ".bat" file

      • dFM0zy0.exe (PID: 3676)
    • Starts application with an unusual extension

      • cmd.exe (PID: 6044)
    • Process drops legitimate windows executable

      • ramez.exe (PID: 8020)
    • Starts a Microsoft application from unusual location

      • Pd1GfFT.exe (PID: 672)
    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 6044)
    • Invokes assembly entry point (POWERSHELL)

      • powershell.exe (PID: 4040)
    • Executing commands from ".cmd" file

      • ramez.exe (PID: 8020)
      • cmd.exe (PID: 1056)
    • Application launched itself

      • cmd.exe (PID: 1056)
    • Executes as Windows Service

      • cmd.exe (PID: 7820)
    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 4528)
    • Hides errors and continues executing the command without stopping

      • powershell.exe (PID: 1168)
    • The process hides Powershell's copyright startup banner

      • cmd.exe (PID: 4528)
    • Returns all items found within a container (POWERSHELL)

      • powershell.exe (PID: 1168)
    • Drops a system driver (possible attempt to evade defenses)

      • 25c81835.exe (PID: 8012)
  • INFO

    • Reads mouse settings

      • random.exe (PID: 1760)
    • The sample compiled with english language support

      • random.exe (PID: 1760)
      • ramez.exe (PID: 8020)
      • TGKnlhM.exe (PID: 7516)
      • powershell.exe (PID: 7436)
      • 25c81835.exe (PID: 8012)
    • Create files in a temporary directory

      • random.exe (PID: 1760)
      • TempJJJGMEHHHO9OP6VIZDXJYHILLEV5I58P.EXE (PID: 7856)
      • ramez.exe (PID: 8020)
      • oxDU0MW.exe (PID: 4120)
    • Reads the computer name

      • random.exe (PID: 1760)
      • TempJJJGMEHHHO9OP6VIZDXJYHILLEV5I58P.EXE (PID: 7856)
      • ramez.exe (PID: 8020)
      • itdkwtq.exe (PID: 4428)
      • MSBuild.exe (PID: 6048)
      • oxDU0MW.exe (PID: 4120)
      • TGKnlhM.exe (PID: 7516)
      • itdkwtq.exe (PID: 7840)
      • TGKnlhM.exe (PID: 6080)
      • MSBuild.exe (PID: 1452)
      • 30152dcba5.exe (PID: 5392)
    • Checks supported languages

      • random.exe (PID: 1760)
      • TempJJJGMEHHHO9OP6VIZDXJYHILLEV5I58P.EXE (PID: 7856)
      • TempJJJGMEHHHO9OP6VIZDXJYHILLEV5I58P.EXE (PID: 8148)
      • ramez.exe (PID: 8020)
      • 1GJEEz3.exe (PID: 8188)
      • itdkwtq.exe (PID: 4428)
      • MSBuild.exe (PID: 6048)
      • oxDU0MW.exe (PID: 4120)
      • WinTemp-v4.exe (PID: 4724)
      • TGKnlhM.exe (PID: 7516)
      • fPbjy1Q.exe (PID: 7932)
      • itdkwtq.exe (PID: 7840)
      • TGKnlhM.exe (PID: 6080)
      • 30152dcba5.exe (PID: 5392)
      • MSBuild.exe (PID: 1452)
      • Win-v43.exe (PID: 7408)
      • Win-v42.exe (PID: 7320)
    • Reads Internet Explorer settings

      • mshta.exe (PID: 2140)
      • mshta.exe (PID: 7708)
    • Auto-launch of the file from Task Scheduler

      • cmd.exe (PID: 5668)
    • Disables trace logs

      • powershell.exe (PID: 6108)
      • powershell.exe (PID: 7804)
    • Checks proxy server information

      • powershell.exe (PID: 6108)
      • ramez.exe (PID: 8020)
      • powershell.exe (PID: 7804)
      • MSBuild.exe (PID: 1452)
    • Manual execution by a user

      • mshta.exe (PID: 7708)
      • itdkwtq.exe (PID: 7840)
      • Win-v42.exe (PID: 7320)
      • Win-v43.exe (PID: 7408)
      • dllhost.exe (PID: 1616)
      • powershell.exe (PID: 864)
      • Idle.exe (PID: 2564)
    • The executable file from the user directory is run by the Powershell process

      • TempJJJGMEHHHO9OP6VIZDXJYHILLEV5I58P.EXE (PID: 7856)
      • TempJJJGMEHHHO9OP6VIZDXJYHILLEV5I58P.EXE (PID: 8148)
    • Process checks computer location settings

      • TempJJJGMEHHHO9OP6VIZDXJYHILLEV5I58P.EXE (PID: 7856)
      • ramez.exe (PID: 8020)
    • Creates files or folders in the user directory

      • ramez.exe (PID: 8020)
      • itdkwtq.exe (PID: 4428)
      • WinTemp-v4.exe (PID: 4724)
    • Reads Environment values

      • itdkwtq.exe (PID: 4428)
      • itdkwtq.exe (PID: 7840)
    • Checks transactions between databases Windows and Oracle

      • oxDU0MW.exe (PID: 4120)
    • Reads the machine GUID from the registry

      • oxDU0MW.exe (PID: 4120)
      • itdkwtq.exe (PID: 4428)
      • itdkwtq.exe (PID: 7840)
      • 30152dcba5.exe (PID: 5392)
    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 5116)
      • ComputerDefaults.exe (PID: 6656)
    • Reads the software policy settings

      • MSBuild.exe (PID: 6048)
    • Reads Microsoft Office registry keys

      • itdkwtq.exe (PID: 4428)
      • itdkwtq.exe (PID: 7840)
    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 5244)
      • powershell.exe (PID: 7572)
      • powershell.exe (PID: 8088)
    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 5244)
      • powershell.exe (PID: 7572)
      • powershell.exe (PID: 7172)
      • powershell.exe (PID: 8088)
    • Uses Task Scheduler to autorun other applications (AUTOMATE)

      • WinTemp-v4.exe (PID: 4724)
    • Auto-launch of the file from Registry key

      • WinTemp-v4.exe (PID: 4724)
    • Changes the display of characters in the console

      • cmd.exe (PID: 6044)
    • Application launched itself

      • chrome.exe (PID: 8164)
    • Returns hidden items found within a container (POWERSHELL)

      • conhost.exe (PID: 5392)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(8020) ramez.exe
C2185.156.72.96
URLhttp://185.156.72.96/te4h2nus/index.php
Version5.34
Options
Drop directoryd610cf342e
Drop nameramez.exe
Strings (125)lv:
msi
Kaspersky Lab
av:
|
#
"
\App
00000422
dm:
Powershell.exe
ProgramData\
ps1
rundll32
http://
Content-Disposition: form-data; name="data"; filename="
SOFTWARE\Microsoft\Windows NT\CurrentVersion
dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
id:
VideoID
cred.dll|clip.dll|
0000043f
cmd
00000423
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
-executionpolicy remotesigned -File "
2022
------
2016
og:
\0000
CurrentBuild
2019
:::
S-%lu-
" && timeout 1 && del
ProductName
Panda Security
ESET
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
/k
+++
?scr=1
Doctor Web
GET
SYSTEM\ControlSet001\Services\BasicDisplay\Video
/quiet
.jpg
d610cf342e
vs:
sd:
rundll32.exe
"taskkill /f /im "
pc:
random
=
360TotalSecurity
<d>
wb
Content-Type: multipart/form-data; boundary=----
Startup
Norton
&& Exit"
os:
https://
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
2025
Avira
%-lu
zip
POST
" Content-Type: application/octet-stream
Rem
/te4h2nus/index.php
------
5.34
<c>
clip.dll
AVAST Software
\
shell32.dll
" && ren
e3
ramez.exe
kernel32.dll
DefaultSettings.XResolution
d1
DefaultSettings.YResolution
185.156.72.96
r=
cred.dll
--
GetNativeSystemInfo
-%lu
ComputerName
&unit=
Keyboard Layout\Preload
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
ar:
Sophos
%USERPROFILE%
exe
e1
e2
st=s
Programs
0123456789
un:
rb
bi:
abcdefghijklmnopqrstuvwxyz0123456789-_
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
cmd /C RMDIR /s/q
Bitdefender
-unicode-
AVG
WinDefender
&&
shutdown -s -t 0
Comodo
00000419
Content-Type: application/x-www-form-urlencoded
/Plugins/
Main

Lumma

(PID) Process(6048) MSBuild.exe
C2 (10)escczlv.top/bufi
ordntx.top/pxla
korxddl.top/qidz
https://t.me/gagsdgfh24
localixbiw.top/zlpa
bogtkr.top/zhyk
diecam.top/laur
citellcagt.top/gjtu
narrathfpt.top/tekq
gofzm.digital/apx
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:11 21:26:31+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 633856
InitializedDataSize: 326144
UninitializedDataSize: -
EntryPoint: 0x20577
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
435
Monitored processes
284
Malicious processes
33
Suspicious processes
9

Behavior graph

Click at the process to see the details
start random.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs schtasks.exe no specs powershell.exe conhost.exe no specs sppextcomobj.exe no specs slui.exe mshta.exe no specs powershell.exe conhost.exe no specs tempjjjgmehhho9op6vizdxjyhillev5i58p.exe #AMADEY ramez.exe tempjjjgmehhho9op6vizdxjyhillev5i58p.exe no specs 1gjeez3.exe no specs conhost.exe no specs #LUMMA msbuild.exe itdkwtq.exe #XMRIG oxdu0mw.exe CMSTPLUA #XMRIG wintemp-v4.exe powershell.exe no specs conhost.exe no specs #PRYSMAX tgknlhm.exe powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs computerdefaults.exe no specs powershell.exe no specs conhost.exe no specs computerdefaults.exe no specs computerdefaults.exe powershell.exe no specs conhost.exe no specs #PRYSMAX tgknlhm.exe no specs fpbjy1q.exe no specs conhost.exe no specs itdkwtq.exe schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reagentc.exe no specs #STEALC msbuild.exe 30152dcba5.exe no specs #XMRIG win-v43.exe #XMRIG win-v42.exe werfault.exe no specs CMSTPLUA werfault.exe no specs attrib.exe no specs conhost.exe no specs dfm0zy0.exe 30152dcba5.exe no specs tasklist.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs takeown.exe no specs cmd.exe no specs vaultcmd.exe no specs conhost.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs cmdkey.exe no specs tasklist.exe no specs tasklist.exe no specs icacls.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powershell.exe no specs powercfg.exe no specs conhost.exe no specs cmd.exe conhost.exe no specs powercfg.exe no specs conhost.exe no specs dfm0zy0.exe powercfg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs ping.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs 08iyoof.exe no specs conhost.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs ramez.exe no specs cmd.exe no specs conhost.exe no specs msbuild.exe no specs msbuild.exe no specs msbuild.exe no specs #LUMMA msbuild.exe chcp.com no specs dllhost.exe no specs idle.exe powershell.exe no specs 4iixuqz.exe ping.exe no specs #LUMMA svchost.exe cmd.exe conhost.exe no specs taskkill.exe no specs idle.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs pd1gfft.exe no specs taskkill.exe no specs conhost.exe no specs net.exe taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs cmdkey.exe no specs tasklist.exe no specs conhost.exe no specs certutil.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs certutil.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs tasklist.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs #MINER cmd.exe taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs tix1nl9.exe no specs conhost.exe no specs #DARKCRYSTAL powershell.exe svchost.exe no specs cmd.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs msbuild.exe slui.exe no specs cmd.exe taskkill.exe no specs conhost.exe no specs cmd.exe no specs win-v41.exe no specs powershell.exe werfault.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs powershell.exe tasklist.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs ramez.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs 25c81835.exe werfault.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208"powershell" -Command "Get-VpnConnection | ConvertTo-Json"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeTGKnlhM.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
632"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless --use-angle=swiftshader-webgl --headless --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1456 --field-trial-handle=1464,i,7571025672273460013,9041740974894749312,262144 --disable-features=PaintHolding --variations-seed-version /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
664\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exetaskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
668\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exetaskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
672"C:\Users\admin\AppData\Local\Temp\10191580101\Pd1GfFT.exe" C:\Users\admin\AppData\Local\Temp\10191580101\Pd1GfFT.exeramez.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Voice access
Exit code:
0
Version:
10.0.22621.1635 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\10191580101\pd1gfft.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
680\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exepowercfg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
684\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exetasklist.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
732"taskkill" /F /IM epic.exeC:\Windows\System32\taskkill.exeTGKnlhM.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
736icacls "C:\WINDOWS\System32\reagentc.exe" /grant Administrators:FC:\Windows\System32\icacls.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
856"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe08IyOOF.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
127 056
Read events
126 864
Write events
125
Delete events
67

Modification events

(PID) Process:(2140) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2140) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2140) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6108) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6108) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6108) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6108) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6108) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6108) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6108) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
66
Suspicious files
80
Text files
143
Unknown types
0

Dropped files

PID
Process
Filename
Type
6108powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_xrrno5bt.rzr.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6108powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_yqkzkj2x.3hn.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7804powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_v5232doa.cqn.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7804powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_xrh4ixrm.p5q.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
8020ramez.exeC:\Users\admin\AppData\Local\Temp\10191490101\1GJEEz3.exeexecutable
MD5:9A0F4D0454564E92C202FC8721B13ADB
SHA256:32A2C5F1DC3F9F06AD456FF2C95DD32BACFAC2B71EA88A04A4FEBA203F1CC77A
8020ramez.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\1GJEEz3[1].exeexecutable
MD5:9A0F4D0454564E92C202FC8721B13ADB
SHA256:32A2C5F1DC3F9F06AD456FF2C95DD32BACFAC2B71EA88A04A4FEBA203F1CC77A
7856TempJJJGMEHHHO9OP6VIZDXJYHILLEV5I58P.EXEC:\Windows\Tasks\ramez.jobbinary
MD5:08CFA05387C631BF9A0B82B5A4FD1CE5
SHA256:5806A5497AED25B138155296C2B93598D97D2F2440311B996F3BA8435413AFB0
6108powershell.exeC:\Users\admin\AppData\Local\TempJJJGMEHHHO9OP6VIZDXJYHILLEV5I58P.EXEexecutable
MD5:26CC5A6CFD8E8ECC433337413C14CDDB
SHA256:2D904D576B46236BAF504DBA21775F6EBBBD0F65272A9C2FCA1C6798184FA4E8
7856TempJJJGMEHHHO9OP6VIZDXJYHILLEV5I58P.EXEC:\Users\admin\AppData\Local\Temp\d610cf342e\ramez.exeexecutable
MD5:26CC5A6CFD8E8ECC433337413C14CDDB
SHA256:2D904D576B46236BAF504DBA21775F6EBBBD0F65272A9C2FCA1C6798184FA4E8
8020ramez.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\itdkwtq[1].exeexecutable
MD5:CF5795934C458278611AF9B94F0F7D39
SHA256:8A00568B5157CC8FFAD2D3CAB029DA7E93453ED806CFBBD23738402739DBA703
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
189
TCP/UDP connections
104
DNS requests
33
Threats
44

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
6108
powershell.exe
GET
200
185.156.72.121:80
http://185.156.72.121/testmine/random.exe
unknown
unknown
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
7804
powershell.exe
GET
200
185.156.72.121:80
http://185.156.72.121/testmine/random.exe
unknown
unknown
8020
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
unknown
8020
ramez.exe
GET
200
185.156.72.2:80
http://185.156.72.2/files/5494432675/1GJEEz3.exe
unknown
malicious
8020
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
unknown
8020
ramez.exe
GET
200
185.156.72.2:80
http://185.156.72.2/files/5373782173/itdkwtq.exe
unknown
malicious
8020
ramez.exe
POST
200
185.156.72.96:80
http://185.156.72.96/te4h2nus/index.php
unknown
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6108
powershell.exe
185.156.72.121:80
Tov Vaiz Partner
RU
unknown
6544
svchost.exe
20.190.160.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.185.142
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.128
  • 40.126.32.133
  • 40.126.32.72
  • 40.126.32.74
  • 40.126.32.68
  • 20.190.160.130
  • 40.126.32.136
  • 20.190.160.65
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
t.me
  • 149.154.167.99
whitelisted
gofzm.digital
  • 172.67.158.39
  • 104.21.14.69
unknown
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted

Threats

PID
Process
Class
Message
6108
powershell.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
6108
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
6108
powershell.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
6108
powershell.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
6108
powershell.exe
Misc activity
ET INFO Packed Executable Download
8020
ramez.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
7804
powershell.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7804
powershell.exe
Misc activity
ET INFO Packed Executable Download
7804
powershell.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7804
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
No debug info