File name:

e8858826028984242479e4e2eeab90d6a3ffdd40288a3953782868ada5a98ecb.exe

Full analysis: https://app.any.run/tasks/ab3c213d-dc95-4c89-b1cc-08e6fee13fbb
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: October 28, 2024, 03:40:19
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
amadey
botnet
stealer
loader
themida
stealc
lumma
exfiltration
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

4D8BD3F87147A589146495B1CBA8951F

SHA1:

2FBD579D144FA35AAE1D7B416FFF617E1A0832E1

SHA256:

E8858826028984242479E4E2EEAB90D6A3FFDD40288A3953782868ADA5A98ECB

SSDEEP:

98304:AFefYt2NcdJCE8ebDvD1+vUOXWsukzuoS2qF7vX46cqi4aaWylg0tUM6q7bHnMk6:MjcqxdWr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • AMADEY has been detected (YARA)

      • axplong.exe (PID: 6772)
    • Connects to the CnC server

      • axplong.exe (PID: 6772)
      • f0606cd2f3.exe (PID: 7148)
    • AMADEY has been detected (SURICATA)

      • axplong.exe (PID: 6772)
    • LUMMA has been detected (YARA)

      • 08129255dc.exe (PID: 1572)
    • STEALC has been detected (SURICATA)

      • f0606cd2f3.exe (PID: 7148)
  • SUSPICIOUS

    • Reads the BIOS version

      • e8858826028984242479e4e2eeab90d6a3ffdd40288a3953782868ada5a98ecb.exe (PID: 6368)
      • axplong.exe (PID: 6772)
    • Reads security settings of Internet Explorer

      • e8858826028984242479e4e2eeab90d6a3ffdd40288a3953782868ada5a98ecb.exe (PID: 6368)
    • Executable content was dropped or overwritten

      • e8858826028984242479e4e2eeab90d6a3ffdd40288a3953782868ada5a98ecb.exe (PID: 6368)
      • axplong.exe (PID: 6772)
      • 08129255dc.exe (PID: 1572)
    • Contacting a server suspected of hosting an CnC

      • axplong.exe (PID: 6772)
      • f0606cd2f3.exe (PID: 7148)
    • Potential Corporate Privacy Violation

      • axplong.exe (PID: 6772)
      • 08129255dc.exe (PID: 1572)
    • Starts itself from another location

      • e8858826028984242479e4e2eeab90d6a3ffdd40288a3953782868ada5a98ecb.exe (PID: 6368)
    • Connects to the server without a host name

      • axplong.exe (PID: 6772)
      • f0606cd2f3.exe (PID: 7148)
      • 08129255dc.exe (PID: 1572)
    • Process requests binary or script from the Internet

      • axplong.exe (PID: 6772)
      • 08129255dc.exe (PID: 1572)
    • The process executes via Task Scheduler

      • axplong.exe (PID: 5584)
      • axplong.exe (PID: 7152)
      • axplong.exe (PID: 5064)
  • INFO

    • Reads the computer name

      • e8858826028984242479e4e2eeab90d6a3ffdd40288a3953782868ada5a98ecb.exe (PID: 6368)
    • Checks supported languages

      • e8858826028984242479e4e2eeab90d6a3ffdd40288a3953782868ada5a98ecb.exe (PID: 6368)
      • axplong.exe (PID: 6772)
    • The process uses the downloaded file

      • e8858826028984242479e4e2eeab90d6a3ffdd40288a3953782868ada5a98ecb.exe (PID: 6368)
    • Sends debugging messages

      • axplong.exe (PID: 6772)
      • e8858826028984242479e4e2eeab90d6a3ffdd40288a3953782868ada5a98ecb.exe (PID: 6368)
    • Process checks computer location settings

      • e8858826028984242479e4e2eeab90d6a3ffdd40288a3953782868ada5a98ecb.exe (PID: 6368)
    • Themida protector has been detected

      • axplong.exe (PID: 6772)
      • 08129255dc.exe (PID: 1572)
    • Create files in a temporary directory

      • e8858826028984242479e4e2eeab90d6a3ffdd40288a3953782868ada5a98ecb.exe (PID: 6368)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(6772) axplong.exe
C2185.215.113.16
URLhttp://185.215.113.16/Jo89Ku7d/index.php
Version4.41
Options
Drop directory44111dbc49
Drop nameaxplong.exe
Strings (119)Kaspersky Lab
ProductName
------
POST
ESET
random
bi:
S-%lu-
Doctor Web
GET
Bitdefender
-unicode-
#
/Jo89Ku7d/index.php
ar:
/Plugins/
cred.dll
VideoID
/quiet
wb
&&
Powershell.exe
"
\
cmd /C RMDIR /s/q
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
un:
cred.dll|clip.dll|
e2
Programs
msi
av:
r=
DefaultSettings.YResolution
AVG
dm:
rb
Panda Security
" && timeout 1 && del
e0
Main
zip
SOFTWARE\Microsoft\Windows NT\CurrentVersion
%-lu
Norton
Comodo
e1
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
2016
CurrentBuild
Sophos
<d>
ComputerName
pc:
GetNativeSystemInfo
44111dbc49
abcdefghijklmnopqrstuvwxyz0123456789-_
d1
lv:
AVAST Software
:::
axplong.exe
Rem
exe
|
vs:
--
https://
WinDefender
st=s
&unit=
Startup
=
kernel32.dll
ProgramData\
rundll32.exe
id:
sd:
" && ren
/k
.jpg
+++
-executionpolicy remotesigned -File "
"taskkill /f /im "
cmd
?scr=1
360TotalSecurity
0123456789
dll
shell32.dll
Content-Type: multipart/form-data; boundary=----
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Content-Disposition: form-data; name="data"; filename="
-%lu
------
\0000
ps1
Avira
clip.dll
2019
&& Exit"
rundll32
SYSTEM\ControlSet001\Services\BasicDisplay\Video
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
\App
http://
%USERPROFILE%
4.41
shutdown -s -t 0
" Content-Type: application/octet-stream
Content-Type: application/x-www-form-urlencoded
185.215.113.16
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
og:
<c>
DefaultSettings.XResolution
os:
2022
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:25 12:10:38+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.24
CodeSize: 321024
InitializedDataSize: 117248
UninitializedDataSize: -
EntryPoint: 0x4bb000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
8
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start e8858826028984242479e4e2eeab90d6a3ffdd40288a3953782868ada5a98ecb.exe THREAT axplong.exe #STEALC f0606cd2f3.exe THREAT 08129255dc.exe axplong.exe axplong.exe azif7nzmd9zdg5akita.exe axplong.exe

Process information

PID
CMD
Path
Indicators
Parent process
1572"C:\Users\admin\AppData\Local\Temp\1000993001\08129255dc.exe" C:\Users\admin\AppData\Local\Temp\1000993001\08129255dc.exe
axplong.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\1000993001\08129255dc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4816"C:\Users\admin\AppData\Local\Temp\AZIF7NZMD9ZDG5AKITA.exe"C:\Users\admin\AppData\Local\Temp\AZIF7NZMD9ZDG5AKITA.exe
08129255dc.exe
User:
admin
Integrity Level:
MEDIUM
Description:
defOff
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\azif7nzmd9zdg5akita.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5064"C:\Users\admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\admin\AppData\Local\Temp\44111dbc49\axplong.exe
svchost.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\44111dbc49\axplong.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
5584"C:\Users\admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\admin\AppData\Local\Temp\44111dbc49\axplong.exe
svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\44111dbc49\axplong.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
6368"C:\Users\admin\Desktop\e8858826028984242479e4e2eeab90d6a3ffdd40288a3953782868ada5a98ecb.exe" C:\Users\admin\Desktop\e8858826028984242479e4e2eeab90d6a3ffdd40288a3953782868ada5a98ecb.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\e8858826028984242479e4e2eeab90d6a3ffdd40288a3953782868ada5a98ecb.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6772"C:\Users\admin\AppData\Local\Temp\44111dbc49\axplong.exe" C:\Users\admin\AppData\Local\Temp\44111dbc49\axplong.exe
e8858826028984242479e4e2eeab90d6a3ffdd40288a3953782868ada5a98ecb.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\44111dbc49\axplong.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Amadey
(PID) Process(6772) axplong.exe
C2185.215.113.16
URLhttp://185.215.113.16/Jo89Ku7d/index.php
Version4.41
Options
Drop directory44111dbc49
Drop nameaxplong.exe
Strings (119)Kaspersky Lab
ProductName
------
POST
ESET
random
bi:
S-%lu-
Doctor Web
GET
Bitdefender
-unicode-
#
/Jo89Ku7d/index.php
ar:
/Plugins/
cred.dll
VideoID
/quiet
wb
&&
Powershell.exe
"
\
cmd /C RMDIR /s/q
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
un:
cred.dll|clip.dll|
e2
Programs
msi
av:
r=
DefaultSettings.YResolution
AVG
dm:
rb
Panda Security
" && timeout 1 && del
e0
Main
zip
SOFTWARE\Microsoft\Windows NT\CurrentVersion
%-lu
Norton
Comodo
e1
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
2016
CurrentBuild
Sophos
<d>
ComputerName
pc:
GetNativeSystemInfo
44111dbc49
abcdefghijklmnopqrstuvwxyz0123456789-_
d1
lv:
AVAST Software
:::
axplong.exe
Rem
exe
|
vs:
--
https://
WinDefender
st=s
&unit=
Startup
=
kernel32.dll
ProgramData\
rundll32.exe
id:
sd:
" && ren
/k
.jpg
+++
-executionpolicy remotesigned -File "
"taskkill /f /im "
cmd
?scr=1
360TotalSecurity
0123456789
dll
shell32.dll
Content-Type: multipart/form-data; boundary=----
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Content-Disposition: form-data; name="data"; filename="
-%lu
------
\0000
ps1
Avira
clip.dll
2019
&& Exit"
rundll32
SYSTEM\ControlSet001\Services\BasicDisplay\Video
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
\App
http://
%USERPROFILE%
4.41
shutdown -s -t 0
" Content-Type: application/octet-stream
Content-Type: application/x-www-form-urlencoded
185.215.113.16
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
og:
<c>
DefaultSettings.XResolution
os:
2022
7148"C:\Users\admin\AppData\Local\Temp\1000992001\f0606cd2f3.exe" C:\Users\admin\AppData\Local\Temp\1000992001\f0606cd2f3.exe
axplong.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\1000992001\f0606cd2f3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7152"C:\Users\admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\admin\AppData\Local\Temp\44111dbc49\axplong.exe
svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\44111dbc49\axplong.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
Total events
4 684
Read events
4 676
Write events
8
Delete events
0

Modification events

(PID) Process:(6772) axplong.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6772) axplong.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6772) axplong.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6772) axplong.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:f0606cd2f3.exe
Value:
C:\Users\admin\AppData\Local\Temp\1000992001\f0606cd2f3.exe
(PID) Process:(7148) f0606cd2f3.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7148) f0606cd2f3.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7148) f0606cd2f3.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6772) axplong.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:08129255dc.exe
Value:
C:\Users\admin\AppData\Local\Temp\1000993001\08129255dc.exe
Executable files
6
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6368e8858826028984242479e4e2eeab90d6a3ffdd40288a3953782868ada5a98ecb.exeC:\Users\admin\AppData\Local\Temp\44111dbc49\axplong.exeexecutable
MD5:4D8BD3F87147A589146495B1CBA8951F
SHA256:E8858826028984242479E4E2EEAB90D6A3FFDD40288A3953782868ADA5A98ECB
6772axplong.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\random[1].exeexecutable
MD5:24AB903B7276338CDA60E57C72552519
SHA256:D461B32B71AE3AD4D6F51C5907ACCAC1E41CC0C5FD585B7FC3EC70EB15916146
6772axplong.exeC:\Users\admin\AppData\Local\Temp\1000992001\f0606cd2f3.exeexecutable
MD5:24AB903B7276338CDA60E57C72552519
SHA256:D461B32B71AE3AD4D6F51C5907ACCAC1E41CC0C5FD585B7FC3EC70EB15916146
6772axplong.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\random[1].exeexecutable
MD5:558D65B3588761CA41784D41ECB554A2
SHA256:97D4F31B2C8D21DE54B6FA9E9D66A622B3227E131EE2D5D3C955A9B5647EA4A1
6772axplong.exeC:\Users\admin\AppData\Local\Temp\1000993001\08129255dc.exeexecutable
MD5:558D65B3588761CA41784D41ECB554A2
SHA256:97D4F31B2C8D21DE54B6FA9E9D66A622B3227E131EE2D5D3C955A9B5647EA4A1
157208129255dc.exeC:\Users\admin\AppData\Local\Temp\AZIF7NZMD9ZDG5AKITA.exeexecutable
MD5:912530348F40281F6E25C8EA61EF2574
SHA256:34EB474471CA930C01E65FEEF8190E177EAB3908A1A585AE58FD9ACFDF0B03D9
6368e8858826028984242479e4e2eeab90d6a3ffdd40288a3953782868ada5a98ecb.exeC:\Windows\Tasks\axplong.jobbinary
MD5:FDB2B409B4CB385AE5004AAA5ABB9687
SHA256:863A28DC79C4D45DDC93163C6ACE84C793F85F52A931770FEE5584406604B38C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
22
TCP/UDP connections
31
DNS requests
9
Threats
29

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5488
MoUsoCoreWorker.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
7044
RUXIMICS.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
6944
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
7044
RUXIMICS.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
6772
axplong.exe
POST
200
185.215.113.16:80
http://185.215.113.16/Jo89Ku7d/index.php
unknown
malicious
6772
axplong.exe
POST
200
185.215.113.16:80
http://185.215.113.16/Jo89Ku7d/index.php
unknown
malicious
7148
f0606cd2f3.exe
GET
200
185.215.113.206:80
http://185.215.113.206/
unknown
malicious
6772
axplong.exe
POST
200
185.215.113.16:80
http://185.215.113.16/Jo89Ku7d/index.php
unknown
malicious
6772
axplong.exe
GET
200
185.215.113.16:80
http://185.215.113.16/steam/random.exe
unknown
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6944
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
whitelisted
104.126.37.123:443
www.bing.com
Akamai International B.V.
DE
whitelisted
7044
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5488
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
5488
MoUsoCoreWorker.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
7044
RUXIMICS.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5488
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6944
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
www.bing.com
  • 104.126.37.123
  • 104.126.37.171
  • 104.126.37.144
whitelisted
google.com
  • 142.250.185.142
whitelisted
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
presticitpo.store
unknown
crisiwarny.store
  • 172.67.170.64
  • 104.21.95.91
malicious
self.events.data.microsoft.com
  • 40.79.173.40
whitelisted

Threats

PID
Process
Class
Message
6772
axplong.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 32
6772
axplong.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
6772
axplong.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
6772
axplong.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
6772
axplong.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
6772
axplong.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
6772
axplong.exe
A Network Trojan was detected
ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2
6772
axplong.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7148
f0606cd2f3.exe
Malware Command and Control Activity Detected
ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in
7148
f0606cd2f3.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] Stealc HTTP POST Request
3 ETPRO signatures available at the full report
Process
Message
e8858826028984242479e4e2eeab90d6a3ffdd40288a3953782868ada5a98ecb.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
axplong.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
f0606cd2f3.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
08129255dc.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
axplong.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
axplong.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
AZIF7NZMD9ZDG5AKITA.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
axplong.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------