File name:

file

Full analysis: https://app.any.run/tasks/047304e7-3a78-44f8-9cde-af35f92214fd
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: December 13, 2024, 19:53:35
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
amadey
botnet
stealer
loader
lumma
themida
stealc
telegram
vidar
auto
gcleaner
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

3B7F8EA6D98D68EDD65A49C922671468

SHA1:

E5D999ECC81A188BFA758AF9980ECF55038527B3

SHA256:

EADBAD94A4EF1B106F1309FDDE748C49D606FC04589FC079853292B0C4EE136F

SSDEEP:

98304:bHkYbAXoiPpqcw6YSC6sunTrGSjlzkkIyG1r9ehbxXq63q+lbzN/ZgVE3WrHCI4+:b1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AMADEY has been detected (SURICATA)

      • skotes.exe (PID: 6564)

    • Connects to the CnC server

      • skotes.exe (PID: 6564)
      • eddf699b5c.exe (PID: 3808)
      • svchost.exe (PID: 2192)

    • LUMMA mutex has been found

      • 90813d843f.exe (PID: 7108)
      • 6cad2dbca3.exe (PID: 8660)

    • Actions looks like stealing of personal data

      • 90813d843f.exe (PID: 7108)
      • eddf699b5c.exe (PID: 3808)
      • 755bfa09c6.exe (PID: 8452)
      • 6cad2dbca3.exe (PID: 8660)

    • Steals credentials from Web Browsers

      • 90813d843f.exe (PID: 7108)
      • eddf699b5c.exe (PID: 3808)

    • AMADEY has been detected (YARA)

      • skotes.exe (PID: 6564)

    • Changes the autorun value in the registry

      • skotes.exe (PID: 6564)

    • Possible tool for stealing has been detected

      • 7c6a1d738f.exe (PID: 6252)
      • firefox.exe (PID: 6420)

    • StealC has been detected

      • eddf699b5c.exe (PID: 3808)

    • STEALC has been detected (SURICATA)

      • eddf699b5c.exe (PID: 3808)

    • VIDAR mutex has been found

      • 755bfa09c6.exe (PID: 8452)

    • STEALC has been detected (YARA)

      • eddf699b5c.exe (PID: 3808)

    • LUMMA has been found (auto)

      • skotes.exe (PID: 6564)

    • GCLEANER has been detected (SURICATA)

      • 6f0f67af9a.exe (PID: 4468)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2192)
      • 6cad2dbca3.exe (PID: 8660)

  • SUSPICIOUS

    • Reads the BIOS version

      • file.exe (PID: 6332)
      • skotes.exe (PID: 6564)
      • eddf699b5c.exe (PID: 3808)
      • c64e6a4deb.exe (PID: 8044)
      • skotes.exe (PID: 7820)
      • ECFCBFBGDB.exe (PID: 8976)
      • skotes.exe (PID: 540)

    • Reads security settings of Internet Explorer

      • file.exe (PID: 6332)
      • skotes.exe (PID: 6564)
      • eddf699b5c.exe (PID: 3808)
      • 755bfa09c6.exe (PID: 8452)
      • 6f0f67af9a.exe (PID: 4468)

    • Executable content was dropped or overwritten

      • file.exe (PID: 6332)
      • skotes.exe (PID: 6564)
      • eddf699b5c.exe (PID: 3808)
      • 6f0f67af9a.exe (PID: 4468)

    • Starts itself from another location

      • file.exe (PID: 6332)

    • Potential Corporate Privacy Violation

      • skotes.exe (PID: 6564)
      • eddf699b5c.exe (PID: 3808)
      • 6f0f67af9a.exe (PID: 4468)

    • Process requests binary or script from the Internet

      • skotes.exe (PID: 6564)
      • eddf699b5c.exe (PID: 3808)

    • Contacting a server suspected of hosting an CnC

      • skotes.exe (PID: 6564)
      • eddf699b5c.exe (PID: 3808)
      • 6cad2dbca3.exe (PID: 8660)
      • svchost.exe (PID: 2192)

    • Application launched itself

      • 90813d843f.exe (PID: 7020)

    • Uses TASKKILL.EXE to kill process

      • 7c6a1d738f.exe (PID: 6252)

    • Windows Defender mutex has been found

      • eddf699b5c.exe (PID: 3808)

    • Uses TASKKILL.EXE to kill Browsers

      • 7c6a1d738f.exe (PID: 6252)

    • Connects to the server without a host name

      • skotes.exe (PID: 6564)
      • eddf699b5c.exe (PID: 3808)
      • 6f0f67af9a.exe (PID: 4468)

    • Searches for installed software

      • eddf699b5c.exe (PID: 3808)

    • The process executes via Task Scheduler

      • skotes.exe (PID: 7820)
      • skotes.exe (PID: 540)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • 755bfa09c6.exe (PID: 8452)

    • Checks Windows Trust Settings

      • 755bfa09c6.exe (PID: 8452)

    • The process drops Mozilla's DLL files

      • eddf699b5c.exe (PID: 3808)

    • The process drops C-runtime libraries

      • eddf699b5c.exe (PID: 3808)

    • Process drops legitimate windows executable

      • eddf699b5c.exe (PID: 3808)

    • The executable file from the user directory is run by the CMD process

      • ECFCBFBGDB.exe (PID: 8976)

    • Starts CMD.EXE for commands execution

      • eddf699b5c.exe (PID: 3808)
      • 755bfa09c6.exe (PID: 8452)

    • Executes application which crashes

      • 755bfa09c6.exe (PID: 8452)
      • 6f0f67af9a.exe (PID: 4468)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 8048)

  • INFO

    • Reads the computer name

      • file.exe (PID: 6332)
      • skotes.exe (PID: 6564)
      • 90813d843f.exe (PID: 7108)
      • 7c6a1d738f.exe (PID: 6252)
      • eddf699b5c.exe (PID: 3808)
      • 755bfa09c6.exe (PID: 8452)
      • 6f0f67af9a.exe (PID: 4468)

    • Checks supported languages

      • file.exe (PID: 6332)
      • skotes.exe (PID: 6564)
      • 90813d843f.exe (PID: 7108)
      • 90813d843f.exe (PID: 7020)
      • 7c6a1d738f.exe (PID: 6252)
      • eddf699b5c.exe (PID: 3808)
      • skotes.exe (PID: 7820)
      • 755bfa09c6.exe (PID: 8452)
      • c64e6a4deb.exe (PID: 8044)
      • ECFCBFBGDB.exe (PID: 8976)

    • Sends debugging messages

      • file.exe (PID: 6332)
      • skotes.exe (PID: 6564)
      • eddf699b5c.exe (PID: 3808)
      • skotes.exe (PID: 7820)
      • c64e6a4deb.exe (PID: 8044)
      • 6f0f67af9a.exe (PID: 4468)
      • ECFCBFBGDB.exe (PID: 8976)
      • skotes.exe (PID: 540)

    • The process uses the downloaded file

      • file.exe (PID: 6332)
      • skotes.exe (PID: 6564)

    • Process checks computer location settings

      • file.exe (PID: 6332)
      • skotes.exe (PID: 6564)
      • eddf699b5c.exe (PID: 3808)

    • Checks proxy server information

      • skotes.exe (PID: 6564)
      • eddf699b5c.exe (PID: 3808)
      • 755bfa09c6.exe (PID: 8452)
      • 6f0f67af9a.exe (PID: 4468)
      • WerFault.exe (PID: 1144)
      • WerFault.exe (PID: 9172)

    • Create files in a temporary directory

      • skotes.exe (PID: 6564)

    • Reads the software policy settings

      • 90813d843f.exe (PID: 7108)
      • 6cad2dbca3.exe (PID: 8660)
      • WerFault.exe (PID: 9172)
      • WerFault.exe (PID: 1144)

    • The sample compiled with english language support

      • skotes.exe (PID: 6564)
      • eddf699b5c.exe (PID: 3808)

    • Themida protector has been detected

      • skotes.exe (PID: 6564)
      • eddf699b5c.exe (PID: 3808)
      • 6f0f67af9a.exe (PID: 4468)

    • Reads mouse settings

      • 7c6a1d738f.exe (PID: 6252)

    • Application launched itself

      • firefox.exe (PID: 6420)
      • firefox.exe (PID: 6440)
      • chrome.exe (PID: 7492)
      • msedge.exe (PID: 8684)
      • chrome.exe (PID: 9152)
      • msedge.exe (PID: 1544)

    • Reads CPU info

      • eddf699b5c.exe (PID: 3808)

    • Reads Environment values

      • eddf699b5c.exe (PID: 3808)

    • Reads product name

      • eddf699b5c.exe (PID: 3808)

    • Creates files or folders in the user directory

      • skotes.exe (PID: 6564)
      • 755bfa09c6.exe (PID: 8452)
      • 6f0f67af9a.exe (PID: 4468)
      • eddf699b5c.exe (PID: 3808)
      • WerFault.exe (PID: 9172)

    • Reads the machine GUID from the registry

      • 755bfa09c6.exe (PID: 8452)

    • Creates files in the program directory

      • eddf699b5c.exe (PID: 3808)
      • 755bfa09c6.exe (PID: 8452)

    • Attempting to use instant messaging service

      • 755bfa09c6.exe (PID: 8452)

    • The sample compiled with czech language support

      • skotes.exe (PID: 6564)

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 6440)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(6564) skotes.exe
Strings (120)2016
cmd /C RMDIR /s/q
Comodo
st=s
=
skotes.exe
\App
Norton
e1
AVG
" && timeout 1 && del
exe
2019
--
wb
DefaultSettings.YResolution
ProgramData\
:::
VideoID
Rem
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
http://
<d>
2022
Sophos
Programs
lv:
&unit=
------
POST
%-lu
<c>
Content-Type: application/x-www-form-urlencoded
185.215.113.43
Doctor Web
\
id:
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
360TotalSecurity
Startup
clip.dll
" Content-Type: application/octet-stream
Content-Type: multipart/form-data; boundary=----
cred.dll|clip.dll|
S-%lu-
rb
rundll32.exe
0123456789
GetNativeSystemInfo
abc3bc1985
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
" && ren
d1
ESET
vs:
"
------
sd:
WinDefender
dll
e0
%USERPROFILE%
Panda Security
SOFTWARE\Microsoft\Windows NT\CurrentVersion
zip
cmd
-unicode-
cred.dll
shell32.dll
ProductName
&&
shutdown -s -t 0
|
/Plugins/
Bitdefender
\0000
Content-Disposition: form-data; name="data"; filename="
/Zu7JuNko/index.php
os:
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
av:
4.42
-%lu
Avira
GET
e2
/quiet
Kaspersky Lab
#
ps1
-executionpolicy remotesigned -File "
DefaultSettings.XResolution
Powershell.exe
bi:
msi
https://
random
pc:
un:
abcdefghijklmnopqrstuvwxyz0123456789-_
ar:
Main
"taskkill /f /im "
ComputerName
2025
AVAST Software
SYSTEM\ControlSet001\Services\BasicDisplay\Video
r=
.jpg
CurrentBuild
og:
dm:
?scr=1
kernel32.dll
/k
&& Exit"
+++
rundll32
Options
Drop nameskotes.exe
Drop directoryabc3bc1985
Version4.42
URLhttp://185.215.113.43/Zu7JuNko/index.php
C2185.215.113.43
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:09:22 17:40:44+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.24
CodeSize: 322048
InitializedDataSize: 104960
UninitializedDataSize: -
EntryPoint: 0x31f000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
213
Monitored processes
78
Malicious processes
11
Suspicious processes
3

Behavior graph

Click at the process to see the details
start #LUMMA svchost.exe file.exe #AMADEY skotes.exe 90813d843f.exe no specs conhost.exe no specs 90813d843f.exe no specs 90813d843f.exe no specs #LUMMA 90813d843f.exe THREAT 7c6a1d738f.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs #STEALC eddf699b5c.exe taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs THREAT firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs chrome.exe firefox.exe no specs chrome.exe no specs skotes.exe chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs c64e6a4deb.exe chrome.exe no specs #VIDAR 755bfa09c6.exe chrome.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs #GCLEANER 6f0f67af9a.exe chrome.exe no specs #LUMMA 6cad2dbca3.exe msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs conhost.exe no specs ecfcbfbgdb.exe cmd.exe no specs conhost.exe no specs timeout.exe no specs werfault.exe werfault.exe skotes.exe

Process information

PID
CMD
Path
Indicators
Parent process
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
6332"C:\Users\admin\AppData\Local\Temp\file.exe" C:\Users\admin\AppData\Local\Temp\file.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\file.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6564"C:\Users\admin\AppData\Local\Temp\abc3bc1985\skotes.exe" C:\Users\admin\AppData\Local\Temp\abc3bc1985\skotes.exe
file.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\abc3bc1985\skotes.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Amadey
(PID) Process(6564) skotes.exe
Strings (120)2016
cmd /C RMDIR /s/q
Comodo
st=s
=
skotes.exe
\App
Norton
e1
AVG
" && timeout 1 && del
exe
2019
--
wb
DefaultSettings.YResolution
ProgramData\
:::
VideoID
Rem
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
http://
<d>
2022
Sophos
Programs
lv:
&unit=
------
POST
%-lu
<c>
Content-Type: application/x-www-form-urlencoded
185.215.113.43
Doctor Web
\
id:
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
360TotalSecurity
Startup
clip.dll
" Content-Type: application/octet-stream
Content-Type: multipart/form-data; boundary=----
cred.dll|clip.dll|
S-%lu-
rb
rundll32.exe
0123456789
GetNativeSystemInfo
abc3bc1985
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
" && ren
d1
ESET
vs:
"
------
sd:
WinDefender
dll
e0
%USERPROFILE%
Panda Security
SOFTWARE\Microsoft\Windows NT\CurrentVersion
zip
cmd
-unicode-
cred.dll
shell32.dll
ProductName
&&
shutdown -s -t 0
|
/Plugins/
Bitdefender
\0000
Content-Disposition: form-data; name="data"; filename="
/Zu7JuNko/index.php
os:
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
av:
4.42
-%lu
Avira
GET
e2
/quiet
Kaspersky Lab
#
ps1
-executionpolicy remotesigned -File "
DefaultSettings.XResolution
Powershell.exe
bi:
msi
https://
random
pc:
un:
abcdefghijklmnopqrstuvwxyz0123456789-_
ar:
Main
"taskkill /f /im "
ComputerName
2025
AVAST Software
SYSTEM\ControlSet001\Services\BasicDisplay\Video
r=
.jpg
CurrentBuild
og:
dm:
?scr=1
kernel32.dll
/k
&& Exit"
+++
rundll32
Options
Drop nameskotes.exe
Drop directoryabc3bc1985
Version4.42
URLhttp://185.215.113.43/Zu7JuNko/index.php
C2185.215.113.43
7020"C:\Users\admin\AppData\Local\Temp\1014910001\90813d843f.exe" C:\Users\admin\AppData\Local\Temp\1014910001\90813d843f.exe—skotes.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\1014910001\90813d843f.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
7028\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—90813d843f.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7088"C:\Users\admin\AppData\Local\Temp\1014910001\90813d843f.exe"C:\Users\admin\AppData\Local\Temp\1014910001\90813d843f.exe—90813d843f.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\1014910001\90813d843f.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7096"C:\Users\admin\AppData\Local\Temp\1014910001\90813d843f.exe"C:\Users\admin\AppData\Local\Temp\1014910001\90813d843f.exe—90813d843f.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\1014910001\90813d843f.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7108"C:\Users\admin\AppData\Local\Temp\1014910001\90813d843f.exe"C:\Users\admin\AppData\Local\Temp\1014910001\90813d843f.exe
90813d843f.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\1014910001\90813d843f.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6252"C:\Users\admin\AppData\Local\Temp\1014911001\7c6a1d738f.exe" C:\Users\admin\AppData\Local\Temp\1014911001\7c6a1d738f.exe
skotes.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\1014911001\7c6a1d738f.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
4300taskkill /F /IM firefox.exe /TC:\Windows\SysWOW64\taskkill.exe—7c6a1d738f.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
36 365
Read events
36 323
Write events
42
Delete events
0

Modification events

(PID) Process:(6564) skotes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6564) skotes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6564) skotes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6564) skotes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:7c6a1d738f.exe
Value:
C:\Users\admin\AppData\Local\Temp\1014911001\7c6a1d738f.exe
(PID) Process:(3808) eddf699b5c.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3808) eddf699b5c.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3808) eddf699b5c.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6440) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
0
(PID) Process:(6564) skotes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:eddf699b5c.exe
Value:
C:\Users\admin\AppData\Local\Temp\1014912001\eddf699b5c.exe
(PID) Process:(7492) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
Executable files
53
Suspicious files
418
Text files
186
Unknown types
0

Dropped files

PID
Process
Filename
Type
6440firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
6440firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.jsonbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
6440firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cookies.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
6440firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\urlCache-current.binbinary
MD5:297E88D7CEB26E549254EC875649F4EB
SHA256:8B75D4FB1845BAA06122888D11F6B65E6A36B140C54A72CC13DF390FD7C95702
6440firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
6564skotes.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\random[1].exeexecutable
MD5:28E568616A7B792CAC1726DEB77D9039
SHA256:9597798F7789ADC29FBE97707B1BD8CA913C4D5861B0AD4FDD6B913AF7C7A8E2
6564skotes.exeC:\Users\admin\AppData\Local\Temp\1014911001\7c6a1d738f.exeexecutable
MD5:2C4DECB4A0DD610843D56D6C8A7F3474
SHA256:065B99CB2637E4516BA4784DCB269D59CAE9651A29CA0B8BD12AB429B2D73B07
6564skotes.exeC:\Users\admin\AppData\Local\Temp\1014910001\90813d843f.exeexecutable
MD5:28E568616A7B792CAC1726DEB77D9039
SHA256:9597798F7789ADC29FBE97707B1BD8CA913C4D5861B0AD4FDD6B913AF7C7A8E2
6440firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.json.tmpbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
6440firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
105
TCP/UDP connections
224
DNS requests
198
Threats
89

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3808
eddf699b5c.exe
GET
200
185.215.113.206:80
http://185.215.113.206/
unknown
—
—
malicious
6564
skotes.exe
POST
200
185.215.113.43:80
http://185.215.113.43/Zu7JuNko/index.php
unknown
—
—
malicious
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
3808
eddf699b5c.exe
POST
200
185.215.113.206:80
http://185.215.113.206/c4becf79229cb002.php
unknown
—
—
malicious
6564
skotes.exe
GET
200
185.215.113.16:80
http://185.215.113.16/well/random.exe
unknown
—
—
malicious
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3808
eddf699b5c.exe
POST
200
185.215.113.206:80
http://185.215.113.206/c4becf79229cb002.php
unknown
—
—
malicious
6564
skotes.exe
GET
200
31.41.244.11:80
http://31.41.244.11/files/fate/random.exe
unknown
—
—
—
6564
skotes.exe
GET
200
185.215.113.16:80
http://185.215.113.16/steam/random.exe
unknown
—
—
malicious
6564
skotes.exe
POST
200
185.215.113.43:80
http://185.215.113.43/Zu7JuNko/index.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5064
SearchApp.exe
2.19.80.88:443
www.bing.com
Akamai International B.V.
DE
whitelisted
5856
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2396
RUXIMICS.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1076
svchost.exe
23.218.210.69:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.238
whitelisted
www.bing.com
  • 2.19.80.88
  • 2.19.80.123
  • 2.19.80.90
  • 2.19.80.96
  • 2.19.80.114
  • 2.19.80.82
  • 2.19.80.115
  • 2.19.80.120
  • 2.19.80.83
  • 2.19.80.81
  • 2.19.80.97
  • 2.19.80.74
  • 2.19.80.56
  • 2.19.80.50
  • 2.19.80.73
  • 2.19.80.57
  • 2.19.80.42
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.133
  • 20.190.160.20
  • 20.190.160.14
  • 40.126.32.138
  • 40.126.32.140
  • 40.126.32.74
  • 40.126.32.134
  • 40.126.32.76
whitelisted
go.microsoft.com
  • 23.218.210.69
whitelisted
drive-connect.cyou
  • 104.21.79.7
  • 172.67.139.78
malicious
youtube.com
  • 142.250.186.110
  • 2a00:1450:4001:80e::200e
whitelisted
detectportal.firefox.com
  • 34.107.221.82
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
contile.services.mozilla.com
  • 34.117.188.166
whitelisted

Threats

PID
Process
Class
Message
—
—
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
—
—
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 33
—
—
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 2
—
—
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
—
—
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
—
—
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 33
4 ETPRO signatures available at the full report
Process
Message
file.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
skotes.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
eddf699b5c.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
skotes.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
c64e6a4deb.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
6f0f67af9a.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
ECFCBFBGDB.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
skotes.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
file