URL:

https://rtexcorporation.com/storage/app/release.rar

Full analysis: https://app.any.run/tasks/3783141e-5e66-4f46-b37a-b4efbc19fffc
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: December 17, 2023, 08:09:07
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
privateloader
evasion
loader
risepro
stealer
stealc
redline
tofsee
botnet
lumma
amadey
opendir
miner
smoke
smokeloader
sinkhole
ransomware
stop
trojan
glupteba
socks5systemz
proxy
xmrig
g0njxa
Indicators:
MD5:

B6D6A282262BCAA6E469B2C26E1B1D41

SHA1:

1F9EBC6F53739E413D96695B77E8F0D83777CB91

SHA256:

ECC7BA3CE0AD7E46B70D964EEF3E34D5258B022D8C9DB6EBCDB75F6369CA527D

SSDEEP:

3:N84BKX8/dINRMrcZJhrXEXn:2+INRMIyX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Actions looks like stealing of personal data

      • setup.exe (PID: 7540)
      • BpCQVeXVekb0t5lbBQ31uW7A.exe (PID: 3712)
      • wgFRtNtecGRIviEPuvCntuXW.exe (PID: 6764)
      • X8iZZQuqUMIQsqKIsUL_vLr8.exe (PID: 6856)
      • AppLaunch.exe (PID: 5388)
      • RegSvcs.exe (PID: 1752)
      • RegSvcs.exe (PID: 4988)
      • jsc.exe (PID: 3268)
      • MSBuild.exe (PID: 8412)
      • 2Lw4292.exe (PID: 8652)
      • explorer.exe (PID: 6452)
      • AppLaunch.exe (PID: 3284)
      • 2Nx_5PGBv7Vpf5Y4ysEps7wm.exe (PID: 7872)
      • 4hb569CM.exe (PID: 3124)
    • PRIVATELOADER has been detected (SURICATA)

      • setup.exe (PID: 7540)
      • BpCQVeXVekb0t5lbBQ31uW7A.exe (PID: 3712)
      • X8iZZQuqUMIQsqKIsUL_vLr8.exe (PID: 6856)
    • Connects to the CnC server

      • setup.exe (PID: 7540)
      • _FTS87RpX1yPKRoyVrlH4NCl.exe (PID: 7988)
      • BpCQVeXVekb0t5lbBQ31uW7A.exe (PID: 3712)
      • AppLaunch.exe (PID: 5388)
      • 2Nx_5PGBv7Vpf5Y4ysEps7wm.exe (PID: 7872)
      • RegSvcs.exe (PID: 1752)
      • X8iZZQuqUMIQsqKIsUL_vLr8.exe (PID: 6856)
      • svchost.exe (PID: 1848)
      • explorer.exe (PID: 4500)
      • 2Lw4292.exe (PID: 8652)
      • explorer.exe (PID: 6452)
      • explorer.exe (PID: 5632)
      • AppLaunch.exe (PID: 3284)
      • 4hb569CM.exe (PID: 3124)
      • csrss.exe (PID: 7644)
      • gphoneapp.exe (PID: 9076)
    • Drops the executable file immediately after the start

      • kBFiz5fBEO8W6rVIKQ5G25C2.exe (PID: 7804)
      • setup.exe (PID: 7540)
      • 2Nx_5PGBv7Vpf5Y4ysEps7wm.exe (PID: 7872)
      • EYtAeIUdhVkTd1bAqh9WFF4C.exe (PID: 6060)
      • ZWtC6f_bRqpBy_0ziBKyd_4L.exe (PID: 7972)
      • I25O7_Jb7VF7dhLNowxDBvx5.exe (PID: 7784)
      • u4GcQBT7sQBj19L_cCRpg0rp.exe (PID: 8016)
      • cmd.exe (PID: 7824)
      • BpCQVeXVekb0t5lbBQ31uW7A.exe (PID: 3712)
      • ZKba8xPBkuI3r0F4BmUagfkJ.exe (PID: 3716)
      • 6wZBRPiDOPgHECJq3zB_rWf3.exe (PID: 6508)
      • F0C7.exe (PID: 8460)
      • nq0sZ04.exe (PID: 8480)
      • AZ3Px41.exe (PID: 8516)
      • 30FF.exe (PID: 7392)
      • 30FF.exe (PID: 7684)
      • gphoneapp.exe (PID: 2632)
      • 30FF.tmp (PID: 6632)
      • updater.exe (PID: 7688)
      • 4hb569CM.exe (PID: 3124)
      • 1E32.exe (PID: 6208)
      • csrss.exe (PID: 7644)
    • Create files in the Startup directory

      • 2Nx_5PGBv7Vpf5Y4ysEps7wm.exe (PID: 7872)
    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 4284)
      • UBrBCYPGH1FyjjqZR58SdjwY.exe (PID: 1552)
      • explorer.exe (PID: 4500)
      • csrss.exe (PID: 7644)
    • Application was injected by another process

      • explorer.exe (PID: 4500)
    • Runs injected code in another process

      • qP7pSkTDjxZolwozxnzwVAtH.exe (PID: 7788)
      • 68.exe (PID: 8980)
      • 6uD6AH2.exe (PID: 8380)
    • STEALC has been detected (SURICATA)

      • _FTS87RpX1yPKRoyVrlH4NCl.exe (PID: 7988)
    • RISEPRO has been detected (SURICATA)

      • 8y0rfqjpHvUvKK4SwFD77NfD.exe (PID: 6652)
      • 2Nx_5PGBv7Vpf5Y4ysEps7wm.exe (PID: 7872)
      • 4hb569CM.exe (PID: 3124)
    • Uses Task Scheduler to autorun other applications

      • cmd.exe (PID: 4988)
      • csrss.exe (PID: 7644)
    • REDLINE has been detected (SURICATA)

      • AppLaunch.exe (PID: 5388)
      • wgFRtNtecGRIviEPuvCntuXW.exe (PID: 6764)
      • jsc.exe (PID: 3268)
      • AppLaunch.exe (PID: 3284)
    • Steals credentials from Web Browsers

      • 2Nx_5PGBv7Vpf5Y4ysEps7wm.exe (PID: 7872)
      • wgFRtNtecGRIviEPuvCntuXW.exe (PID: 6764)
      • jsc.exe (PID: 3268)
      • AppLaunch.exe (PID: 5388)
      • 4hb569CM.exe (PID: 3124)
      • AppLaunch.exe (PID: 3284)
    • RISEPRO has been detected (YARA)

      • 2Nx_5PGBv7Vpf5Y4ysEps7wm.exe (PID: 7872)
    • Creates a writable file in the system directory

      • svchost.exe (PID: 6568)
      • X8iZZQuqUMIQsqKIsUL_vLr8.exe (PID: 6856)
      • powershell.exe (PID: 7052)
      • powershell.exe (PID: 9180)
      • csrss.exe (PID: 7644)
    • Changes the autorun value in the registry

      • UBrBCYPGH1FyjjqZR58SdjwY.exe (PID: 1552)
      • csrss.exe (PID: 7644)
    • Modifies files in the Chrome extension folder

      • X8iZZQuqUMIQsqKIsUL_vLr8.exe (PID: 6856)
    • Stop is detected

      • u4GcQBT7sQBj19L_cCRpg0rp.exe (PID: 6056)
    • Adds path to the Windows Defender exclusion list

      • explorer.exe (PID: 4500)
    • TOFSEE has been detected (SURICATA)

      • svchost.exe (PID: 6568)
    • AMADEY has been detected (SURICATA)

      • UBrBCYPGH1FyjjqZR58SdjwY.exe (PID: 1552)
    • LUMMA has been detected (SURICATA)

      • RegSvcs.exe (PID: 4988)
      • RegSvcs.exe (PID: 1752)
      • MSBuild.exe (PID: 8412)
      • 2Lw4292.exe (PID: 8652)
    • MINER has been detected (SURICATA)

      • svchost.exe (PID: 1848)
    • SMOKE has been detected (SURICATA)

      • explorer.exe (PID: 4500)
      • explorer.exe (PID: 6452)
      • explorer.exe (PID: 5632)
    • Unusual connection from system programs

      • explorer.exe (PID: 6452)
    • Glupteba is detected

      • 1E32.exe (PID: 6208)
    • TOFSEE has been detected (YARA)

      • svchost.exe (PID: 6568)
    • SOCKS5SYSTEMZ has been detected (SURICATA)

      • gphoneapp.exe (PID: 9076)
    • GLUPTEBA has been detected (SURICATA)

      • csrss.exe (PID: 7644)
  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 4552)
      • EYtAeIUdhVkTd1bAqh9WFF4C.exe (PID: 6060)
      • ZKba8xPBkuI3r0F4BmUagfkJ.exe (PID: 3716)
      • explorer.exe (PID: 4500)
      • F0C7.exe (PID: 8460)
      • nq0sZ04.exe (PID: 8480)
      • 30FF.tmp (PID: 6632)
    • Connects to the server without a host name

      • setup.exe (PID: 7540)
      • UBrBCYPGH1FyjjqZR58SdjwY.exe (PID: 1552)
      • svchost.exe (PID: 6568)
    • Reads security settings of Internet Explorer

      • setup.exe (PID: 7540)
      • u4GcQBT7sQBj19L_cCRpg0rp.exe (PID: 8016)
      • BpCQVeXVekb0t5lbBQ31uW7A.exe (PID: 3712)
      • u4GcQBT7sQBj19L_cCRpg0rp.exe (PID: 6056)
      • X8iZZQuqUMIQsqKIsUL_vLr8.exe (PID: 6856)
      • WinProxy.exe (PID: 4932)
    • Checks Windows Trust Settings

      • setup.exe (PID: 7540)
      • u4GcQBT7sQBj19L_cCRpg0rp.exe (PID: 8016)
      • BpCQVeXVekb0t5lbBQ31uW7A.exe (PID: 3712)
      • u4GcQBT7sQBj19L_cCRpg0rp.exe (PID: 6056)
      • X8iZZQuqUMIQsqKIsUL_vLr8.exe (PID: 6856)
      • WinProxy.exe (PID: 4932)
    • Reads the BIOS version

      • setup.exe (PID: 7540)
      • YwEFeb9HrOXYcXlbkqIJVJOL.exe (PID: 7648)
      • X8iZZQuqUMIQsqKIsUL_vLr8.exe (PID: 6856)
    • Checks for external IP

      • setup.exe (PID: 7540)
      • 8y0rfqjpHvUvKK4SwFD77NfD.exe (PID: 6652)
      • BpCQVeXVekb0t5lbBQ31uW7A.exe (PID: 3712)
      • 2Nx_5PGBv7Vpf5Y4ysEps7wm.exe (PID: 7872)
      • X8iZZQuqUMIQsqKIsUL_vLr8.exe (PID: 6856)
      • 4hb569CM.exe (PID: 3124)
    • Process requests binary or script from the Internet

      • setup.exe (PID: 7540)
    • Drops 7-zip archiver for unpacking

      • setup.exe (PID: 7540)
      • 30FF.tmp (PID: 6632)
    • Reads the date of Windows installation

      • kBFiz5fBEO8W6rVIKQ5G25C2.exe (PID: 7804)
      • ZWtC6f_bRqpBy_0ziBKyd_4L.exe (PID: 7972)
      • UBrBCYPGH1FyjjqZR58SdjwY.exe (PID: 1552)
      • u4GcQBT7sQBj19L_cCRpg0rp.exe (PID: 8016)
      • X8iZZQuqUMIQsqKIsUL_vLr8.exe (PID: 6856)
      • AppLaunch.exe (PID: 5388)
      • 30FF.tmp (PID: 7616)
    • Application launched itself

      • u4GcQBT7sQBj19L_cCRpg0rp.exe (PID: 7236)
      • u4GcQBT7sQBj19L_cCRpg0rp.exe (PID: 8016)
      • u4GcQBT7sQBj19L_cCRpg0rp.exe (PID: 6200)
      • svchost.exe (PID: 6568)
      • 1E32.exe (PID: 6580)
    • The process drops C-runtime libraries

      • EYtAeIUdhVkTd1bAqh9WFF4C.exe (PID: 6060)
    • Starts CMD.EXE for commands execution

      • 2Nx_5PGBv7Vpf5Y4ysEps7wm.exe (PID: 7872)
      • ZWtC6f_bRqpBy_0ziBKyd_4L.exe (PID: 7972)
      • explorer.exe (PID: 4500)
      • 1E32.exe (PID: 8984)
      • 1E32.exe (PID: 6208)
      • csrss.exe (PID: 7644)
      • windefender.exe (PID: 6676)
    • Executes application which crashes

      • _FTS87RpX1yPKRoyVrlH4NCl.exe (PID: 7988)
      • ZWtC6f_bRqpBy_0ziBKyd_4L.exe (PID: 7972)
      • seuhvumq.exe (PID: 7596)
      • 2Nx_5PGBv7Vpf5Y4ysEps7wm.exe (PID: 7872)
      • EA4D.exe (PID: 7348)
      • 2Lw4292.exe (PID: 8652)
      • 4hb569CM.exe (PID: 3124)
      • B860.exe (PID: 7044)
    • Loads Python modules

      • LG.exe (PID: 1584)
    • Uses ICACLS.EXE to modify access control lists

      • u4GcQBT7sQBj19L_cCRpg0rp.exe (PID: 8016)
    • The process executes via Task Scheduler

      • WinProxy.exe (PID: 4932)
      • UBrBCYPGH1FyjjqZR58SdjwY.exe (PID: 6156)
      • updater.exe (PID: 7688)
      • UBrBCYPGH1FyjjqZR58SdjwY.exe (PID: 7676)
      • UBrBCYPGH1FyjjqZR58SdjwY.exe (PID: 4536)
      • UBrBCYPGH1FyjjqZR58SdjwY.exe (PID: 7172)
      • UBrBCYPGH1FyjjqZR58SdjwY.exe (PID: 8552)
      • UBrBCYPGH1FyjjqZR58SdjwY.exe (PID: 9152)
    • Connects to unusual port

      • 8y0rfqjpHvUvKK4SwFD77NfD.exe (PID: 6652)
      • YwEFeb9HrOXYcXlbkqIJVJOL.exe (PID: 7648)
      • AppLaunch.exe (PID: 5388)
      • wgFRtNtecGRIviEPuvCntuXW.exe (PID: 6764)
      • 2Nx_5PGBv7Vpf5Y4ysEps7wm.exe (PID: 7872)
      • svchost.exe (PID: 6568)
      • svchost.exe (PID: 1848)
      • jsc.exe (PID: 3268)
      • explorer.exe (PID: 6648)
      • AppLaunch.exe (PID: 3284)
      • 4hb569CM.exe (PID: 3124)
      • gphoneapp.exe (PID: 9076)
    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • ZWtC6f_bRqpBy_0ziBKyd_4L.exe (PID: 7972)
      • cmd.exe (PID: 6956)
    • Executes as Windows Service

      • seuhvumq.exe (PID: 7596)
      • windefender.exe (PID: 7896)
    • Detected use of alternative data streams (AltDS)

      • svchost.exe (PID: 6568)
    • The process checks if it is being run in the virtual environment

      • rundll32.exe (PID: 7476)
      • rundll32.exe (PID: 5164)
    • Creates or modifies Windows services

      • svchost.exe (PID: 6568)
    • Searches for installed software

      • AppLaunch.exe (PID: 5388)
      • 2Nx_5PGBv7Vpf5Y4ysEps7wm.exe (PID: 7872)
      • wgFRtNtecGRIviEPuvCntuXW.exe (PID: 6764)
      • RegSvcs.exe (PID: 1752)
      • RegSvcs.exe (PID: 4988)
      • jsc.exe (PID: 3268)
      • MSBuild.exe (PID: 8412)
      • 2Lw4292.exe (PID: 8652)
      • 4hb569CM.exe (PID: 3124)
      • AppLaunch.exe (PID: 3284)
    • Starts POWERSHELL.EXE for commands execution

      • explorer.exe (PID: 4500)
      • 1E32.exe (PID: 6580)
      • 1E32.exe (PID: 6208)
      • csrss.exe (PID: 7644)
    • Script adds exclusion path to Windows Defender

      • explorer.exe (PID: 4500)
    • Starts SC.EXE for service management

      • cmd.exe (PID: 8132)
      • cmd.exe (PID: 4132)
    • Uses powercfg.exe to modify the power settings

      • cmd.exe (PID: 7488)
      • cmd.exe (PID: 7380)
    • Connects to SMTP port

      • svchost.exe (PID: 6568)
    • Uses RUNDLL32.EXE to load library

      • rundll32.exe (PID: 7476)
    • The process creates files with name similar to system file names

      • powershell.exe (PID: 7052)
      • powershell.exe (PID: 4104)
      • powershell.exe (PID: 9180)
      • 1E32.exe (PID: 6208)
    • Reads the Windows owner or organization settings

      • 30FF.tmp (PID: 6632)
    • Loads DLL from Mozilla Firefox

      • explorer.exe (PID: 5632)
    • Process drops SQLite DLL files

      • 30FF.tmp (PID: 6632)
    • Drops a system driver (possible attempt to evade defenses)

      • updater.exe (PID: 7688)
      • csrss.exe (PID: 7644)
    • The process bypasses the loading of PowerShell profile settings

      • 1E32.exe (PID: 6580)
      • 1E32.exe (PID: 6208)
      • csrss.exe (PID: 7644)
    • The process hides Powershell's copyright startup banner

      • 1E32.exe (PID: 6580)
      • 1E32.exe (PID: 6208)
      • csrss.exe (PID: 7644)
    • Starts itself from another location

      • 1E32.exe (PID: 6208)
    • Creates files in the driver directory

      • csrss.exe (PID: 7644)
    • Found strings related to reading or modifying Windows Defender settings

      • windefender.exe (PID: 6676)
    • Xmrig is detected

      • csrss.exe (PID: 7644)
  • INFO

    • Checks supported languages

      • identity_helper.exe (PID: 6540)
      • TextInputHost.exe (PID: 8052)
      • setup.exe (PID: 7540)
      • 2Nx_5PGBv7Vpf5Y4ysEps7wm.exe (PID: 7872)
      • qP7pSkTDjxZolwozxnzwVAtH.exe (PID: 7788)
      • kBFiz5fBEO8W6rVIKQ5G25C2.exe (PID: 7804)
      • ZWtC6f_bRqpBy_0ziBKyd_4L.exe (PID: 7972)
      • _FTS87RpX1yPKRoyVrlH4NCl.exe (PID: 7988)
      • qJzhRbGT29RYkWswp5erqEOJ.exe (PID: 1828)
      • I25O7_Jb7VF7dhLNowxDBvx5.exe (PID: 7784)
      • EI9kE_gGhB4DaoGnEKotPiXw.exe (PID: 6820)
      • X8iZZQuqUMIQsqKIsUL_vLr8.exe (PID: 6856)
      • 8y0rfqjpHvUvKK4SwFD77NfD.exe (PID: 6652)
      • wgFRtNtecGRIviEPuvCntuXW.exe (PID: 6764)
      • YwEFeb9HrOXYcXlbkqIJVJOL.exe (PID: 7648)
      • hPWR1krG3upNjQw8OviN_DLf.exe (PID: 6260)
      • BpCQVeXVekb0t5lbBQ31uW7A.exe (PID: 3712)
      • t76w83FOzlkBuLtJrKEz5Qwg.exe (PID: 7340)
      • ZKba8xPBkuI3r0F4BmUagfkJ.exe (PID: 3716)
      • EYtAeIUdhVkTd1bAqh9WFF4C.exe (PID: 6060)
      • u4GcQBT7sQBj19L_cCRpg0rp.exe (PID: 7236)
      • u4GcQBT7sQBj19L_cCRpg0rp.exe (PID: 8016)
      • AppLaunch.exe (PID: 5388)
      • LG.exe (PID: 1584)
      • seuhvumq.exe (PID: 7596)
      • RegSvcs.exe (PID: 4988)
      • UBrBCYPGH1FyjjqZR58SdjwY.exe (PID: 1552)
      • RegSvcs.exe (PID: 1752)
      • 6wZBRPiDOPgHECJq3zB_rWf3.exe (PID: 6508)
      • u4GcQBT7sQBj19L_cCRpg0rp.exe (PID: 6200)
      • u4GcQBT7sQBj19L_cCRpg0rp.exe (PID: 6056)
      • WinProxy.exe (PID: 4932)
      • UBrBCYPGH1FyjjqZR58SdjwY.exe (PID: 6156)
      • updater.exe (PID: 7688)
      • jsc.exe (PID: 3268)
      • EA4D.exe (PID: 7348)
      • MSBuild.exe (PID: 8412)
      • F0C7.exe (PID: 8460)
      • nq0sZ04.exe (PID: 8480)
      • AZ3Px41.exe (PID: 8516)
      • 68.exe (PID: 8980)
      • 2Lw4292.exe (PID: 8652)
      • 1E32.exe (PID: 8984)
      • 30FF.exe (PID: 7392)
      • 30FF.tmp (PID: 7616)
      • 30FF.exe (PID: 7684)
      • 30FF.tmp (PID: 6632)
      • 1Ba04Zt6.exe (PID: 8536)
      • gphoneapp.exe (PID: 2632)
      • gphoneapp.exe (PID: 9076)
      • 1E32.exe (PID: 6580)
      • AppLaunch.exe (PID: 3284)
      • 4hb569CM.exe (PID: 3124)
      • 1E32.exe (PID: 6208)
      • 6uD6AH2.exe (PID: 8380)
      • UBrBCYPGH1FyjjqZR58SdjwY.exe (PID: 7676)
      • B860.exe (PID: 7044)
      • csrss.exe (PID: 7644)
      • windefender.exe (PID: 6676)
      • windefender.exe (PID: 7896)
      • UBrBCYPGH1FyjjqZR58SdjwY.exe (PID: 7172)
      • UBrBCYPGH1FyjjqZR58SdjwY.exe (PID: 4536)
      • UBrBCYPGH1FyjjqZR58SdjwY.exe (PID: 9152)
      • UBrBCYPGH1FyjjqZR58SdjwY.exe (PID: 8552)
    • Reads the computer name

      • identity_helper.exe (PID: 6540)
      • TextInputHost.exe (PID: 8052)
      • setup.exe (PID: 7540)
      • I25O7_Jb7VF7dhLNowxDBvx5.exe (PID: 7784)
      • kBFiz5fBEO8W6rVIKQ5G25C2.exe (PID: 7804)
      • 2Nx_5PGBv7Vpf5Y4ysEps7wm.exe (PID: 7872)
      • wgFRtNtecGRIviEPuvCntuXW.exe (PID: 6764)
      • hPWR1krG3upNjQw8OviN_DLf.exe (PID: 6260)
      • _FTS87RpX1yPKRoyVrlH4NCl.exe (PID: 7988)
      • t76w83FOzlkBuLtJrKEz5Qwg.exe (PID: 7340)
      • u4GcQBT7sQBj19L_cCRpg0rp.exe (PID: 8016)
      • BpCQVeXVekb0t5lbBQ31uW7A.exe (PID: 3712)
      • AppLaunch.exe (PID: 5388)
      • 8y0rfqjpHvUvKK4SwFD77NfD.exe (PID: 6652)
      • ZWtC6f_bRqpBy_0ziBKyd_4L.exe (PID: 7972)
      • LG.exe (PID: 1584)
      • seuhvumq.exe (PID: 7596)
      • RegSvcs.exe (PID: 4988)
      • UBrBCYPGH1FyjjqZR58SdjwY.exe (PID: 1552)
      • RegSvcs.exe (PID: 1752)
      • X8iZZQuqUMIQsqKIsUL_vLr8.exe (PID: 6856)
      • u4GcQBT7sQBj19L_cCRpg0rp.exe (PID: 6056)
      • WinProxy.exe (PID: 4932)
      • jsc.exe (PID: 3268)
      • EA4D.exe (PID: 7348)
      • MSBuild.exe (PID: 8412)
      • 1Ba04Zt6.exe (PID: 8536)
      • 2Lw4292.exe (PID: 8652)
      • 1E32.exe (PID: 8984)
      • 30FF.tmp (PID: 7616)
      • 30FF.tmp (PID: 6632)
      • gphoneapp.exe (PID: 2632)
      • 1E32.exe (PID: 6580)
      • AppLaunch.exe (PID: 3284)
      • 4hb569CM.exe (PID: 3124)
      • 1E32.exe (PID: 6208)
      • csrss.exe (PID: 7644)
      • windefender.exe (PID: 6676)
      • windefender.exe (PID: 7896)
      • gphoneapp.exe (PID: 9076)
      • EYtAeIUdhVkTd1bAqh9WFF4C.exe (PID: 6060)
    • The process uses the downloaded file

      • msedge.exe (PID: 1268)
      • WinRAR.exe (PID: 4552)
      • msedge.exe (PID: 3964)
    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 4552)
      • msedge.exe (PID: 6708)
      • explorer.exe (PID: 4500)
    • Reads the software policy settings

      • slui.exe (PID: 6576)
      • setup.exe (PID: 7540)
      • slui.exe (PID: 6688)
      • I25O7_Jb7VF7dhLNowxDBvx5.exe (PID: 7784)
      • 8y0rfqjpHvUvKK4SwFD77NfD.exe (PID: 6652)
      • u4GcQBT7sQBj19L_cCRpg0rp.exe (PID: 8016)
      • BpCQVeXVekb0t5lbBQ31uW7A.exe (PID: 3712)
      • 2Nx_5PGBv7Vpf5Y4ysEps7wm.exe (PID: 7872)
      • WerFault.exe (PID: 4936)
      • X8iZZQuqUMIQsqKIsUL_vLr8.exe (PID: 6856)
      • WerFault.exe (PID: 4644)
      • WinProxy.exe (PID: 4932)
      • WerFault.exe (PID: 8492)
      • explorer.exe (PID: 4500)
      • WerFault.exe (PID: 5548)
      • 4hb569CM.exe (PID: 3124)
      • WerFault.exe (PID: 7692)
      • WerFault.exe (PID: 7468)
    • Process checks computer location settings

      • setup.exe (PID: 7540)
      • kBFiz5fBEO8W6rVIKQ5G25C2.exe (PID: 7804)
      • ZWtC6f_bRqpBy_0ziBKyd_4L.exe (PID: 7972)
      • BpCQVeXVekb0t5lbBQ31uW7A.exe (PID: 3712)
      • UBrBCYPGH1FyjjqZR58SdjwY.exe (PID: 1552)
      • u4GcQBT7sQBj19L_cCRpg0rp.exe (PID: 8016)
      • X8iZZQuqUMIQsqKIsUL_vLr8.exe (PID: 6856)
      • AppLaunch.exe (PID: 5388)
      • 30FF.tmp (PID: 7616)
      • csrss.exe (PID: 7644)
    • Checks proxy server information

      • setup.exe (PID: 7540)
      • slui.exe (PID: 6688)
      • _FTS87RpX1yPKRoyVrlH4NCl.exe (PID: 7988)
      • I25O7_Jb7VF7dhLNowxDBvx5.exe (PID: 7784)
      • u4GcQBT7sQBj19L_cCRpg0rp.exe (PID: 8016)
      • LG.exe (PID: 1584)
      • 2Nx_5PGBv7Vpf5Y4ysEps7wm.exe (PID: 7872)
      • BpCQVeXVekb0t5lbBQ31uW7A.exe (PID: 3712)
      • WerFault.exe (PID: 4936)
      • WerFault.exe (PID: 4644)
      • UBrBCYPGH1FyjjqZR58SdjwY.exe (PID: 1552)
      • u4GcQBT7sQBj19L_cCRpg0rp.exe (PID: 6056)
      • X8iZZQuqUMIQsqKIsUL_vLr8.exe (PID: 6856)
      • WinProxy.exe (PID: 4932)
      • explorer.exe (PID: 4500)
      • EA4D.exe (PID: 7348)
      • WerFault.exe (PID: 8492)
      • explorer.exe (PID: 6452)
      • explorer.exe (PID: 5632)
      • WerFault.exe (PID: 5548)
      • 4hb569CM.exe (PID: 3124)
      • WerFault.exe (PID: 7692)
      • WerFault.exe (PID: 7468)
      • gphoneapp.exe (PID: 9076)
    • Application launched itself

      • msedge.exe (PID: 3964)
      • chrome.exe (PID: 7272)
      • msedge.exe (PID: 6844)
      • msedge.exe (PID: 7488)
      • msedge.exe (PID: 8780)
      • msedge.exe (PID: 8612)
      • msedge.exe (PID: 8988)
      • msedge.exe (PID: 9180)
      • msedge.exe (PID: 7032)
      • msedge.exe (PID: 8616)
      • msedge.exe (PID: 8780)
      • msedge.exe (PID: 8876)
      • msedge.exe (PID: 8776)
    • Process checks are UAC notifies on

      • setup.exe (PID: 7540)
      • YwEFeb9HrOXYcXlbkqIJVJOL.exe (PID: 7648)
      • X8iZZQuqUMIQsqKIsUL_vLr8.exe (PID: 6856)
    • Reads the machine GUID from the registry

      • setup.exe (PID: 7540)
      • I25O7_Jb7VF7dhLNowxDBvx5.exe (PID: 7784)
      • hPWR1krG3upNjQw8OviN_DLf.exe (PID: 6260)
      • t76w83FOzlkBuLtJrKEz5Qwg.exe (PID: 7340)
      • wgFRtNtecGRIviEPuvCntuXW.exe (PID: 6764)
      • 2Nx_5PGBv7Vpf5Y4ysEps7wm.exe (PID: 7872)
      • 8y0rfqjpHvUvKK4SwFD77NfD.exe (PID: 6652)
      • AppLaunch.exe (PID: 5388)
      • u4GcQBT7sQBj19L_cCRpg0rp.exe (PID: 8016)
      • BpCQVeXVekb0t5lbBQ31uW7A.exe (PID: 3712)
      • X8iZZQuqUMIQsqKIsUL_vLr8.exe (PID: 6856)
      • u4GcQBT7sQBj19L_cCRpg0rp.exe (PID: 6056)
      • WinProxy.exe (PID: 4932)
      • jsc.exe (PID: 3268)
      • EA4D.exe (PID: 7348)
      • AppLaunch.exe (PID: 3284)
      • 4hb569CM.exe (PID: 3124)
      • windefender.exe (PID: 6676)
      • windefender.exe (PID: 7896)
      • csrss.exe (PID: 7644)
    • Create files in a temporary directory

      • kBFiz5fBEO8W6rVIKQ5G25C2.exe (PID: 7804)
      • ZWtC6f_bRqpBy_0ziBKyd_4L.exe (PID: 7972)
      • EYtAeIUdhVkTd1bAqh9WFF4C.exe (PID: 6060)
      • 2Nx_5PGBv7Vpf5Y4ysEps7wm.exe (PID: 7872)
      • ZKba8xPBkuI3r0F4BmUagfkJ.exe (PID: 3716)
      • explorer.exe (PID: 4500)
      • F0C7.exe (PID: 8460)
      • nq0sZ04.exe (PID: 8480)
      • AZ3Px41.exe (PID: 8516)
      • 30FF.exe (PID: 7392)
      • explorer.exe (PID: 6452)
      • 30FF.exe (PID: 7684)
      • 30FF.tmp (PID: 6632)
      • 4hb569CM.exe (PID: 3124)
    • Creates files or folders in the user directory

      • setup.exe (PID: 7540)
      • 2Nx_5PGBv7Vpf5Y4ysEps7wm.exe (PID: 7872)
      • u4GcQBT7sQBj19L_cCRpg0rp.exe (PID: 8016)
      • explorer.exe (PID: 4500)
      • I25O7_Jb7VF7dhLNowxDBvx5.exe (PID: 7784)
      • WerFault.exe (PID: 4936)
      • BpCQVeXVekb0t5lbBQ31uW7A.exe (PID: 3712)
      • wgFRtNtecGRIviEPuvCntuXW.exe (PID: 6764)
      • t76w83FOzlkBuLtJrKEz5Qwg.exe (PID: 7340)
      • hPWR1krG3upNjQw8OviN_DLf.exe (PID: 6260)
      • WerFault.exe (PID: 4644)
      • u4GcQBT7sQBj19L_cCRpg0rp.exe (PID: 6056)
      • X8iZZQuqUMIQsqKIsUL_vLr8.exe (PID: 6856)
      • WinProxy.exe (PID: 4932)
      • jsc.exe (PID: 3268)
      • AppLaunch.exe (PID: 5388)
      • WerFault.exe (PID: 8492)
      • WerFault.exe (PID: 5548)
      • WerFault.exe (PID: 7692)
      • WerFault.exe (PID: 7468)
    • Reads Environment values

      • I25O7_Jb7VF7dhLNowxDBvx5.exe (PID: 7784)
      • 2Nx_5PGBv7Vpf5Y4ysEps7wm.exe (PID: 7872)
      • wgFRtNtecGRIviEPuvCntuXW.exe (PID: 6764)
      • AppLaunch.exe (PID: 5388)
      • UBrBCYPGH1FyjjqZR58SdjwY.exe (PID: 1552)
      • jsc.exe (PID: 3268)
      • EA4D.exe (PID: 7348)
      • 4hb569CM.exe (PID: 3124)
      • AppLaunch.exe (PID: 3284)
    • Creates files in the program directory

      • 2Nx_5PGBv7Vpf5Y4ysEps7wm.exe (PID: 7872)
      • I25O7_Jb7VF7dhLNowxDBvx5.exe (PID: 7784)
      • 6wZBRPiDOPgHECJq3zB_rWf3.exe (PID: 6508)
      • 30FF.tmp (PID: 6632)
      • gphoneapp.exe (PID: 2632)
      • updater.exe (PID: 7688)
      • gphoneapp.exe (PID: 9076)
    • Manual execution by a user

      • powershell.exe (PID: 6904)
      • cmd.exe (PID: 8132)
      • powershell.exe (PID: 3224)
      • cmd.exe (PID: 7488)
      • schtasks.exe (PID: 7644)
      • msedge.exe (PID: 7488)
      • EA4D.exe (PID: 7348)
      • F0C7.exe (PID: 8460)
      • 68.exe (PID: 8980)
      • powershell.exe (PID: 7052)
      • 1E32.exe (PID: 8984)
      • 30FF.exe (PID: 7392)
      • explorer.exe (PID: 6452)
      • cmd.exe (PID: 4132)
      • powershell.exe (PID: 8432)
      • cmd.exe (PID: 7380)
      • explorer.exe (PID: 5632)
      • conhost.exe (PID: 8220)
      • explorer.exe (PID: 6648)
      • B860.exe (PID: 7044)
    • Reads mouse settings

      • 1Ba04Zt6.exe (PID: 8536)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Tofsee

(PID) Process(6568) svchost.exe
C2 (2)vanaheim.cn
jotunheim.name
Encrypted Strings (59)c:\Windows
\system32\
ImagePath
.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
MSConfig
/r
.exe
cmd /C move /Y "%s" %s sc config %s binPath= "%s%s /d\"%s\"" sc start %s
svchost.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
ConsentPromptBehaviorAdmin
PromptOnSecureDesktop
MSConfig
:.repos
USERPROFILE
\Local Settings:.repos
USERPROFILE
\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.repos
USERPROFILE
\wincookie.repos
TMP
Config
Control Panel\Buses
Config
SOFTWARE\Microsoft\Buses
Config
Control Panel\Buses
Config
SOFTWARE\Microsoft\Buses
SYSTEM\CurrentControlSet\services
ImagePath
SYSTEM\CurrentControlSet\services
SYSTEM\CurrentControlSet\services
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
.exe
qazwsxed
%s%i%i%i%i.bat
@echo off :next_try del "%s">nul if exist "%s" ( ping 127.0.0.1 >nul goto next_try ) del %%0
svchost.exe
.exe
/u
USERPROFILE
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
/d
/e
/d
/e
.exe
"%s" /u"%s"
USERPROFILE
.exe
USERPROFILE
USERPROFILE
ver=%d lid=%d win=%X/%d sid=%s rep=%s
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
436
Monitored processes
280
Malicious processes
61
Suspicious processes
5

Behavior graph

Click at the process to see the details
start inject msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs sppextcomobj.exe no specs slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs textinputhost.exe no specs slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs winrar.exe no specs msedge.exe no specs setup.exe no specs #PRIVATELOADER setup.exe msedge.exe no specs msedge.exe no specs i25o7_jb7vf7dhlnowxdbvx5.exe qp7psktdjxzolwozxnzwvath.exe no specs kbfiz5fbeo8w6rvikq5g25c2.exe no specs #RISEPRO 2nx_5pgbv7vpf5y4yseps7wm.exe zwtc6f_brqpby_0zibkyd_4l.exe qjzhrbgt29rykwswp5erqeoj.exe no specs #STEALC _fts87rpx1ypkroyvrlh4ncl.exe ei9ke_gghb4daognekotpixw.exe no specs #PRIVATELOADER x8izzququmiqsqkisul_vlr8.exe #RISEPRO 8y0rfqjphvuvkk4swfd77nfd.exe #REDLINE wgfrtntecgriviepuvcntuxw.exe control.exe no specs ywefeb9hroxycxlbkqijvjol.exe hpwr1krg3upnjqw8ovin_dlf.exe no specs t76w83fozlkbultjrkez5qwg.exe no specs #PRIVATELOADER bpcqvexvekb0t5lbbq31uw7a.exe zkba8xpbkui3r0f4bmuagfkj.exe no specs eytaeiudhvktd1baqh9wff4c.exe no specs u4gcqbt7sqbj19l_ccrpg0rp.exe no specs rundll32.exe no specs cmd.exe no specs u4gcqbt7sqbj19l_ccrpg0rp.exe conhost.exe no specs #REDLINE applaunch.exe schtasks.exe no specs cmd.exe no specs conhost.exe no specs lg.exe werfault.exe cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs sc.exe no specs conhost.exe no specs winproxy.exe schtasks.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs werfault.exe no specs seuhvumq.exe #TOFSEE svchost.exe werfault.exe no specs werfault.exe #LUMMA regsvcs.exe #AMADEY ubrbcypgh1fyjjqzr58sdjwy.exe #LUMMA regsvcs.exe schtasks.exe no specs conhost.exe no specs 6wzbrpidopghecjq3zb_rwf3.exe no specs u4gcqbt7sqbj19l_ccrpg0rp.exe no specs #STOP u4gcqbt7sqbj19l_ccrpg0rp.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs #MINER svchost.exe conhost.exe no specs powershell.exe ubrbcypgh1fyjjqzr58sdjwy.exe no specs conhost.exe no specs cmd.exe conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs cmd.exe powershell.exe conhost.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs schtasks.exe conhost.exe no specs updater.exe no specs #REDLINE jsc.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs rundll32.exe no specs msedge.exe no specs rundll32.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs ea4d.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs #LUMMA msbuild.exe f0c7.exe no specs nq0sz04.exe no specs werfault.exe az3px41.exe no specs 1ba04zt6.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs 68.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs powershell.exe #LUMMA 2lw4292.exe conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs 1e32.exe no specs msedge.exe no specs 30ff.exe no specs cmd.exe 30ff.tmp no specs conhost.exe no specs #SMOKE explorer.exe sc.exe no specs sc.exe no specs 30ff.exe sc.exe no specs sc.exe no specs 30ff.tmp no specs sc.exe no specs cmd.exe powershell.exe conhost.exe no specs conhost.exe no specs #SMOKE explorer.exe powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs net.exe no specs gphoneapp.exe no specs conhost.exe no specs #SOCKS5SYSTEMZ gphoneapp.exe net1.exe no specs cmd.exe no specs conhost.exe no specs fodhelper.exe no specs fodhelper.exe no specs fodhelper.exe conhost.exe explorer.exe 1e32.exe no specs powershell.exe no specs conhost.exe no specs applaunch.exe no specs werfault.exe #REDLINE applaunch.exe #RISEPRO 4hb569cm.exe werfault.exe ubrbcypgh1fyjjqzr58sdjwy.exe no specs #GLUPTEBA 1e32.exe powershell.exe no specs conhost.exe no specs 6ud6ah2.exe no specs filecoauth.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs powershell.exe no specs conhost.exe no specs b860.exe werfault.exe powershell.exe no specs conhost.exe no specs #GLUPTEBA csrss.exe powershell.exe no specs conhost.exe no specs schtasks.exe no specs schtasks.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs mountvol.exe no specs conhost.exe no specs mountvol.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs #SMOKE explorer.exe schtasks.exe no specs conhost.exe no specs windefender.exe no specs conhost.exe no specs cmd.exe no specs sc.exe no specs windefender.exe no specs ubrbcypgh1fyjjqzr58sdjwy.exe no specs ubrbcypgh1fyjjqzr58sdjwy.exe no specs ubrbcypgh1fyjjqzr58sdjwy.exe no specs ubrbcypgh1fyjjqzr58sdjwy.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
432\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exepowershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
632powercfg /x -hibernate-timeout-dc 0 C:\Windows\System32\powercfg.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\powrprof.dll
756icacls "C:\Users\admin\AppData\Local\475344d6-f644-487c-a675-19cda3bf5093" /deny *S-1-1-0:(OI)(CI)(DE,DC)C:\Windows\SysWOW64\icacls.exeu4GcQBT7sQBj19L_cCRpg0rp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
872sc stop UsoSvc C:\Windows\System32\sc.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1096powershell -nologo -noprofileC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.execsrss.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
1124"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2072,i,9170237658692207260,10841260903811503162,131072 /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
111.0.1661.62
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\111.0.1661.62\msedge_elf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptbase.dll
1268"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7736 --field-trial-handle=2072,i,9170237658692207260,10841260903811503162,131072 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
111.0.1661.62
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\111.0.1661.62\msedge_elf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptbase.dll
1376\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1532"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2004 --field-trial-handle=2148,i,15554572623158646236,13688197875979832600,131072 /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
111.0.1661.62
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\111.0.1661.62\msedge_elf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptbase.dll
1552"C:\Users\admin\Pictures\Minor Policy\UBrBCYPGH1FyjjqZR58SdjwY.exe" C:\Users\admin\Pictures\Minor Policy\UBrBCYPGH1FyjjqZR58SdjwY.exe
BpCQVeXVekb0t5lbBQ31uW7A.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\pictures\minor policy\ubrbcypgh1fyjjqzr58sdjwy.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
134 417
Read events
133 752
Write events
531
Delete events
134

Modification events

(PID) Process:(3964) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3964) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3964) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(3964) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3964) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:dr
Value:
1
(PID) Process:(3964) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(3964) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
74A98451B7602F00
(PID) Process:(3964) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge
Operation:writeName:UsageStatsInSample
Value:
1
(PID) Process:(3964) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:usagestats
Value:
0
(PID) Process:(3964) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:urlstats
Value:
0
Executable files
215
Suspicious files
567
Text files
267
Unknown types
2

Dropped files

PID
Process
Filename
Type
3964msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RFf2d9e.TMP
MD5:
SHA256:
3964msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old
MD5:
SHA256:
3964msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RFf2dcd.TMP
MD5:
SHA256:
3964msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old
MD5:
SHA256:
3964msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RFf2dfc.TMP
MD5:
SHA256:
3964msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old
MD5:
SHA256:
3964msedge.exeC:\USERS\ADMIN\APPDATA\LOCAL\MICROSOFT\EDGE\USER DATA\VARIATIONSbinary
MD5:6E1AF7D7074A6124EFDB62180565A385
SHA256:70811DE44C337675FCFFDA381E8AB2FB66544B07FFCAE651804B75EF71C11748
3964msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old~RFf2d9e.TMPtext
MD5:5DB127C66F688E2B285A0816EC4BDE1C
SHA256:1A490965A2E4688809FF31A5DB1971688F92700DEFA536BEF28D91512B9AA966
3964msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\7d365b05-a2d5-4edc-b603-8aac0b16cb83.tmpbinary
MD5:4AA39D89F742B0B5C16F91E9F4C90107
SHA256:3B1B2EE11FF17A49217A995ABBDB8F5D01601217CFA939BA209F29B264D9723A
3964msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.oldtext
MD5:63D47248EB1C3F5B97CAAE6599A6FCD0
SHA256:4124BD344E193D3DDBE94EF996C5AFBEA6C00C939F405B3CCBEE9058BA5AE257
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
308
TCP/UDP connections
627
DNS requests
315
Threats
293

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2476
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
320
svchost.exe
GET
200
104.119.109.218:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
binary
814 b
unknown
320
svchost.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
binary
1.11 Kb
unknown
1092
svchost.exe
POST
302
23.211.9.234:80
http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409
unknown
unknown
7384
SIHClient.exe
GET
200
104.119.109.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
binary
409 b
unknown
7384
SIHClient.exe
GET
200
104.119.109.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
binary
418 b
unknown
1092
svchost.exe
POST
502
52.142.223.178:80
http://dmd.metaservices.microsoft.com/metadata.svc
unknown
html
183 b
unknown
1092
svchost.exe
POST
502
52.142.223.178:80
http://dmd.metaservices.microsoft.com/metadata.svc
unknown
html
183 b
unknown
1092
svchost.exe
POST
302
23.211.9.234:80
http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409
unknown
unknown
1092
svchost.exe
POST
302
23.211.9.234:80
http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409
unknown
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3720
svchost.exe
239.255.255.250:1900
whitelisted
3964
msedge.exe
239.255.255.250:1900
whitelisted
1124
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1124
msedge.exe
20.103.180.120:443
nav-edge.smartscreen.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
1124
msedge.exe
51.104.176.40:443
nav-edge.smartscreen.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1124
msedge.exe
103.138.151.6:443
rtexcorporation.com
Purple IT Ltd
BD
unknown
1124
msedge.exe
204.79.197.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1124
msedge.exe
13.107.213.62:443
edgeassetservice.azureedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3964
msedge.exe
224.0.0.251:5353
unknown
2476
svchost.exe
20.190.159.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
rtexcorporation.com
  • 103.138.151.6
unknown
config.edge.skype.com
  • 13.107.42.16
whitelisted
nav-edge.smartscreen.microsoft.com
  • 20.103.180.120
  • 51.104.176.40
whitelisted
data-edge.smartscreen.microsoft.com
  • 51.104.176.40
whitelisted
dl-edge.smartscreen.microsoft.com
  • 51.104.176.40
whitelisted
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
edgeassetservice.azureedge.net
  • 13.107.213.62
  • 13.107.246.62
whitelisted
login.live.com
  • 20.190.159.64
  • 20.190.159.23
  • 20.190.159.75
  • 20.190.159.73
  • 20.190.159.2
  • 20.190.159.68
  • 40.126.31.67
  • 40.126.31.69
  • 40.126.31.73
  • 20.190.159.71
whitelisted
edgeservices.bing.com
  • 2.23.209.130
  • 2.23.209.182
  • 2.23.209.133
whitelisted
www2.bing.com
  • 13.107.21.200
  • 204.79.197.200
whitelisted

Threats

PID
Process
Class
Message
7540
setup.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/BeamWinHTTP CnC Activity M2 (GET)
7540
setup.exe
Device Retrieving External IP Address Detected
ET INFO Observed External IP Lookup Domain in TLS SNI (api .myip .com)
7540
setup.exe
Device Retrieving External IP Address Detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
7540
setup.exe
Device Retrieving External IP Address Detected
ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io)
7540
setup.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 25
7540
setup.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7540
setup.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7540
setup.exe
Misc activity
ET INFO Packed Executable Download
7540
setup.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 20
7540
setup.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
49 ETPRO signatures available at the full report
Process
Message
8y0rfqjpHvUvKK4SwFD77NfD.exe
5yh45
8y0rfqjpHvUvKK4SwFD77NfD.exe
5yh45
8y0rfqjpHvUvKK4SwFD77NfD.exe
5yh45
8y0rfqjpHvUvKK4SwFD77NfD.exe
5yh45
8y0rfqjpHvUvKK4SwFD77NfD.exe
5445dfg
8y0rfqjpHvUvKK4SwFD77NfD.exe
th1y5atj8
msedge.exe
[1217/081221.227:ERROR:exception_handler_server.cc(527)] ConnectNamedPipe: The pipe is being closed. (0xE8)
msedge.exe
[1217/081222.734:ERROR:exception_handler_server.cc(527)] ConnectNamedPipe: The pipe is being closed. (0xE8)
msedge.exe
[1217/081223.043:ERROR:exception_handler_server.cc(527)] ConnectNamedPipe: The pipe is being closed. (0xE8)
msedge.exe
[1217/081224.012:ERROR:exception_handler_server.cc(527)] ConnectNamedPipe: The pipe is being closed. (0xE8)