File name:

2025-05-18_71672ae9ffa17c8fc12c39cd5414fb0a_amadey_elex_gcleaner_rhadamanthys_smoke-loader_urelas

Full analysis: https://app.any.run/tasks/0969c298-376e-447b-88fd-d8b37ea05714
Verdict: Malicious activity
Analysis date: May 18, 2025, 02:46:05
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
urelas
bootkit
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, PECompact2 compressed, 4 sections
MD5:

71672AE9FFA17C8FC12C39CD5414FB0A

SHA1:

B437C5A07B706351579F73F08D94287A102B3B8B

SHA256:

EFD4CD9AB3B8129CA171A6C44C68A6255D7EC71DB21C76F42ECAA5AA2A99622C

SSDEEP:

12288:n8T263i00zxoZthdXnG3xRqpNGkPEGlPei:n8a6y00zx0HG3xRUIkPEGlPei

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • URELAS has been detected

      • 2025-05-18_71672ae9ffa17c8fc12c39cd5414fb0a_amadey_elex_gcleaner_rhadamanthys_smoke-loader_urelas.exe (PID: 7012)
      • cmd.exe (PID: 7148)
      • tevux.exe (PID: 5244)
      • hovup.exe (PID: 5384)

    • URELAS has been detected (YARA)

      • tevux.exe (PID: 5244)
      • hovup.exe (PID: 5384)

    • URELAS mutex has been found

      • tevux.exe (PID: 5244)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 2025-05-18_71672ae9ffa17c8fc12c39cd5414fb0a_amadey_elex_gcleaner_rhadamanthys_smoke-loader_urelas.exe (PID: 7012)
      • tevux.exe (PID: 5244)
      • hovup.exe (PID: 5384)

    • Starts itself from another location

      • 2025-05-18_71672ae9ffa17c8fc12c39cd5414fb0a_amadey_elex_gcleaner_rhadamanthys_smoke-loader_urelas.exe (PID: 7012)

    • Starts CMD.EXE for commands execution

      • 2025-05-18_71672ae9ffa17c8fc12c39cd5414fb0a_amadey_elex_gcleaner_rhadamanthys_smoke-loader_urelas.exe (PID: 7012)

    • Reads security settings of Internet Explorer

      • 2025-05-18_71672ae9ffa17c8fc12c39cd5414fb0a_amadey_elex_gcleaner_rhadamanthys_smoke-loader_urelas.exe (PID: 7012)
      • tevux.exe (PID: 5244)

    • Executing commands from a ".bat" file

      • 2025-05-18_71672ae9ffa17c8fc12c39cd5414fb0a_amadey_elex_gcleaner_rhadamanthys_smoke-loader_urelas.exe (PID: 7012)

    • Connects to unusual port

      • tevux.exe (PID: 5244)

    • There is functionality for taking screenshot (YARA)

      • hovup.exe (PID: 5384)

  • INFO

    • Reads the computer name

      • 2025-05-18_71672ae9ffa17c8fc12c39cd5414fb0a_amadey_elex_gcleaner_rhadamanthys_smoke-loader_urelas.exe (PID: 7012)
      • tevux.exe (PID: 5244)

    • Process checks computer location settings

      • 2025-05-18_71672ae9ffa17c8fc12c39cd5414fb0a_amadey_elex_gcleaner_rhadamanthys_smoke-loader_urelas.exe (PID: 7012)
      • tevux.exe (PID: 5244)

    • Checks supported languages

      • 2025-05-18_71672ae9ffa17c8fc12c39cd5414fb0a_amadey_elex_gcleaner_rhadamanthys_smoke-loader_urelas.exe (PID: 7012)
      • tevux.exe (PID: 5244)
      • hovup.exe (PID: 5384)

    • Create files in a temporary directory

      • 2025-05-18_71672ae9ffa17c8fc12c39cd5414fb0a_amadey_elex_gcleaner_rhadamanthys_smoke-loader_urelas.exe (PID: 7012)
      • tevux.exe (PID: 5244)
      • hovup.exe (PID: 5384)

    • Checks proxy server information

      • slui.exe (PID: 5064)

    • Reads the software policy settings

      • slui.exe (PID: 5064)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (36.8)
.exe | Win32 Executable MS Visual C++ (generic) (26.6)
.exe | Win64 Executable (generic) (23.6)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:09:09 07:29:59+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 110592
InitializedDataSize: 253952
UninitializedDataSize: -
EntryPoint: 0xc9e9
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
6
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #URELAS 2025-05-18_71672ae9ffa17c8fc12c39cd5414fb0a_amadey_elex_gcleaner_rhadamanthys_smoke-loader_urelas.exe #URELAS tevux.exe #URELAS cmd.exe no specs conhost.exe no specs slui.exe #URELAS hovup.exe

Process information

PID
CMD
Path
Indicators
Parent process
5064C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5244"C:\Users\admin\AppData\Local\Temp\tevux.exe" C:\Users\admin\AppData\Local\Temp\tevux.exe
2025-05-18_71672ae9ffa17c8fc12c39cd5414fb0a_amadey_elex_gcleaner_rhadamanthys_smoke-loader_urelas.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\tevux.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5384"C:\Users\admin\AppData\Local\Temp\hovup.exe" C:\Users\admin\AppData\Local\Temp\hovup.exe
tevux.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\hovup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5544\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7012"C:\Users\admin\Desktop\2025-05-18_71672ae9ffa17c8fc12c39cd5414fb0a_amadey_elex_gcleaner_rhadamanthys_smoke-loader_urelas.exe" C:\Users\admin\Desktop\2025-05-18_71672ae9ffa17c8fc12c39cd5414fb0a_amadey_elex_gcleaner_rhadamanthys_smoke-loader_urelas.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\2025-05-18_71672ae9ffa17c8fc12c39cd5414fb0a_amadey_elex_gcleaner_rhadamanthys_smoke-loader_urelas.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7148C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\_uinsey.bat" "C:\Windows\SysWOW64\cmd.exe
2025-05-18_71672ae9ffa17c8fc12c39cd5414fb0a_amadey_elex_gcleaner_rhadamanthys_smoke-loader_urelas.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
4 225
Read events
4 225
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
0
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
5244tevux.exeC:\Users\admin\AppData\Local\Temp\hovup.exeexecutable
MD5:F27004E093A89CBC480464E7C7093796
SHA256:F7356584308B78AC0507AAE772344838B5A7A5DA9969D331B57CE605878FA9B6
5384hovup.exeC:\Users\admin\AppData\Local\Temp\tevux.exeexecutable
MD5:0F46AF4CE5C44674BC11C87F61E809B3
SHA256:5C0CB229E86FE929D9788312EE91A9EA8BCCCF7A632972E3B405AAF2BF3B84AB
70122025-05-18_71672ae9ffa17c8fc12c39cd5414fb0a_amadey_elex_gcleaner_rhadamanthys_smoke-loader_urelas.exeC:\Users\admin\AppData\Local\Temp\golfinfo.initext
MD5:8D66D75F291FECFB999348BEE01764D8
SHA256:9BE97C453484C47634AE82B2E88656C4D54971314076114D0805A9326FC9499B
70122025-05-18_71672ae9ffa17c8fc12c39cd5414fb0a_amadey_elex_gcleaner_rhadamanthys_smoke-loader_urelas.exeC:\Users\admin\AppData\Local\Temp\tevux.exeexecutable
MD5:83DAA18CB6831AF701B39C027938E5F0
SHA256:E3B4A02B97A54A0F16FA92FBEE17566CDA87F5CD32849BAE4812D3FB3CEA079A
70122025-05-18_71672ae9ffa17c8fc12c39cd5414fb0a_amadey_elex_gcleaner_rhadamanthys_smoke-loader_urelas.exeC:\Users\admin\AppData\Local\Temp\_uinsey.battext
MD5:EFEB887018262A2C775A06D6120577AB
SHA256:DFE3833E1A09BE38B50F8D7EE50A86D9FA896BA7506A70048D021529495AD82B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
48
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4628
RUXIMICS.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4628
RUXIMICS.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6272
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
6272
SIHClient.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
6272
SIHClient.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
6272
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6272
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
6272
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
6272
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4628
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4628
RUXIMICS.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4628
RUXIMICS.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5244
tevux.exe
218.54.31.226:11110
—
SK Broadband Co Ltd
KR
malicious

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.110
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.159.4
  • 20.190.159.131
  • 40.126.31.131
  • 20.190.159.71
  • 40.126.31.1
  • 40.126.31.0
  • 20.190.159.129
  • 20.190.159.23
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.13
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-05-18_71672ae9ffa17c8fc12c39cd5414fb0a_amadey_elex_gcleaner_rhadamanthys_smoke-loader_urelas