File name:

2025-05-16_653f346c8b31f0cd31c2ff188f5fe10b_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader

Full analysis: https://app.any.run/tasks/46f7143a-b704-471b-b92f-ec7f1d96dde3
Verdict: Malicious activity
Analysis date: May 16, 2025, 08:41:13
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
sakula
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

653F346C8B31F0CD31C2FF188F5FE10B

SHA1:

5E0289DD36CC7C31A96CB8C6AA239340ECA71AD1

SHA256:

F339C8A4A4D6906DBEEA41023F1FBB5F9052A8F96AD105E87558530C2E0FE558

SSDEEP:

1536:cZoUZR6RnYmE2q73nTWPZJA1zekntfaMBRId6HQmRc0nNU/+AE57:c6NYx/nYZJA5cMUepnNU/C

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • 2025-05-16_653f346c8b31f0cd31c2ff188f5fe10b_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader.exe (PID: 5392)

    • SAKULA has been detected

      • 2025-05-16_653f346c8b31f0cd31c2ff188f5fe10b_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader.exe (PID: 5392)

    • Starts CMD.EXE for self-deleting

      • 2025-05-16_653f346c8b31f0cd31c2ff188f5fe10b_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader.exe (PID: 5392)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 2025-05-16_653f346c8b31f0cd31c2ff188f5fe10b_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader.exe (PID: 5392)

    • Starts itself from another location

      • 2025-05-16_653f346c8b31f0cd31c2ff188f5fe10b_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader.exe (PID: 5392)

    • Reads security settings of Internet Explorer

      • 2025-05-16_653f346c8b31f0cd31c2ff188f5fe10b_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader.exe (PID: 5392)

    • Starts CMD.EXE for commands execution

      • 2025-05-16_653f346c8b31f0cd31c2ff188f5fe10b_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader.exe (PID: 5392)

  • INFO

    • Checks supported languages

      • 2025-05-16_653f346c8b31f0cd31c2ff188f5fe10b_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader.exe (PID: 5392)

    • Auto-launch of the file from Registry key

      • 2025-05-16_653f346c8b31f0cd31c2ff188f5fe10b_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader.exe (PID: 5392)

    • Reads the computer name

      • 2025-05-16_653f346c8b31f0cd31c2ff188f5fe10b_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader.exe (PID: 5392)

    • Create files in a temporary directory

      • 2025-05-16_653f346c8b31f0cd31c2ff188f5fe10b_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader.exe (PID: 5392)

    • Process checks computer location settings

      • 2025-05-16_653f346c8b31f0cd31c2ff188f5fe10b_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader.exe (PID: 5392)

    • Manual execution by a user

      • AdobeUpdate.exe (PID: 6036)

    • Checks proxy server information

      • slui.exe (PID: 5800)

    • Reads the software policy settings

      • slui.exe (PID: 5800)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:04:02 06:46:11+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 57344
InitializedDataSize: 32768
UninitializedDataSize: -
EntryPoint: 0x4d59
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
7
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #SAKULA 2025-05-16_653f346c8b31f0cd31c2ff188f5fe10b_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader.exe adobeupdate.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs adobeupdate.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
3100\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4724ping 127.0.0.1 C:\Windows\SysWOW64\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5008"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\admin\Desktop\2025-05-16_653f346c8b31f0cd31c2ff188f5fe10b_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader.exe"C:\Windows\SysWOW64\cmd.exe—2025-05-16_653f346c8b31f0cd31c2ff188f5fe10b_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5392"C:\Users\admin\Desktop\2025-05-16_653f346c8b31f0cd31c2ff188f5fe10b_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader.exe" C:\Users\admin\Desktop\2025-05-16_653f346c8b31f0cd31c2ff188f5fe10b_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\2025-05-16_653f346c8b31f0cd31c2ff188f5fe10b_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5800C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6036C:\Users\admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeC:\Users\admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\micromedia\adobeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6644C:\Users\admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeC:\Users\admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe—2025-05-16_653f346c8b31f0cd31c2ff188f5fe10b_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\micromedia\adobeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
3 915
Read events
3 914
Write events
1
Delete events
0

Modification events

(PID) Process:(5392) 2025-05-16_653f346c8b31f0cd31c2ff188f5fe10b_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:AdobeUpdate
Value:
C:\Users\admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
53922025-05-16_653f346c8b31f0cd31c2ff188f5fe10b_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader.exeC:\Users\admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeexecutable
MD5:CB9516495CF26BF8203869BB55DEF628
SHA256:29929D7FE4A6C86BA62402DDB937411A766194BB4E494FF143BD720EEAAC66B6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
32
TCP/UDP connections
47
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
2.20.245.137:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
200
20.190.159.131:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
—
—
POST
400
40.126.31.3:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
400
20.190.159.68:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
400
20.190.159.64:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
400
20.190.159.73:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
400
20.190.159.128:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
—
—
whitelisted
—
—
POST
400
20.190.159.71:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
400
20.190.159.2:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2104
svchost.exe
2.20.245.137:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
2104
svchost.exe
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
6544
svchost.exe
20.190.160.65:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
  • 20.73.194.208
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.78
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
crl.microsoft.com
  • 2.20.245.137
  • 2.20.245.139
whitelisted
www.microsoft.com
  • 23.219.150.101
  • 95.101.149.131
whitelisted
login.live.com
  • 20.190.160.65
  • 20.190.160.20
  • 40.126.32.136
  • 40.126.32.133
  • 20.190.160.4
  • 40.126.32.74
  • 20.190.160.5
  • 40.126.32.140
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.48
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-05-16_653f346c8b31f0cd31c2ff188f5fe10b_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader