Find similar analyses in TI Lookup

Analysis date (UTC): 29 October 2024, 20:55Analysis environment: Windows 10 Pro, build 19045, x64

https://lakadmakatdg.shop/home.tar

MD5:5E3ECDC32A46DC4962B3401532E00068

SHA1:B6299D9A0D8659B475E16628826120AAF4A0EE82

SHA256:F406531BA36315E70B83CC6A8B8606A0ED3CC5060D31CC05C8B3A4B2E83E12CE

Analysis result

Threat level:Malicious activity

Tags:

phishingarch-execamadeybotnetstealer

Full analysis:Analysis https://lakadmakatdg.shop/home.tar Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

PHISHING has been detected (SURICATA)

msedge.exe (PID: 3648)

Antivirus name has been found in the command line (generic signature)

cmd.exe (PID: 5980)
find.exe (PID: 7944)
tasklist.exe (PID: 8156)
tasklist.exe (PID: 7356)
cmd.exe (PID: 7344)
find.exe (PID: 7260)
cmd.exe (PID: 7656)
tasklist.exe (PID: 7828)
find.exe (PID: 7772)
cmd.exe (PID: 4208)
tasklist.exe (PID: 6804)
find.exe (PID: 1200)
cmd.exe (PID: 7740)
tasklist.exe (PID: 6428)
find.exe (PID: 7692)
cmd.exe (PID: 7764)
tasklist.exe (PID: 2280)
find.exe (PID: 7340)
cmd.exe (PID: 5048)
tasklist.exe (PID: 7820)
cmd.exe (PID: 6540)
find.exe (PID: 7776)
tasklist.exe (PID: 7740)
tasklist.exe (PID: 7844)
find.exe (PID: 7988)
cmd.exe (PID: 2736)
cmd.exe (PID: 8132)
find.exe (PID: 3076)
tasklist.exe (PID: 2816)
find.exe (PID: 6324)

Starts CMD.EXE for self-deleting

Updater.exe (PID: 2928)

Connects to the CnC server

MSBuild.exe (PID: 2376)

AMADEY has been detected (SURICATA)

MSBuild.exe (PID: 2376)

SUSPICIOUS

Executable content was dropped or overwritten

Reminder.exe (PID: 1008)
Reminder.tmp (PID: 3744)
Reminder.exe (PID: 5264)
Reminder.tmp (PID: 4236)
Reminder.tmp (PID: 8032)
Reminder.exe (PID: 2416)
Reminder.exe (PID: 5980)
Reminder.tmp (PID: 7936)
Updater.exe (PID: 3620)

Get information on the list of running processes

Reminder.tmp (PID: 4236)
cmd.exe (PID: 5980)
cmd.exe (PID: 6228)
cmd.exe (PID: 7344)
cmd.exe (PID: 7656)
cmd.exe (PID: 4208)
cmd.exe (PID: 7740)
cmd.exe (PID: 7764)
cmd.exe (PID: 7492)
Reminder.tmp (PID: 7936)
cmd.exe (PID: 5048)
cmd.exe (PID: 6540)
cmd.exe (PID: 2736)
cmd.exe (PID: 8132)

Starts CMD.EXE for commands execution

Reminder.tmp (PID: 4236)
Reminder.tmp (PID: 7936)
Updater.exe (PID: 2928)

Connects to the server without a host name

MSBuild.exe (PID: 2376)

Hides command output

cmd.exe (PID: 6408)

Contacting a server suspected of hosting an CnC

MSBuild.exe (PID: 2376)

Runs PING.EXE to delay simulation

cmd.exe (PID: 6408)

The executable file from the user directory is run by the CMD process

Updater.exe (PID: 3620)

INFO

Application launched itself

msedge.exe (PID: 6436)

Manual execution by a user

WinRAR.exe (PID: 7320)
Reminder.exe (PID: 1008)
Reminder.exe (PID: 2416)

Executable content was dropped or overwritten

WinRAR.exe (PID: 7320)
msedge.exe (PID: 5956)

Threats

PID	Process	Class	Message
3648	msedge.exe	Possible Social Engineering Attempted	PHISHING [ANY.RUN] Suspected Phishing domain by CrossDomain (lakadmakatdg .shop)
3648	msedge.exe	Possible Social Engineering Attempted	PHISHING [ANY.RUN] Suspected Phishing domain by CrossDomain (lakadmakatdg .shop)
2376	MSBuild.exe	Misc Attack	ET DROP Spamhaus DROP Listed Traffic Inbound group 24
2376	MSBuild.exe	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
3648	msedge.exe	Not Suspicious Traffic	INFO [ANY.RUN] An application monitoring request to sentry .io
3648	msedge.exe	Not Suspicious Traffic	INFO [ANY.RUN] An application monitoring request to sentry .io
3648	msedge.exe	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
3648	msedge.exe	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)