File name:

Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13

Full analysis: https://app.any.run/tasks/37c113e0-743c-4801-880f-7c321a9b8ba5
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 15:40:56
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
lumma
stealer
themida
loader
amadey
botnet
rdp
evasion
telegram
gcleaner
enigma
delphi
antivm
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

C51CB0F1AD78C3DFF012B7C89B007DB8

SHA1:

93E259385AFD7A6DCDB53596A51B0B9063D071CC

SHA256:

05CD844545F7741D2B822A7E96BB86000EB5C9B3C91876ED3E5A956338EB1D13

SSDEEP:

98304:YyTyIX/35fZ+UsNM6byhoPqZvWmcQzcN1eSsLDjYIZN7MH+jW2CT13l2laJckPTv:Uz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA mutex has been found

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • MSBuild.exe (PID: 864)
      • MSBuild.exe (PID: 7144)

    • LUMMA has been detected (SURICATA)

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • svchost.exe (PID: 2196)
      • MSBuild.exe (PID: 7144)

    • Steals credentials from Web Browsers

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • MSBuild.exe (PID: 864)
      • MSBuild.exe (PID: 7144)

    • Actions looks like stealing of personal data

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • MSBuild.exe (PID: 864)
      • MSBuild.exe (PID: 7144)

    • LUMMA has been detected (YARA)

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)

    • Connects to the CnC server

      • svchost.exe (PID: 2196)
      • ramez.exe (PID: 2504)

    • AMADEY mutex has been found

      • 69ROCCX6I6UZEFKBG67R2ETK.exe (PID: 6988)
      • ramez.exe (PID: 2504)
      • ramez.exe (PID: 6632)

    • AMADEY has been detected (YARA)

      • ramez.exe (PID: 2504)

    • Application was injected by another process

      • svchost.exe (PID: 6740)
      • svchost.exe (PID: 5720)

    • AMADEY has been detected (SURICATA)

      • ramez.exe (PID: 2504)

    • Executing a file with an untrusted certificate

      • HGVm49v.exe (PID: 5084)

    • Runs injected code in another process

      • e5jg7MM.exe (PID: 6048)

    • GCLEANER has been detected (SURICATA)

      • da22316bc0.exe (PID: 5600)

  • SUSPICIOUS

    • Reads the BIOS version

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • 69ROCCX6I6UZEFKBG67R2ETK.exe (PID: 6988)
      • ramez.exe (PID: 2504)
      • e5jg7MM.exe (PID: 6048)
      • ramez.exe (PID: 6632)

    • Contacting a server suspected of hosting an CnC

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • svchost.exe (PID: 2196)
      • ramez.exe (PID: 2504)
      • MSBuild.exe (PID: 7144)

    • Searches for installed software

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • MSBuild.exe (PID: 864)

    • Connects to the server without a host name

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • ramez.exe (PID: 2504)
      • svchost.exe (PID: 5720)
      • da22316bc0.exe (PID: 5600)

    • Process requests binary or script from the Internet

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • ramez.exe (PID: 2504)

    • Potential Corporate Privacy Violation

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • ramez.exe (PID: 2504)
      • da22316bc0.exe (PID: 5600)

    • Reads security settings of Internet Explorer

      • 69ROCCX6I6UZEFKBG67R2ETK.exe (PID: 6988)
      • ramez.exe (PID: 2504)
      • da22316bc0.exe (PID: 5600)

    • Executable content was dropped or overwritten

      • 69ROCCX6I6UZEFKBG67R2ETK.exe (PID: 6988)
      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • ramez.exe (PID: 2504)
      • da22316bc0.exe (PID: 5600)

    • Starts itself from another location

      • 69ROCCX6I6UZEFKBG67R2ETK.exe (PID: 6988)

    • There is functionality for enable RDP (YARA)

      • ramez.exe (PID: 2504)

    • Application launched itself

      • svchost.exe (PID: 6740)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • svchost.exe (PID: 5720)

    • There is functionality for taking screenshot (YARA)

      • da22316bc0.exe (PID: 5600)

    • There is functionality for VM detection VirtualBox (YARA)

      • da22316bc0.exe (PID: 5600)

    • Starts CMD.EXE for commands execution

      • svchost.exe (PID: 5720)

    • The process executes via Task Scheduler

      • ramez.exe (PID: 6632)
      • PLUGScheduler.exe (PID: 884)

    • Executes application which crashes

      • HGVm49v.exe (PID: 5084)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • MSBuild.exe (PID: 864)

  • INFO

    • Reads the machine GUID from the registry

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • da22316bc0.exe (PID: 5600)
      • MSBuild.exe (PID: 7144)
      • MSBuild.exe (PID: 864)

    • Checks supported languages

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • ramez.exe (PID: 2504)
      • 69ROCCX6I6UZEFKBG67R2ETK.exe (PID: 6988)
      • e5jg7MM.exe (PID: 6048)
      • da22316bc0.exe (PID: 5600)
      • HGVm49v.exe (PID: 5084)
      • ramez.exe (PID: 6632)
      • MSBuild.exe (PID: 864)
      • d1oAX1c.exe (PID: 2568)
      • MSBuild.exe (PID: 7144)

    • Reads the computer name

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • 69ROCCX6I6UZEFKBG67R2ETK.exe (PID: 6988)
      • ramez.exe (PID: 2504)
      • da22316bc0.exe (PID: 5600)
      • MSBuild.exe (PID: 7144)
      • MSBuild.exe (PID: 864)

    • Reads the software policy settings

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • MSBuild.exe (PID: 864)
      • da22316bc0.exe (PID: 5600)
      • MSBuild.exe (PID: 7144)

    • Themida protector has been detected

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • ramez.exe (PID: 2504)

    • Create files in a temporary directory

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • 69ROCCX6I6UZEFKBG67R2ETK.exe (PID: 6988)
      • ramez.exe (PID: 2504)
      • da22316bc0.exe (PID: 5600)

    • Checks proxy server information

      • ramez.exe (PID: 2504)
      • da22316bc0.exe (PID: 5600)

    • Process checks computer location settings

      • 69ROCCX6I6UZEFKBG67R2ETK.exe (PID: 6988)
      • ramez.exe (PID: 2504)

    • Creates files or folders in the user directory

      • ramez.exe (PID: 2504)
      • WerFault.exe (PID: 6964)
      • da22316bc0.exe (PID: 5600)

    • Enigma protector has been detected

      • da22316bc0.exe (PID: 5600)

    • Compiled with Borland Delphi (YARA)

      • da22316bc0.exe (PID: 5600)

    • Attempting to use instant messaging service

      • MSBuild.exe (PID: 864)

    • The sample compiled with english language support

      • ramez.exe (PID: 2504)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Lumma

(PID) Process(3268) Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe
C2 (9)featurlyin.top/pdal
overcovtcg.top/juhd
meteorplyp.live/lekp
zmedtipp.live/mnvzx
flowerexju.bet/lanz
posseswsnc.top/akds
araucahkbm.live/baneb
blackswmxc.top/bgry
easterxeen.run/zavc

Amadey

(PID) Process(2504) ramez.exe
C2185.156.72.96
URLhttp://185.156.72.96/te4h2nus/index.php
Version5.34
Options
Drop directoryd610cf342e
Drop nameramez.exe
Strings (125)lv:
msi
Kaspersky Lab
av:
|
#
"
\App
00000422
dm:
Powershell.exe
ProgramData\
ps1
rundll32
http://
Content-Disposition: form-data; name="data"; filename="
SOFTWARE\Microsoft\Windows NT\CurrentVersion
dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
id:
VideoID
cred.dll|clip.dll|
0000043f
cmd
00000423
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
-executionpolicy remotesigned -File "
2022
------
2016
og:
\0000
CurrentBuild
2019
:::
S-%lu-
" && timeout 1 && del
ProductName
Panda Security
ESET
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
/k
+++
?scr=1
Doctor Web
GET
SYSTEM\ControlSet001\Services\BasicDisplay\Video
/quiet
.jpg
d610cf342e
vs:
sd:
rundll32.exe
"taskkill /f /im "
pc:
random
=
360TotalSecurity
<d>
wb
Content-Type: multipart/form-data; boundary=----
Startup
Norton
&& Exit"
os:
https://
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
2025
Avira
%-lu
zip
POST
" Content-Type: application/octet-stream
Rem
/te4h2nus/index.php
------
5.34
<c>
clip.dll
AVAST Software
\
shell32.dll
" && ren
e3
ramez.exe
kernel32.dll
DefaultSettings.XResolution
d1
DefaultSettings.YResolution
185.156.72.96
r=
cred.dll
--
GetNativeSystemInfo
-%lu
ComputerName
&unit=
Keyboard Layout\Preload
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
ar:
Sophos
%USERPROFILE%
exe
e1
e2
st=s
Programs
0123456789
un:
rb
bi:
abcdefghijklmnopqrstuvwxyz0123456789-_
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
cmd /C RMDIR /s/q
Bitdefender
-unicode-
AVG
WinDefender
&&
shutdown -s -t 0
Comodo
00000419
Content-Type: application/x-www-form-urlencoded
/Plugins/
Main
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:08 12:17:36+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 314880
InitializedDataSize: 37376
UninitializedDataSize: -
EntryPoint: 0x48a000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
259
Monitored processes
17
Malicious processes
13
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #LUMMA sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe #LUMMA svchost.exe 69roccx6i6uzefkbg67r2etk.exe #AMADEY ramez.exe #GCLEANER da22316bc0.exe e5jg7mm.exe no specs svchost.exe svchost.exe ramez.exe no specs hgvm49v.exe #LUMMA msbuild.exe werfault.exe no specs slui.exe no specs d1oax1c.exe no specs msbuild.exe no specs #LUMMA msbuild.exe plugscheduler.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
864"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
HGVm49v.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
884"C:\Program Files\RUXIM\PLUGscheduler.exe"C:\Program Files\RUXIM\PLUGScheduler.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Update LifeCycle Component Scheduler
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\plugscheduler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2504"C:\Users\admin\AppData\Local\Temp\d610cf342e\ramez.exe" C:\Users\admin\AppData\Local\Temp\d610cf342e\ramez.exe
69ROCCX6I6UZEFKBG67R2ETK.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\d610cf342e\ramez.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Amadey
(PID) Process(2504) ramez.exe
C2185.156.72.96
URLhttp://185.156.72.96/te4h2nus/index.php
Version5.34
Options
Drop directoryd610cf342e
Drop nameramez.exe
Strings (125)lv:
msi
Kaspersky Lab
av:
|
#
"
\App
00000422
dm:
Powershell.exe
ProgramData\
ps1
rundll32
http://
Content-Disposition: form-data; name="data"; filename="
SOFTWARE\Microsoft\Windows NT\CurrentVersion
dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
id:
VideoID
cred.dll|clip.dll|
0000043f
cmd
00000423
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
-executionpolicy remotesigned -File "
2022
------
2016
og:
\0000
CurrentBuild
2019
:::
S-%lu-
" && timeout 1 && del
ProductName
Panda Security
ESET
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
/k
+++
?scr=1
Doctor Web
GET
SYSTEM\ControlSet001\Services\BasicDisplay\Video
/quiet
.jpg
d610cf342e
vs:
sd:
rundll32.exe
"taskkill /f /im "
pc:
random
=
360TotalSecurity
<d>
wb
Content-Type: multipart/form-data; boundary=----
Startup
Norton
&& Exit"
os:
https://
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
2025
Avira
%-lu
zip
POST
" Content-Type: application/octet-stream
Rem
/te4h2nus/index.php
------
5.34
<c>
clip.dll
AVAST Software
\
shell32.dll
" && ren
e3
ramez.exe
kernel32.dll
DefaultSettings.XResolution
d1
DefaultSettings.YResolution
185.156.72.96
r=
cred.dll
--
GetNativeSystemInfo
-%lu
ComputerName
&unit=
Keyboard Layout\Preload
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
ar:
Sophos
%USERPROFILE%
exe
e1
e2
st=s
Programs
0123456789
un:
rb
bi:
abcdefghijklmnopqrstuvwxyz0123456789-_
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
cmd /C RMDIR /s/q
Bitdefender
-unicode-
AVG
WinDefender
&&
shutdown -s -t 0
Comodo
00000419
Content-Type: application/x-www-form-urlencoded
/Plugins/
Main
2568"C:\Users\admin\AppData\Local\Temp\10119020101\d1oAX1c.exe" C:\Users\admin\AppData\Local\Temp\10119020101\d1oAX1c.exe—ramez.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\10119020101\d1oax1c.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
3268"C:\Users\admin\Desktop\Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe" C:\Users\admin\Desktop\Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Lumma
(PID) Process(3268) Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe
C2 (9)featurlyin.top/pdal
overcovtcg.top/juhd
meteorplyp.live/lekp
zmedtipp.live/mnvzx
flowerexju.bet/lanz
posseswsnc.top/akds
araucahkbm.live/baneb
blackswmxc.top/bgry
easterxeen.run/zavc
3332C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5084"C:\Users\admin\AppData\Local\Temp\10119010101\HGVm49v.exe" C:\Users\admin\AppData\Local\Temp\10119010101\HGVm49v.exe
ramez.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\temp\10119010101\hgvm49v.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5600"C:\Users\admin\AppData\Local\Temp\10118990101\da22316bc0.exe" C:\Users\admin\AppData\Local\Temp\10118990101\da22316bc0.exe
ramez.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\10118990101\da22316bc0.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5720C:\WINDOWS\system32\svchost.exeC:\Windows\System32\svchost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
Total events
17 267
Read events
17 260
Write events
7
Delete events
0

Modification events

(PID) Process:(2504) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2504) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2504) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5600) da22316bc0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Enigma Protector\BB3DF1FDBB935E9B-50AFA6E27F8A32AF\1D23E801FF916F1C-DF69CE3484AE41BB
Operation:writeName:AEF6E8B3
Value:
131F8A4BC3DE68A2588FC5B83747
(PID) Process:(5600) da22316bc0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5600) da22316bc0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5600) da22316bc0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
13
Suspicious files
51
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
6964WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_HGVm49v.exe_ebc2bfdeb02554ccbb4f874b72494cab36ea3d4_a3665544_375ab74d-74f5-49fc-94fb-74344af16075\Report.wer —
MD5:—
SHA256:—
2504ramez.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\random[1].exeexecutable
MD5:B20DFC438760671893EC3E49DF9AFA35
SHA256:4A991D77AFD122CBFEDC7D61F0EDF90F2907640A25C17FA4B9390E64A926E704
698869ROCCX6I6UZEFKBG67R2ETK.exeC:\Users\admin\AppData\Local\Temp\d610cf342e\ramez.exeexecutable
MD5:8601AB45C980CDDBA6F5ED9B672F1DC6
SHA256:167F6AF339B3E2BD381487E69B233A3AC2EAC47EF56553C5A5729B2FB3FE55E4
3268Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exeC:\Users\admin\AppData\Local\Temp\69ROCCX6I6UZEFKBG67R2ETK.exeexecutable
MD5:8601AB45C980CDDBA6F5ED9B672F1DC6
SHA256:167F6AF339B3E2BD381487E69B233A3AC2EAC47EF56553C5A5729B2FB3FE55E4
5600da22316bc0.exeC:\Users\admin\AppData\Local\Temp\F59E91F8binary
MD5:91267AD1E6E3B1BAACAEB0296F7223BD
SHA256:CE5958694F937603D7891BF5A7E4BD88A282E1BBB3285C0A68801389464AD6A1
698869ROCCX6I6UZEFKBG67R2ETK.exeC:\Windows\Tasks\ramez.jobbinary
MD5:EC082471FCE3967987998C06F761F862
SHA256:F7A9B996B4CF2A53AC3083B8B24CF65C1232785191FAD010AADB04EABDEA8D7B
2504ramez.exeC:\Users\admin\AppData\Local\Temp\10118990101\da22316bc0.exeexecutable
MD5:B20DFC438760671893EC3E49DF9AFA35
SHA256:4A991D77AFD122CBFEDC7D61F0EDF90F2907640A25C17FA4B9390E64A926E704
6964WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERBA27.tmp.xmlxml
MD5:6AA96EFCA53428CF465A011ECA85448E
SHA256:8EFC66A47FBDBEA9CB55A961210B4CC3191404C945D7AADED772306F2F343911
6964WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERB9E8.tmp.WERInternalMetadata.xmlbinary
MD5:48E47D8519630094D31BB2CAB2C3B0C7
SHA256:B8204162D870E21DA0EE35C70DD08F958DD5C300913C42E2F14B6DD5C631F1A8
5600da22316bc0.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\success[1].htmbinary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
135
TCP/UDP connections
113
DNS requests
39
Threats
52

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3268
Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe
GET
200
185.156.72.2:80
http://185.156.72.2/mine/random.exe
unknown
—
—
unknown
2104
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5216
RUXIMICS.exe
GET
200
23.48.23.140:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
23.48.23.140:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5216
RUXIMICS.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4976
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
4976
SIHClient.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
4976
SIHClient.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
4976
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4976
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5216
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2104
svchost.exe
23.48.23.140:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5216
RUXIMICS.exe
23.48.23.140:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3268
Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe
104.21.40.104:443
overcovtcg.top
CLOUDFLARENET
—
malicious
2104
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.174
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
crl.microsoft.com
  • 23.48.23.140
  • 23.48.23.191
  • 23.48.23.185
  • 23.48.23.156
  • 23.48.23.153
  • 23.48.23.181
  • 23.48.23.141
  • 23.48.23.193
  • 23.48.23.183
  • 2.19.11.105
  • 2.19.11.120
whitelisted
meteorplyp.live
  • —
malicious
flowerexju.bet
  • —
malicious
zmedtipp.live
  • —
malicious
easterxeen.run
  • —
malicious
araucahkbm.live
  • —
malicious
overcovtcg.top
  • 104.21.40.104
  • 172.67.150.184
malicious

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zmedtipp .live)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (flowerexju .bet)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (easterxeen .run)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (araucahkbm .live)
3268
Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (overcovtcg .top) in TLS SNI
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (overcovtcg .top)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (meteorplyp .live)
—
—
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
3268
Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (overcovtcg .top) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13