File name:

Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13

Full analysis: https://app.any.run/tasks/37c113e0-743c-4801-880f-7c321a9b8ba5
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 15:40:56
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
lumma
stealer
themida
loader
amadey
botnet
rdp
evasion
telegram
gcleaner
enigma
delphi
antivm
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

C51CB0F1AD78C3DFF012B7C89B007DB8

SHA1:

93E259385AFD7A6DCDB53596A51B0B9063D071CC

SHA256:

05CD844545F7741D2B822A7E96BB86000EB5C9B3C91876ED3E5A956338EB1D13

SSDEEP:

98304:YyTyIX/35fZ+UsNM6byhoPqZvWmcQzcN1eSsLDjYIZN7MH+jW2CT13l2laJckPTv:Uz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)
      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • MSBuild.exe (PID: 7144)

    • LUMMA mutex has been found

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • MSBuild.exe (PID: 864)
      • MSBuild.exe (PID: 7144)

    • Connects to the CnC server

      • svchost.exe (PID: 2196)
      • ramez.exe (PID: 2504)

    • Actions looks like stealing of personal data

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • MSBuild.exe (PID: 864)
      • MSBuild.exe (PID: 7144)

    • Steals credentials from Web Browsers

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • MSBuild.exe (PID: 864)
      • MSBuild.exe (PID: 7144)

    • LUMMA has been detected (YARA)

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)

    • AMADEY mutex has been found

      • 69ROCCX6I6UZEFKBG67R2ETK.exe (PID: 6988)
      • ramez.exe (PID: 2504)
      • ramez.exe (PID: 6632)

    • AMADEY has been detected (SURICATA)

      • ramez.exe (PID: 2504)

    • AMADEY has been detected (YARA)

      • ramez.exe (PID: 2504)

    • Application was injected by another process

      • svchost.exe (PID: 6740)
      • svchost.exe (PID: 5720)

    • Runs injected code in another process

      • e5jg7MM.exe (PID: 6048)

    • Executing a file with an untrusted certificate

      • HGVm49v.exe (PID: 5084)

    • GCLEANER has been detected (SURICATA)

      • da22316bc0.exe (PID: 5600)

  • SUSPICIOUS

    • Reads the BIOS version

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • 69ROCCX6I6UZEFKBG67R2ETK.exe (PID: 6988)
      • ramez.exe (PID: 2504)
      • e5jg7MM.exe (PID: 6048)
      • ramez.exe (PID: 6632)

    • Contacting a server suspected of hosting an CnC

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • svchost.exe (PID: 2196)
      • ramez.exe (PID: 2504)
      • MSBuild.exe (PID: 7144)

    • Connects to the server without a host name

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • ramez.exe (PID: 2504)
      • svchost.exe (PID: 5720)
      • da22316bc0.exe (PID: 5600)

    • Process requests binary or script from the Internet

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • ramez.exe (PID: 2504)

    • Potential Corporate Privacy Violation

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • ramez.exe (PID: 2504)
      • da22316bc0.exe (PID: 5600)

    • Searches for installed software

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • MSBuild.exe (PID: 864)

    • Executable content was dropped or overwritten

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • 69ROCCX6I6UZEFKBG67R2ETK.exe (PID: 6988)
      • ramez.exe (PID: 2504)
      • da22316bc0.exe (PID: 5600)

    • Reads security settings of Internet Explorer

      • 69ROCCX6I6UZEFKBG67R2ETK.exe (PID: 6988)
      • ramez.exe (PID: 2504)
      • da22316bc0.exe (PID: 5600)

    • Starts itself from another location

      • 69ROCCX6I6UZEFKBG67R2ETK.exe (PID: 6988)

    • There is functionality for enable RDP (YARA)

      • ramez.exe (PID: 2504)

    • Application launched itself

      • svchost.exe (PID: 6740)

    • There is functionality for taking screenshot (YARA)

      • da22316bc0.exe (PID: 5600)

    • Starts CMD.EXE for commands execution

      • svchost.exe (PID: 5720)

    • Checks for external IP

      • svchost.exe (PID: 5720)
      • svchost.exe (PID: 2196)

    • There is functionality for VM detection VirtualBox (YARA)

      • da22316bc0.exe (PID: 5600)

    • The process executes via Task Scheduler

      • ramez.exe (PID: 6632)
      • PLUGScheduler.exe (PID: 884)

    • Executes application which crashes

      • HGVm49v.exe (PID: 5084)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • MSBuild.exe (PID: 864)

  • INFO

    • Checks supported languages

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • 69ROCCX6I6UZEFKBG67R2ETK.exe (PID: 6988)
      • ramez.exe (PID: 2504)
      • da22316bc0.exe (PID: 5600)
      • e5jg7MM.exe (PID: 6048)
      • HGVm49v.exe (PID: 5084)
      • ramez.exe (PID: 6632)
      • MSBuild.exe (PID: 864)
      • d1oAX1c.exe (PID: 2568)
      • MSBuild.exe (PID: 7144)

    • Reads the computer name

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • 69ROCCX6I6UZEFKBG67R2ETK.exe (PID: 6988)
      • ramez.exe (PID: 2504)
      • da22316bc0.exe (PID: 5600)
      • MSBuild.exe (PID: 864)
      • MSBuild.exe (PID: 7144)

    • Reads the machine GUID from the registry

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • MSBuild.exe (PID: 864)
      • da22316bc0.exe (PID: 5600)
      • MSBuild.exe (PID: 7144)

    • Reads the software policy settings

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • MSBuild.exe (PID: 864)
      • da22316bc0.exe (PID: 5600)
      • MSBuild.exe (PID: 7144)

    • Themida protector has been detected

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • ramez.exe (PID: 2504)

    • Create files in a temporary directory

      • Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe (PID: 3268)
      • 69ROCCX6I6UZEFKBG67R2ETK.exe (PID: 6988)
      • ramez.exe (PID: 2504)
      • da22316bc0.exe (PID: 5600)

    • Process checks computer location settings

      • 69ROCCX6I6UZEFKBG67R2ETK.exe (PID: 6988)
      • ramez.exe (PID: 2504)

    • Checks proxy server information

      • ramez.exe (PID: 2504)
      • da22316bc0.exe (PID: 5600)

    • Creates files or folders in the user directory

      • ramez.exe (PID: 2504)
      • WerFault.exe (PID: 6964)
      • da22316bc0.exe (PID: 5600)

    • Compiled with Borland Delphi (YARA)

      • da22316bc0.exe (PID: 5600)

    • Enigma protector has been detected

      • da22316bc0.exe (PID: 5600)

    • Attempting to use instant messaging service

      • MSBuild.exe (PID: 864)

    • The sample compiled with english language support

      • ramez.exe (PID: 2504)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Lumma

(PID) Process(3268) Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe
C2 (9)featurlyin.top/pdal
overcovtcg.top/juhd
meteorplyp.live/lekp
zmedtipp.live/mnvzx
flowerexju.bet/lanz
posseswsnc.top/akds
araucahkbm.live/baneb
blackswmxc.top/bgry
easterxeen.run/zavc

Amadey

(PID) Process(2504) ramez.exe
C2185.156.72.96
URLhttp://185.156.72.96/te4h2nus/index.php
Version5.34
Options
Drop directoryd610cf342e
Drop nameramez.exe
Strings (125)lv:
msi
Kaspersky Lab
av:
|
#
"
\App
00000422
dm:
Powershell.exe
ProgramData\
ps1
rundll32
http://
Content-Disposition: form-data; name="data"; filename="
SOFTWARE\Microsoft\Windows NT\CurrentVersion
dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
id:
VideoID
cred.dll|clip.dll|
0000043f
cmd
00000423
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
-executionpolicy remotesigned -File "
2022
------
2016
og:
\0000
CurrentBuild
2019
:::
S-%lu-
" && timeout 1 && del
ProductName
Panda Security
ESET
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
/k
+++
?scr=1
Doctor Web
GET
SYSTEM\ControlSet001\Services\BasicDisplay\Video
/quiet
.jpg
d610cf342e
vs:
sd:
rundll32.exe
"taskkill /f /im "
pc:
random
=
360TotalSecurity
<d>
wb
Content-Type: multipart/form-data; boundary=----
Startup
Norton
&& Exit"
os:
https://
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
2025
Avira
%-lu
zip
POST
" Content-Type: application/octet-stream
Rem
/te4h2nus/index.php
------
5.34
<c>
clip.dll
AVAST Software
\
shell32.dll
" && ren
e3
ramez.exe
kernel32.dll
DefaultSettings.XResolution
d1
DefaultSettings.YResolution
185.156.72.96
r=
cred.dll
--
GetNativeSystemInfo
-%lu
ComputerName
&unit=
Keyboard Layout\Preload
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
ar:
Sophos
%USERPROFILE%
exe
e1
e2
st=s
Programs
0123456789
un:
rb
bi:
abcdefghijklmnopqrstuvwxyz0123456789-_
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
cmd /C RMDIR /s/q
Bitdefender
-unicode-
AVG
WinDefender
&&
shutdown -s -t 0
Comodo
00000419
Content-Type: application/x-www-form-urlencoded
/Plugins/
Main
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:08 12:17:36+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 314880
InitializedDataSize: 37376
UninitializedDataSize: -
EntryPoint: 0x48a000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
259
Monitored processes
17
Malicious processes
13
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #LUMMA sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe #LUMMA svchost.exe 69roccx6i6uzefkbg67r2etk.exe #AMADEY ramez.exe #GCLEANER da22316bc0.exe e5jg7mm.exe no specs svchost.exe svchost.exe ramez.exe no specs hgvm49v.exe #LUMMA msbuild.exe werfault.exe no specs slui.exe no specs d1oax1c.exe no specs msbuild.exe no specs #LUMMA msbuild.exe plugscheduler.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
864"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
HGVm49v.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
884"C:\Program Files\RUXIM\PLUGscheduler.exe"C:\Program Files\RUXIM\PLUGScheduler.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Update LifeCycle Component Scheduler
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\plugscheduler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2504"C:\Users\admin\AppData\Local\Temp\d610cf342e\ramez.exe" C:\Users\admin\AppData\Local\Temp\d610cf342e\ramez.exe
69ROCCX6I6UZEFKBG67R2ETK.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\d610cf342e\ramez.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Amadey
(PID) Process(2504) ramez.exe
C2185.156.72.96
URLhttp://185.156.72.96/te4h2nus/index.php
Version5.34
Options
Drop directoryd610cf342e
Drop nameramez.exe
Strings (125)lv:
msi
Kaspersky Lab
av:
|
#
"
\App
00000422
dm:
Powershell.exe
ProgramData\
ps1
rundll32
http://
Content-Disposition: form-data; name="data"; filename="
SOFTWARE\Microsoft\Windows NT\CurrentVersion
dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
id:
VideoID
cred.dll|clip.dll|
0000043f
cmd
00000423
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
-executionpolicy remotesigned -File "
2022
------
2016
og:
\0000
CurrentBuild
2019
:::
S-%lu-
" && timeout 1 && del
ProductName
Panda Security
ESET
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
/k
+++
?scr=1
Doctor Web
GET
SYSTEM\ControlSet001\Services\BasicDisplay\Video
/quiet
.jpg
d610cf342e
vs:
sd:
rundll32.exe
"taskkill /f /im "
pc:
random
=
360TotalSecurity
<d>
wb
Content-Type: multipart/form-data; boundary=----
Startup
Norton
&& Exit"
os:
https://
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
2025
Avira
%-lu
zip
POST
" Content-Type: application/octet-stream
Rem
/te4h2nus/index.php
------
5.34
<c>
clip.dll
AVAST Software
\
shell32.dll
" && ren
e3
ramez.exe
kernel32.dll
DefaultSettings.XResolution
d1
DefaultSettings.YResolution
185.156.72.96
r=
cred.dll
--
GetNativeSystemInfo
-%lu
ComputerName
&unit=
Keyboard Layout\Preload
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
ar:
Sophos
%USERPROFILE%
exe
e1
e2
st=s
Programs
0123456789
un:
rb
bi:
abcdefghijklmnopqrstuvwxyz0123456789-_
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
cmd /C RMDIR /s/q
Bitdefender
-unicode-
AVG
WinDefender
&&
shutdown -s -t 0
Comodo
00000419
Content-Type: application/x-www-form-urlencoded
/Plugins/
Main
2568"C:\Users\admin\AppData\Local\Temp\10119020101\d1oAX1c.exe" C:\Users\admin\AppData\Local\Temp\10119020101\d1oAX1c.exe—ramez.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\10119020101\d1oax1c.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
3268"C:\Users\admin\Desktop\Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe" C:\Users\admin\Desktop\Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Lumma
(PID) Process(3268) Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe
C2 (9)featurlyin.top/pdal
overcovtcg.top/juhd
meteorplyp.live/lekp
zmedtipp.live/mnvzx
flowerexju.bet/lanz
posseswsnc.top/akds
araucahkbm.live/baneb
blackswmxc.top/bgry
easterxeen.run/zavc
3332C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5084"C:\Users\admin\AppData\Local\Temp\10119010101\HGVm49v.exe" C:\Users\admin\AppData\Local\Temp\10119010101\HGVm49v.exe
ramez.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\temp\10119010101\hgvm49v.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5600"C:\Users\admin\AppData\Local\Temp\10118990101\da22316bc0.exe" C:\Users\admin\AppData\Local\Temp\10118990101\da22316bc0.exe
ramez.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\10118990101\da22316bc0.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5720C:\WINDOWS\system32\svchost.exeC:\Windows\System32\svchost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
Total events
17 267
Read events
17 260
Write events
7
Delete events
0

Modification events

(PID) Process:(2504) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2504) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2504) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5600) da22316bc0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Enigma Protector\BB3DF1FDBB935E9B-50AFA6E27F8A32AF\1D23E801FF916F1C-DF69CE3484AE41BB
Operation:writeName:AEF6E8B3
Value:
131F8A4BC3DE68A2588FC5B83747
(PID) Process:(5600) da22316bc0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5600) da22316bc0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5600) da22316bc0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
13
Suspicious files
51
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
6964WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_HGVm49v.exe_ebc2bfdeb02554ccbb4f874b72494cab36ea3d4_a3665544_375ab74d-74f5-49fc-94fb-74344af16075\Report.wer —
MD5:—
SHA256:—
3268Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exeC:\Users\admin\AppData\Local\Temp\69ROCCX6I6UZEFKBG67R2ETK.exeexecutable
MD5:8601AB45C980CDDBA6F5ED9B672F1DC6
SHA256:167F6AF339B3E2BD381487E69B233A3AC2EAC47EF56553C5A5729B2FB3FE55E4
2504ramez.exeC:\Users\admin\AppData\Local\Temp\10118990101\da22316bc0.exeexecutable
MD5:B20DFC438760671893EC3E49DF9AFA35
SHA256:4A991D77AFD122CBFEDC7D61F0EDF90F2907640A25C17FA4B9390E64A926E704
2504ramez.exeC:\Users\admin\AppData\Local\Temp\10119000101\e5jg7MM.exeexecutable
MD5:7B07898D527A455AE4669C253D8722D5
SHA256:0D532157B751A2AFE492ED04131E1C05D12D425CE65F5FD9FE7E5F92B2F526E2
6964WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERB9E8.tmp.WERInternalMetadata.xmlbinary
MD5:48E47D8519630094D31BB2CAB2C3B0C7
SHA256:B8204162D870E21DA0EE35C70DD08F958DD5C300913C42E2F14B6DD5C631F1A8
6964WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\HGVm49v.exe.5084.dmpbinary
MD5:8DDE3586CA5F2D1B812E12244CAE8ED2
SHA256:AAD5C679191513F43A70AB5FA40FDB8E7A5A98AB8D2CC94B8CF707A7B8C245DE
2504ramez.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\random[1].exeexecutable
MD5:B20DFC438760671893EC3E49DF9AFA35
SHA256:4A991D77AFD122CBFEDC7D61F0EDF90F2907640A25C17FA4B9390E64A926E704
2504ramez.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\HGVm49v[1].exeexecutable
MD5:A33FA5D4484673A634FB1DA94EB0A4B0
SHA256:2229D49F74E72840F0A315372ECA8C099F1226AC1B63CAA3917EF39739BCAC26
698869ROCCX6I6UZEFKBG67R2ETK.exeC:\Windows\Tasks\ramez.jobbinary
MD5:EC082471FCE3967987998C06F761F862
SHA256:F7A9B996B4CF2A53AC3083B8B24CF65C1232785191FAD010AADB04EABDEA8D7B
2504ramez.exeC:\Users\admin\AppData\Local\Temp\10119010101\HGVm49v.exeexecutable
MD5:A33FA5D4484673A634FB1DA94EB0A4B0
SHA256:2229D49F74E72840F0A315372ECA8C099F1226AC1B63CAA3917EF39739BCAC26
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
135
TCP/UDP connections
113
DNS requests
39
Threats
52

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.48.23.140:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5216
RUXIMICS.exe
GET
200
23.48.23.140:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3268
Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe
GET
200
185.156.72.2:80
http://185.156.72.2/mine/random.exe
unknown
—
—
unknown
5216
RUXIMICS.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4976
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
4976
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4976
SIHClient.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
4976
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
4976
SIHClient.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5216
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2104
svchost.exe
23.48.23.140:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5216
RUXIMICS.exe
23.48.23.140:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3268
Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe
104.21.40.104:443
overcovtcg.top
CLOUDFLARENET
—
malicious
2104
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.174
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
crl.microsoft.com
  • 23.48.23.140
  • 23.48.23.191
  • 23.48.23.185
  • 23.48.23.156
  • 23.48.23.153
  • 23.48.23.181
  • 23.48.23.141
  • 23.48.23.193
  • 23.48.23.183
  • 2.19.11.105
  • 2.19.11.120
whitelisted
meteorplyp.live
  • —
malicious
flowerexju.bet
  • —
malicious
zmedtipp.live
  • —
malicious
easterxeen.run
  • —
malicious
araucahkbm.live
  • —
malicious
overcovtcg.top
  • 104.21.40.104
  • 172.67.150.184
malicious

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zmedtipp .live)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (flowerexju .bet)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (easterxeen .run)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (araucahkbm .live)
3268
Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (overcovtcg .top) in TLS SNI
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (overcovtcg .top)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (meteorplyp .live)
—
—
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
3268
Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (overcovtcg .top) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Sigmanly_05cd844545f7741d2b822a7e96bb86000eb5c9b3c91876ed3e5a956338eb1d13