| File name: | random.exe |
| Full analysis: | https://app.any.run/tasks/38cf2e84-2480-4c7e-8dd6-01022382a5fe |
| Verdict: | Malicious activity |
| Threats: | Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks. |
| Analysis date: | April 18, 2025, 07:20:16 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections |
| MD5: | 9103DEDCE3145E133CC78BC88E6B09B7 |
| SHA1: | 84F1BDBB6FF787809E5CA80F17915FD8C517D531 |
| SHA256: | 24C60271CDE0B25F2DE2B469A70528918FEE280E5F3F67D695B2F21C85CB6287 |
| SSDEEP: | 98304:i52LcStgXS9Z6077kYBOzZd50WQzqkXohcouRw77aAqXCvvUeGLaGuZh5JsbSQ3u:r2 |
| .exe | | | Generic Win/DOS Executable (50) |
|---|---|---|
| .exe | | | DOS Executable Generic (49.9) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2025:04:15 21:13:48+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14 |
| CodeSize: | 317952 |
| InitializedDataSize: | 39936 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x4b2000 |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 132 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 232 | C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\SystemService\start.bat" " | C:\Windows\System32\cmd.exe | — | aro5Tjw.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 496 | taskkill /F /IM chrome.exe /T | C:\Windows\SysWOW64\taskkill.exe | — | 9525873fc1.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Terminates Processes Exit code: 128 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 664 | taskkill /F /IM firefox.exe /T | C:\Windows\SysWOW64\taskkill.exe | — | 9525873fc1.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Terminates Processes Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 672 | "C:\Users\admin\AppData\Local\Temp\10043380101\694c3b4028.exe" | C:\Users\admin\AppData\Local\Temp\svchost015.exe | 694c3b4028.exe | ||||||||||||
User: admin Company: X-Ways Software Technology AG Integrity Level: MEDIUM Description: WinHex Exit code: 0 Version: 21.1 Modules
| |||||||||||||||
| 684 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | taskkill.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 684 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2016 -parentBuildID 20240213221259 -prefsHandle 2008 -prefMapHandle 2004 -prefsLen 32427 -prefMapSize 244583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1f7fb0d8-37ae-40a2-a1a8-c357027f2d7e} 5392 "\\.\pipe\gecko-crash-server-pipe.5392" 1b8f8f84110 socket | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 123.0 Modules
| |||||||||||||||
| 812 | C:\WINDOWS\system32\msiexec.exe /V | C:\Windows\System32\msiexec.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 864 | "C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe" "" | C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Resource and Performance Monitor Exit code: 0 Version: 10.00 Modules
| |||||||||||||||
| 920 | "C:\Users\admin\AppData\Local\Temp\10043460101\c6c12343d6.exe" | C:\Users\admin\AppData\Local\Temp\10043460101\c6c12343d6.exe | — | namez.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| (PID) Process: | (8140) namez.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (8140) namez.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (8140) namez.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (4988) svchost015.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (4988) svchost015.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (4988) svchost015.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (672) svchost015.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (672) svchost015.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (672) svchost015.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7300) cd58f59688.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1 |
| Operation: | write | Name: | Inno Setup: Setup Version |
Value: 6.4.0 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7336 | random.exe | C:\Users\admin\AppData\Local\Temp\RJWWSKS6F7UONUQCOF.exe | executable | |
MD5:3EC886E81B3A5649FF9DAC6D88BABA96 | SHA256:ECC4CDE448FA9B09BFFC77555B878E1656AC4E5C6C4218B08078EE85B1B8F8D5 | |||
| 7300 | cd58f59688.tmp | C:\Users\admin\AppData\Roaming\MyApp\is-IKVCK.tmp | — | |
MD5:— | SHA256:— | |||
| 7300 | cd58f59688.tmp | C:\Users\admin\AppData\Roaming\MyApp\core.exe | — | |
MD5:— | SHA256:— | |||
| 8068 | RJWWSKS6F7UONUQCOF.exe | C:\Windows\Tasks\namez.job | binary | |
MD5:FD356E07EB9DCAD38FA3A6B7478F938B | SHA256:E665CB6801B99E42C18E7337DF755AE43BFB27513DF770D102BAC2169E1D5CA9 | |||
| 8140 | namez.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\random[1].exe | executable | |
MD5:5D314B0CCE9388B469A0478306F88D48 | SHA256:6913E064AB05ADB891C9A64B1A1B3C361F08DB2073603C88A4CEE616B69C0C11 | |||
| 8140 | namez.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\random[1].exe | executable | |
MD5:AF5AB75EAA7716A26F543D06CA4BC1FC | SHA256:4D34C2C4890D33B17BCEEE71D1ADBD186A8E4414365E371E1DE85D3B359B9AA1 | |||
| 8140 | namez.exe | C:\Users\admin\AppData\Local\Temp\10043380101\694c3b4028.exe | executable | |
MD5:56F12BB2BD6BCB7206A50AB15133FA1E | SHA256:B9B0C91EBB43B4610B5E9BC01D3EDE61F76E0664DDB5F6F5B8FAC27D88401246 | |||
| 4988 | svchost015.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\success[1].htm | binary | |
MD5:CFCD208495D565EF66E7DFF9F98764DA | SHA256:5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9 | |||
| 7324 | cd58f59688.exe | C:\Users\admin\AppData\Local\Temp\is-KN2OD.tmp\cd58f59688.tmp | executable | |
MD5:E4C43138CCB8240276872FD1AEC369BE | SHA256:46BE5E3F28A5E4ED63D66B901D927C25944B4DA36EFFEA9C97FB05994360EDF5 | |||
| 8140 | namez.exe | C:\Users\admin\AppData\Local\Temp\10043360101\0dcce0575f.exe | executable | |
MD5:AF5AB75EAA7716A26F543D06CA4BC1FC | SHA256:4D34C2C4890D33B17BCEEE71D1ADBD186A8E4414365E371E1DE85D3B359B9AA1 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
672 | svchost015.exe | GET | 200 | 185.156.73.98:80 | http://185.156.73.98/success?substr=mixfour&s=three&sub=none | unknown | — | — | unknown |
4988 | svchost015.exe | GET | 200 | 185.156.73.98:80 | http://185.156.73.98/success?substr=mixseven&s=three&sub=none | unknown | — | — | unknown |
8140 | namez.exe | POST | 200 | 185.215.113.59:80 | http://185.215.113.59/Dy5h4kus/index.php | unknown | — | — | malicious |
4988 | svchost015.exe | GET | 200 | 185.156.73.98:80 | http://185.156.73.98/update | unknown | — | — | malicious |
4988 | svchost015.exe | GET | 200 | 185.156.73.98:80 | http://185.156.73.98/info | unknown | — | — | malicious |
— | — | GET | 200 | 23.216.77.42:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.216.77.42:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
7336 | random.exe | GET | 200 | 185.39.17.162:80 | http://185.39.17.162/mine/random.exe | unknown | — | — | unknown |
8140 | namez.exe | POST | 200 | 185.215.113.59:80 | http://185.215.113.59/Dy5h4kus/index.php | unknown | — | — | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 23.216.77.42:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.216.77.42:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
2104 | svchost.exe | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
7336 | random.exe | 172.67.205.184:443 | clarmodq.top | CLOUDFLARENET | US | malicious |
2112 | svchost.exe | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3216 | svchost.exe | 172.211.123.250:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6544 | svchost.exe | 40.126.32.140:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
Domain | IP | Reputation |
|---|---|---|
crl.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
clarmodq.top |
| malicious |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
t.me |
| whitelisted |
overlapseq.digital |
| malicious |
slscr.update.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
2196 | svchost.exe | Potentially Bad Traffic | ET DNS Query to a *.top domain - Likely Hostile |
7336 | random.exe | Domain Observed Used for C2 Detected | ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI) |
2196 | svchost.exe | A Network Trojan was detected | MALWARE [ANY.RUN] Suspected Domain Associated with Malware Distribution (clarmodq .top) |
2196 | svchost.exe | Domain Observed Used for C2 Detected | ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clarmodq .top) |
7336 | random.exe | Domain Observed Used for C2 Detected | ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI) |
7336 | random.exe | Domain Observed Used for C2 Detected | ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI) |
7336 | random.exe | Domain Observed Used for C2 Detected | ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI) |
7336 | random.exe | Domain Observed Used for C2 Detected | ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI) |
7336 | random.exe | Domain Observed Used for C2 Detected | ET MALWARE Observed Win32/Lumma Stealer Related Domain (clarmodq .top in TLS SNI) |
7336 | random.exe | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |