File name:

Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355

Full analysis: https://app.any.run/tasks/4044fccc-904e-43cb-bb68-1f46b9a885ca
Verdict: Malicious activity
Threats:

PrivateLoader is a malware family that is specifically created to infect computer systems and drop additional malicious programs. It operates using a pay-per-install business model, which means that the individuals behind it are paid for each instance of successful deployment of different types of harmful programs, including trojans, stealers, and other ransomware.

Malware Trends Tracker     >>>
Analysis date: May 16, 2025, 15:48:33
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
privateloader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 10 sections
MD5:

FDE4EC171A6E988C9640D8F8DCF35AEA

SHA1:

47D357A4E617B46E47DDC8AA9869F33A3C9FFFB8

SHA256:

57962D6E4DEA092778CA4B98D68EE62D11A8CFA88FD7FD7B89CB97FBA2193355

SSDEEP:

98304:9bRwXuv0bjY0mqBvzKczYA3IycQ6XpyWzI/vjhugtsoQYWb7lFGo3:MeMVvaAPHzhug4pUy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the Windows auto-update feature

      • Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exe (PID: 4988)

    • PRIVATELOADER has been detected (SURICATA)

      • Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exe (PID: 4988)

    • Connects to the CnC server

      • Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exe (PID: 4988)

    • PRIVATELOADER has been detected (YARA)

      • Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exe (PID: 4988)

  • SUSPICIOUS

    • Contacting a server suspected of hosting an CnC

      • Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exe (PID: 4988)

    • Connects to the server without a host name

      • Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exe (PID: 4988)

    • Executes application which crashes

      • Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exe (PID: 4988)

  • INFO

    • Reads the computer name

      • Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exe (PID: 4988)

    • Checks supported languages

      • Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exe (PID: 4988)

    • The sample compiled with english language support

      • Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exe (PID: 4988)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 668)

    • Reads the software policy settings

      • slui.exe (PID: 4436)

    • Checks proxy server information

      • slui.exe (PID: 4436)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2023:05:25 12:13:29+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.29
CodeSize: 3105280
InitializedDataSize: 709120
UninitializedDataSize: -
EntryPoint: 0x8844a9
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 7.0.45.1145
ProductVersionNumber: 7.0.45.1145
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: N-able Take Control
FileDescription: TCDirectChat
FileVersion: 7.0.45.1145
InternalName: N-able Take Control
ProgramID: com.embarcadero.TCDirectChat
ProductName: TCDirectChat
ProductVersion: 7.0.45.1145
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #PRIVATELOADER sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exe werfault.exe no specs slui.exe sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
668C:\WINDOWS\system32\WerFault.exe -u -p 4988 -s 876C:\Windows\System32\WerFault.exe—Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\oleaut32.dll
4040"C:\Users\admin\Desktop\Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exe" C:\Users\admin\Desktop\Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exe—explorer.exe
User:
admin
Company:
N-able Take Control
Integrity Level:
MEDIUM
Description:
TCDirectChat
Exit code:
3221226540
Version:
7.0.45.1145
Modules
Images
c:\users\admin\desktop\sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exe
c:\windows\system32\ntdll.dll
4436C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4988"C:\Users\admin\Desktop\Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exe" C:\Users\admin\Desktop\Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exe
explorer.exe
User:
admin
Company:
N-able Take Control
Integrity Level:
HIGH
Description:
TCDirectChat
Exit code:
3221225620
Version:
7.0.45.1145
Modules
Images
c:\users\admin\desktop\sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
5 424
Read events
5 357
Write events
38
Delete events
29

Modification events

(PID) Process:(4988) Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B3F424BF-9B07-435C-8FC3-DADF77FE80AE}Machine\Software\Policies\Microsoft\AppHVSI
Operation:writeName:AllowAppHVSI_ProviderSet
Value:
0
(PID) Process:(4988) Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B3F424BF-9B07-435C-8FC3-DADF77FE80AE}Machine\Software\Policies\Microsoft\EdgeUpdate
Operation:writeName:UpdateDefault
Value:
0
(PID) Process:(4988) Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B3F424BF-9B07-435C-8FC3-DADF77FE80AE}Machine\Software\Policies\Microsoft\Windows\Network Connections
Operation:writeName:NC_DoNotShowLocalOnlyIcon
Value:
1
(PID) Process:(4988) Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B3F424BF-9B07-435C-8FC3-DADF77FE80AE}Machine\Software\Policies\Microsoft\Windows\Windows Feeds
Operation:writeName:EnableFeeds
Value:
0
(PID) Process:(4988) Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B3F424BF-9B07-435C-8FC3-DADF77FE80AE}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate
Operation:writeName:WUServer
Value:
http://neverupdatewindows10.com
(PID) Process:(4988) Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B3F424BF-9B07-435C-8FC3-DADF77FE80AE}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate
Operation:writeName:WUStatusServer
Value:
http://neverupdatewindows10.com
(PID) Process:(4988) Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B3F424BF-9B07-435C-8FC3-DADF77FE80AE}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate
Operation:writeName:UpdateServiceUrlAlternate
Value:
http://neverupdatewindows10.com
(PID) Process:(4988) Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B3F424BF-9B07-435C-8FC3-DADF77FE80AE}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate
Operation:writeName:**del.FillEmptyContentUrls
Value:
(PID) Process:(4988) Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B3F424BF-9B07-435C-8FC3-DADF77FE80AE}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate\AU
Operation:writeName:UseWUServer
Value:
1
(PID) Process:(4988) Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B3F424BF-9B07-435C-8FC3-DADF77FE80AE}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate\AU
Operation:writeName:NoAutoUpdate
Value:
0
Executable files
0
Suspicious files
5
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
668WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Sigmanly_57962d6_b99b77e7eeae74b2dbc33edc6ced735312a72c7_2f918441_eaa4ddb9-6fb1-4c5c-840b-241513dba1e6\Report.wer —
MD5:—
SHA256:—
668WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER741.tmp.WERInternalMetadata.xmlbinary
MD5:21C5D91B937A4ED6C0D2CBEDDB971492
SHA256:1B09999F0C271279B5E00177539D9F09729EFCB55ADE570229ABB3E93EE9F8DD
668WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exe.4988.dmpbinary
MD5:261ADA14670E497B53409F1EB9DBE95A
SHA256:FDD0BC70EAD3D6C324F8ED074FAE237807E507FB335CB783557163618AFEE5B7
4988Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exeC:\Windows\System32\GroupPolicy\gpt.initext
MD5:3D89F23265C9E30A0CF055C3EB4D637C
SHA256:806582F6221C79BD4C7EACDC4B63E937CE247EEE2BA159F55C545CDFB2B1C25B
668WerFault.exeC:\Windows\appcompat\Programs\Amcache.hvebinary
MD5:FB06555C18861E0795ADA26EB60725D8
SHA256:4EA16FD7BC45F889CDCF3617FE813BB3A364D09A02A8795132B492B70AE096C5
668WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER752.tmp.xmlxml
MD5:56543B95051BC2165A65BE53519CD7CE
SHA256:11E2A6BB74F93E143DB4DB4B25AFC30637351B561EB40FE547BEB138243D88E7
668WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER694.tmp.dmpbinary
MD5:736A0C2B49963BD25ED77F587099ACBB
SHA256:4A91BDCD3F903C5D11087E71350735CF8C263C94C9E4ABDC80254B26636B9C4C
4988Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exeC:\Windows\System32\GroupPolicy\Machine\Registry.polbinary
MD5:551F2716A3AF0148E9A55792A5708892
SHA256:B4E6B3EB7656C4D44F67FBCC6803525C17DCA34BD65AF9F146D8FCA3441AB565
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
29
DNS requests
5
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4988
Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exe
GET
—
94.142.138.131:80
http://94.142.138.131/api/tracemap.php
unknown
—
—
malicious
4988
Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exe
GET
—
94.142.138.113:80
http://94.142.138.113/api/tracemap.php
unknown
—
—
malicious
4988
Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exe
GET
—
208.67.104.60:80
http://208.67.104.60/api/tracemap.php
unknown
—
—
malicious
2104
svchost.exe
GET
200
23.216.77.31:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4988
Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exe
GET
—
85.208.136.10:80
http://85.208.136.10/api/tracemap.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4988
Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exe
94.142.138.131:80
—
Network Management Ltd
RU
malicious
2196
svchost.exe
224.0.0.251:5353
—
—
—
unknown
2196
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
2104
svchost.exe
23.216.77.31:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4988
Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exe
94.142.138.113:80
—
Network Management Ltd
RU
malicious

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.23.110
whitelisted
crl.microsoft.com
  • 23.216.77.31
  • 23.216.77.22
  • 23.216.77.39
  • 23.216.77.41
  • 23.216.77.37
  • 23.216.77.27
  • 23.216.77.32
  • 23.216.77.35
  • 23.216.77.29
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

PID
Process
Class
Message
4988
Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/BeamWinHTTP CnC Activity M2 (GET)
4988
Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/BeamWinHTTP CnC Activity M2 (GET)
4988
Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/BeamWinHTTP CnC Activity M2 (GET)
4988
Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/BeamWinHTTP CnC Activity M2 (GET)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Sigmanly_57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355