File name:

random.exe

Full analysis: https://app.any.run/tasks/38950e79-110d-4fef-b3d2-99d534de53da
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: April 29, 2025, 06:47:32
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
lumma
stealer
themida
loader
amadey
botnet
auto
rdp
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

2A7E58BFC08AEE8EDE4459650ACD925A

SHA1:

3B98A505E165EDEB5B5A0B61F23D170D166AB5A3

SHA256:

65188A3EE94FE1BE3383CDE5151D94F27BBF6E854A6700C8847AF38744B415FC

SSDEEP:

98304:OMJKGavA2U0xp9DJ06ZmbZjyJLzkT+Giqeo5HQs2GSbWJFRoy1tgSujFJwnuRM+M:65h

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • LUMMA has been detected (YARA)

      • random.exe (PID: 6148)
    • LUMMA has been detected (SURICATA)

      • random.exe (PID: 6148)
      • svchost.exe (PID: 2196)
    • Actions looks like stealing of personal data

      • random.exe (PID: 6148)
    • Connects to the CnC server

      • svchost.exe (PID: 2196)
      • saved.exe (PID: 4200)
    • LUMMA mutex has been found

      • random.exe (PID: 6148)
    • AMADEY has been found (auto)

      • random.exe (PID: 6148)
      • TQHM3A41OLO3SFPWZED4NG2O0OE.exe (PID: 8136)
    • AMADEY has been detected (SURICATA)

      • saved.exe (PID: 4200)
    • AMADEY has been detected (YARA)

      • saved.exe (PID: 4200)
  • SUSPICIOUS

    • Reads the BIOS version

      • random.exe (PID: 6148)
    • Contacting a server suspected of hosting an CnC

      • random.exe (PID: 6148)
      • svchost.exe (PID: 2196)
      • saved.exe (PID: 4200)
    • Executable content was dropped or overwritten

      • random.exe (PID: 6148)
      • TQHM3A41OLO3SFPWZED4NG2O0OE.exe (PID: 8136)
    • Searches for installed software

      • random.exe (PID: 6148)
    • Connects to the server without a host name

      • random.exe (PID: 6148)
      • saved.exe (PID: 4200)
    • Process requests binary or script from the Internet

      • random.exe (PID: 6148)
    • Potential Corporate Privacy Violation

      • random.exe (PID: 6148)
    • Reads security settings of Internet Explorer

      • TQHM3A41OLO3SFPWZED4NG2O0OE.exe (PID: 8136)
      • saved.exe (PID: 4200)
    • Starts itself from another location

      • TQHM3A41OLO3SFPWZED4NG2O0OE.exe (PID: 8136)
    • There is functionality for taking screenshot (YARA)

      • saved.exe (PID: 4200)
    • There is functionality for enable RDP (YARA)

      • saved.exe (PID: 4200)
  • INFO

    • Reads the computer name

      • random.exe (PID: 6148)
      • TQHM3A41OLO3SFPWZED4NG2O0OE.exe (PID: 8136)
      • saved.exe (PID: 4200)
    • Checks supported languages

      • random.exe (PID: 6148)
      • TQHM3A41OLO3SFPWZED4NG2O0OE.exe (PID: 8136)
      • saved.exe (PID: 4200)
    • Themida protector has been detected

      • random.exe (PID: 6148)
    • Reads the software policy settings

      • slui.exe (PID: 7296)
      • random.exe (PID: 6148)
    • Create files in a temporary directory

      • random.exe (PID: 6148)
      • TQHM3A41OLO3SFPWZED4NG2O0OE.exe (PID: 8136)
    • Process checks computer location settings

      • TQHM3A41OLO3SFPWZED4NG2O0OE.exe (PID: 8136)
    • Checks proxy server information

      • saved.exe (PID: 4200)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:04:26 14:47:23+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 312320
InitializedDataSize: 38400
UninitializedDataSize: -
EntryPoint: 0x47d000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
7
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #LUMMA random.exe #LUMMA svchost.exe sppextcomobj.exe no specs slui.exe slui.exe no specs #AMADEY tqhm3a41olo3sfpwzed4ng2o0oe.exe #AMADEY saved.exe

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4200"C:\Users\admin\AppData\Local\Temp\c13dbdc4fa\saved.exe" C:\Users\admin\AppData\Local\Temp\c13dbdc4fa\saved.exe
TQHM3A41OLO3SFPWZED4NG2O0OE.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\c13dbdc4fa\saved.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6148"C:\Users\admin\AppData\Local\Temp\random.exe" C:\Users\admin\AppData\Local\Temp\random.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\random.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7264C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exesvchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
7296"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msxml6.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\ondemandconnroutehelper.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\dhcpcsvc6.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\webio.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\winnsi.dll
8036C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
8136"C:\Users\admin\AppData\Local\Temp\TQHM3A41OLO3SFPWZED4NG2O0OE.exe"C:\Users\admin\AppData\Local\Temp\TQHM3A41OLO3SFPWZED4NG2O0OE.exe
random.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\tqhm3a41olo3sfpwzed4ng2o0oe.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
1 756
Read events
1 753
Write events
3
Delete events
0

Modification events

(PID) Process:(4200) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4200) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4200) saved.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
2
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
8136TQHM3A41OLO3SFPWZED4NG2O0OE.exeC:\Users\admin\AppData\Local\Temp\c13dbdc4fa\saved.exeexecutable
MD5:F6C20A18AFEAC04964A6CCAD6BE59731
SHA256:CE75F9DEDE6D4E93549D35B816898113B6BEFAB9EF0AADF8949D4887C2C34BEA
8136TQHM3A41OLO3SFPWZED4NG2O0OE.exeC:\Windows\Tasks\saved.jobbinary
MD5:586D46982324BA5F1F8BE9D514D43019
SHA256:F4858B98FFBF5D0D54BE7D03CF4BDFBA24351064DA1104BCA008F045953ED400
6148random.exeC:\Users\admin\AppData\Local\Temp\TQHM3A41OLO3SFPWZED4NG2O0OE.exeexecutable
MD5:F6C20A18AFEAC04964A6CCAD6BE59731
SHA256:CE75F9DEDE6D4E93549D35B816898113B6BEFAB9EF0AADF8949D4887C2C34BEA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
35
DNS requests
28
Threats
26

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
7868
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
7868
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
6148
random.exe
GET
200
185.39.17.162:80
http://185.39.17.162/mine/random.exe
unknown
malicious
4200
saved.exe
POST
200
185.39.17.163:80
http://185.39.17.163/Su8kud7i/index.php
unknown
malicious
4200
saved.exe
POST
200
185.39.17.163:80
http://185.39.17.163/Su8kud7i/index.php
unknown
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
whitelisted
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
whitelisted
6148
random.exe
188.114.97.3:443
buzzarddf.live
CLOUDFLARENET
NL
malicious
6544
svchost.exe
40.126.31.3:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
  • 20.73.194.208
whitelisted
google.com
  • 142.250.185.142
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
clarmodq.top
malicious
geographys.run
malicious
woodpeckersd.run
malicious
tropiscbs.live
malicious
buzzarddf.live
  • 188.114.97.3
  • 188.114.96.3
malicious
login.live.com
  • 40.126.31.3
  • 20.190.159.131
  • 40.126.31.69
  • 40.126.31.131
  • 20.190.159.129
  • 20.190.159.4
  • 20.190.159.71
  • 40.126.31.1
whitelisted

Threats

PID
Process
Class
Message
A Network Trojan was detected
MALWARE [ANY.RUN] Suspected Domain Associated with Malware Distribution (clarmodq .top)
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (geographys .run)
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (buzzarddf .live) in TLS SNI
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clarmodq .top)
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tropiscbs .live)
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (buzzarddf .live)
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (woodpeckersd .run)
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fishgh .digital)
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (biosphxere .digital)
No debug info