File name:

a81259adc53c57bd78ae651de229035c6644f0335cb752a75d89927b4f594eb2

Full analysis: https://app.any.run/tasks/67a99236-12a3-45f3-8745-d457a9aa669c
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: April 29, 2025, 09:38:27
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
lumma
amadey
stealc
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

8140CE50CAB39E8002CDE713C567DF06

SHA1:

71B4D67CB314A29DB98FCB88C8DCB5C31B6601C8

SHA256:

A81259ADC53C57BD78AE651DE229035C6644F0335CB752A75D89927B4F594EB2

SSDEEP:

98304:Pn2neeZ+HCrLZuSuTN6mqK7nkc4IYQm00l3ohWdYrOwWi872S2uByYXgdwkf19+m:0qV0B8EQNeTJ6f

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • AMADEY mutex has been found

      • 1E02N9.exe (PID: 6032)
      • rapes.exe (PID: 1228)
      • rapes.exe (PID: 6592)
    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)
    • Stealers network behavior

      • svchost.exe (PID: 2196)
    • STEALC mutex has been found

      • 3Q54x.exe (PID: 960)
    • STEALC has been detected

      • 3Q54x.exe (PID: 960)
    • Connects to the CnC server

      • svchost.exe (PID: 2196)
  • SUSPICIOUS

    • Process drops legitimate windows executable

      • a81259adc53c57bd78ae651de229035c6644f0335cb752a75d89927b4f594eb2.exe (PID: 6132)
    • Executable content was dropped or overwritten

      • a81259adc53c57bd78ae651de229035c6644f0335cb752a75d89927b4f594eb2.exe (PID: 6132)
      • M6m03.exe (PID: 4000)
      • 1E02N9.exe (PID: 6032)
    • Starts a Microsoft application from unusual location

      • a81259adc53c57bd78ae651de229035c6644f0335cb752a75d89927b4f594eb2.exe (PID: 6132)
      • M6m03.exe (PID: 4000)
    • Reads the BIOS version

      • 1E02N9.exe (PID: 6032)
      • rapes.exe (PID: 1228)
      • 2z3927.exe (PID: 1532)
      • 3Q54x.exe (PID: 960)
      • rapes.exe (PID: 6592)
    • Reads security settings of Internet Explorer

      • 1E02N9.exe (PID: 6032)
      • rapes.exe (PID: 1228)
    • Starts itself from another location

      • 1E02N9.exe (PID: 6032)
    • The process executes via Task Scheduler

      • rapes.exe (PID: 6592)
    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2196)
    • Windows Defender mutex has been found

      • 3Q54x.exe (PID: 960)
  • INFO

    • Create files in a temporary directory

      • a81259adc53c57bd78ae651de229035c6644f0335cb752a75d89927b4f594eb2.exe (PID: 6132)
      • M6m03.exe (PID: 4000)
      • 1E02N9.exe (PID: 6032)
    • Checks supported languages

      • M6m03.exe (PID: 4000)
      • a81259adc53c57bd78ae651de229035c6644f0335cb752a75d89927b4f594eb2.exe (PID: 6132)
      • 1E02N9.exe (PID: 6032)
      • 2z3927.exe (PID: 1532)
      • 3Q54x.exe (PID: 960)
      • rapes.exe (PID: 1228)
      • rapes.exe (PID: 6592)
    • The sample compiled with english language support

      • a81259adc53c57bd78ae651de229035c6644f0335cb752a75d89927b4f594eb2.exe (PID: 6132)
    • Reads the computer name

      • 1E02N9.exe (PID: 6032)
      • rapes.exe (PID: 1228)
      • 2z3927.exe (PID: 1532)
      • 3Q54x.exe (PID: 960)
    • Reads the software policy settings

      • 2z3927.exe (PID: 1532)
    • Process checks computer location settings

      • 1E02N9.exe (PID: 6032)
    • Checks proxy server information

      • rapes.exe (PID: 1228)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:05:24 22:49:06+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.13
CodeSize: 25600
InitializedDataSize: 5826560
UninitializedDataSize: -
EntryPoint: 0x6a60
OSVersion: 10
ImageVersion: 10
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 11.0.17763.1
ProductVersionNumber: 11.0.17763.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor
FileVersion: 11.00.17763.1 (WinBuild.160101.0800)
InternalName: Wextract
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: WEXTRACT.EXE .MUI
ProductName: Internet Explorer
ProductVersion: 11.00.17763.1
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
8
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start a81259adc53c57bd78ae651de229035c6644f0335cb752a75d89927b4f594eb2.exe m6m03.exe 1e02n9.exe rapes.exe 2z3927.exe #LUMMA svchost.exe #STEALC 3q54x.exe no specs rapes.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
960C:\Users\admin\AppData\Local\Temp\IXP000.TMP\3Q54x.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\3Q54x.exe
a81259adc53c57bd78ae651de229035c6644f0335cb752a75d89927b4f594eb2.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\3q54x.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1228"C:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exe" C:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1E02N9.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\bb556cff4a\rapes.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1532C:\Users\admin\AppData\Local\Temp\IXP001.TMP\2z3927.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\2z3927.exe
M6m03.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ixp001.tmp\2z3927.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4000C:\Users\admin\AppData\Local\Temp\IXP000.TMP\M6m03.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\M6m03.exe
a81259adc53c57bd78ae651de229035c6644f0335cb752a75d89927b4f594eb2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\m6m03.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6032C:\Users\admin\AppData\Local\Temp\IXP001.TMP\1E02N9.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\1E02N9.exe
M6m03.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ixp001.tmp\1e02n9.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6132"C:\Users\admin\AppData\Local\Temp\a81259adc53c57bd78ae651de229035c6644f0335cb752a75d89927b4f594eb2.exe" C:\Users\admin\AppData\Local\Temp\a81259adc53c57bd78ae651de229035c6644f0335cb752a75d89927b4f594eb2.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\a81259adc53c57bd78ae651de229035c6644f0335cb752a75d89927b4f594eb2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6592"C:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exe"C:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exesvchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\bb556cff4a\rapes.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
Total events
1 129
Read events
1 126
Write events
3
Delete events
0

Modification events

(PID) Process:(1228) rapes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1228) rapes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1228) rapes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
5
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6132a81259adc53c57bd78ae651de229035c6644f0335cb752a75d89927b4f594eb2.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\3Q54x.exeexecutable
MD5:2EDBF32DFD028DE2AC28EA039ED443A5
SHA256:7C25DBEE75DFD0CD79E9A3680427EF40307C0027EEAEA056554C53083FBE38BC
4000M6m03.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\1E02N9.exeexecutable
MD5:9DD9880CA1E2740390258E8F485335E3
SHA256:C78C590215038EF4670B42869D5CC8CCB194CF2C271E03366D24282C6EB5E7BE
6132a81259adc53c57bd78ae651de229035c6644f0335cb752a75d89927b4f594eb2.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\M6m03.exeexecutable
MD5:E5C161CB16C0ACEF4A8FFDE113FF0712
SHA256:565560FE3A000743FEB48301FAA6461F4730F5293857BB24085713F9851F3A90
4000M6m03.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\2z3927.exeexecutable
MD5:29661A8D74E442DAE00F05D7D6183347
SHA256:168C3E18D4AEEE4694835A587AECB0BD58ED274417B2D1D9644CFFC8FB356018
60321E02N9.exeC:\Windows\Tasks\rapes.jobbinary
MD5:D5C29F5BD1A9AB80E031051D683119B7
SHA256:CA3689124BF59AAE67B978621424296F05AAEBEEEED8C6FC4E47556200B94473
60321E02N9.exeC:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exeexecutable
MD5:9DD9880CA1E2740390258E8F485335E3
SHA256:C78C590215038EF4670B42869D5CC8CCB194CF2C271E03366D24282C6EB5E7BE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
22
DNS requests
24
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.30:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
6620
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
6620
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
whitelisted
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.30:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6544
svchost.exe
20.190.159.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1532
2z3927.exe
23.197.130.99:443
steamcommunity.com
Akamai International B.V.
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
google.com
  • 216.58.206.46
whitelisted
crl.microsoft.com
  • 23.216.77.30
  • 23.216.77.29
  • 23.216.77.18
  • 23.216.77.9
  • 23.216.77.23
  • 23.216.77.14
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
login.live.com
  • 20.190.159.64
  • 20.190.159.73
  • 20.190.159.128
  • 20.190.159.2
  • 20.190.159.129
  • 40.126.31.73
  • 20.190.159.131
  • 40.126.31.0
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
rodformi.run
unknown
metalsyo.digital
unknown
ironloxp.live
unknown

Threats

PID
Process
Class
Message
2196
svchost.exe
A Network Trojan was detected
STEALER [ANY.RUN] Domain has been identified as part of Lumma Stealer's infrastructure (rodformi .run)
2196
svchost.exe
A Network Trojan was detected
STEALER [ANY.RUN] Domain has been identified as part of Lumma Stealer's infrastructure (navstarx .shop)
2196
svchost.exe
A Network Trojan was detected
STEALER [ANY.RUN] Domain has been identified as part of Lumma Stealer's infrastructure (metalsyo .digital)
2196
svchost.exe
A Network Trojan was detected
STEALER [ANY.RUN] Domain has been identified as part of Lumma Stealer's infrastructure (starcloc .bet)
2196
svchost.exe
A Network Trojan was detected
STEALER [ANY.RUN] Domain has been identified as part of Lumma Stealer's infrastructure (ironloxp .live)
2196
svchost.exe
A Network Trojan was detected
STEALER [ANY.RUN] Domain has been identified as part of Lumma Stealer's infrastructure (advennture .top)
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rodformi .run)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navstarx .shop)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (metalsyo .digital)
No debug info