File name:

b55b2edd91937f6ec64679d3d2a7c99ab64bf370029074072b0a227ea5df3d75

Full analysis: https://app.any.run/tasks/f7c503ea-6b78-4727-90c8-746d19cf3a4a
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: April 29, 2025, 16:26:52
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
lumma
amadey
stealc
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

CD6A629C09E90B45121547142D851CB2

SHA1:

F358BE9170510850506740575F4D6F980177B4B8

SHA256:

B55B2EDD91937F6EC64679D3D2A7C99AB64BF370029074072B0A227EA5DF3D75

SSDEEP:

98304:Dn255VU+98RiR8haVTzO3f27soFYY22uXp9XatlYGGO+g+H+PgKYyyrK3pMmag2E:4TUtvE0G

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • AMADEY mutex has been found

      • rapes.exe (PID: 7344)
      • 1C00A2.exe (PID: 5736)
    • STEALC has been detected

      • 3o42b.exe (PID: 7876)
    • STEALC mutex has been found

      • 3o42b.exe (PID: 7876)
    • Stealers network behavior

      • svchost.exe (PID: 2196)
    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)
  • SUSPICIOUS

    • Process drops legitimate windows executable

      • b55b2edd91937f6ec64679d3d2a7c99ab64bf370029074072b0a227ea5df3d75.exe (PID: 5280)
    • Starts a Microsoft application from unusual location

      • H6Z68.exe (PID: 6044)
      • b55b2edd91937f6ec64679d3d2a7c99ab64bf370029074072b0a227ea5df3d75.exe (PID: 5280)
    • Executable content was dropped or overwritten

      • b55b2edd91937f6ec64679d3d2a7c99ab64bf370029074072b0a227ea5df3d75.exe (PID: 5280)
      • H6Z68.exe (PID: 6044)
      • 1C00A2.exe (PID: 5736)
    • Reads the BIOS version

      • 1C00A2.exe (PID: 5736)
      • 2L7514.exe (PID: 7356)
      • rapes.exe (PID: 7344)
      • 3o42b.exe (PID: 7876)
    • Reads security settings of Internet Explorer

      • 1C00A2.exe (PID: 5736)
      • rapes.exe (PID: 7344)
    • Starts itself from another location

      • 1C00A2.exe (PID: 5736)
    • Windows Defender mutex has been found

      • 3o42b.exe (PID: 7876)
  • INFO

    • The sample compiled with english language support

      • b55b2edd91937f6ec64679d3d2a7c99ab64bf370029074072b0a227ea5df3d75.exe (PID: 5280)
    • Checks supported languages

      • b55b2edd91937f6ec64679d3d2a7c99ab64bf370029074072b0a227ea5df3d75.exe (PID: 5280)
      • H6Z68.exe (PID: 6044)
      • 1C00A2.exe (PID: 5736)
      • 2L7514.exe (PID: 7356)
      • rapes.exe (PID: 7344)
      • 3o42b.exe (PID: 7876)
    • Create files in a temporary directory

      • b55b2edd91937f6ec64679d3d2a7c99ab64bf370029074072b0a227ea5df3d75.exe (PID: 5280)
      • H6Z68.exe (PID: 6044)
      • 1C00A2.exe (PID: 5736)
    • Checks proxy server information

      • rapes.exe (PID: 7344)
    • Reads the computer name

      • rapes.exe (PID: 7344)
      • 2L7514.exe (PID: 7356)
      • 1C00A2.exe (PID: 5736)
      • 3o42b.exe (PID: 7876)
    • Process checks computer location settings

      • 1C00A2.exe (PID: 5736)
    • Reads the software policy settings

      • 2L7514.exe (PID: 7356)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:05:24 22:49:06+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.13
CodeSize: 25600
InitializedDataSize: 5805056
UninitializedDataSize: -
EntryPoint: 0x6a60
OSVersion: 10
ImageVersion: 10
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 11.0.17763.1
ProductVersionNumber: 11.0.17763.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor
FileVersion: 11.00.17763.1 (WinBuild.160101.0800)
InternalName: Wextract
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: WEXTRACT.EXE .MUI
ProductName: Internet Explorer
ProductVersion: 11.00.17763.1
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
9
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start b55b2edd91937f6ec64679d3d2a7c99ab64bf370029074072b0a227ea5df3d75.exe h6z68.exe 1c00a2.exe sppextcomobj.exe no specs slui.exe no specs rapes.exe 2l7514.exe #LUMMA svchost.exe #STEALC 3o42b.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
5280"C:\Users\admin\AppData\Local\Temp\b55b2edd91937f6ec64679d3d2a7c99ab64bf370029074072b0a227ea5df3d75.exe" C:\Users\admin\AppData\Local\Temp\b55b2edd91937f6ec64679d3d2a7c99ab64bf370029074072b0a227ea5df3d75.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\b55b2edd91937f6ec64679d3d2a7c99ab64bf370029074072b0a227ea5df3d75.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
5736C:\Users\admin\AppData\Local\Temp\IXP001.TMP\1C00A2.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\1C00A2.exe
H6Z68.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ixp001.tmp\1c00a2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6044C:\Users\admin\AppData\Local\Temp\IXP000.TMP\H6Z68.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\H6Z68.exe
b55b2edd91937f6ec64679d3d2a7c99ab64bf370029074072b0a227ea5df3d75.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\h6z68.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7204C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exesvchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7236"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exeSppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7344"C:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exe" C:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1C00A2.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\bb556cff4a\rapes.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7356C:\Users\admin\AppData\Local\Temp\IXP001.TMP\2L7514.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\2L7514.exe
H6Z68.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ixp001.tmp\2l7514.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7876C:\Users\admin\AppData\Local\Temp\IXP000.TMP\3o42b.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\3o42b.exe
b55b2edd91937f6ec64679d3d2a7c99ab64bf370029074072b0a227ea5df3d75.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\3o42b.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
1 219
Read events
1 216
Write events
3
Delete events
0

Modification events

(PID) Process:(7344) rapes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7344) rapes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7344) rapes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
5
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
5280b55b2edd91937f6ec64679d3d2a7c99ab64bf370029074072b0a227ea5df3d75.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\H6Z68.exeexecutable
MD5:931960C183CA7E4AF8A8E9C61AD2C7B2
SHA256:DE87577221EDCB3E2945B33E824A2EB8BA5A16112232A1A55A61443C7D4164DA
5280b55b2edd91937f6ec64679d3d2a7c99ab64bf370029074072b0a227ea5df3d75.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\3o42b.exeexecutable
MD5:C3F960B7822A0D2E2AFCA856CA678E23
SHA256:7898B352AD22D41F6FD9FA60E3A71151F75122929E879D8655E35D4CA8E4B921
57361C00A2.exeC:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exeexecutable
MD5:BEAB850AED65C3015EBA75FB4CB4D32A
SHA256:502230611025E3DA928BC79E71EF5AB6BE3603BB62E4128B4707A99BA9AFB0B7
57361C00A2.exeC:\Windows\Tasks\rapes.jobbinary
MD5:0C99DB21724C94A85A0E973B85D0FB4C
SHA256:58E6FBD75288CCD25AEEE4B06CC1F1AB7D3AA4C1941F750E8A7C5F41EBF4D634
6044H6Z68.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\2L7514.exeexecutable
MD5:11BEBD09728E344AB9A13AA32A5AB982
SHA256:830F4F62A09858606B6C97B0291CA537D3B243FB4A8A7199BCD28471EC58F501
6044H6Z68.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\1C00A2.exeexecutable
MD5:BEAB850AED65C3015EBA75FB4CB4D32A
SHA256:502230611025E3DA928BC79E71EF5AB6BE3603BB62E4128B4707A99BA9AFB0B7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
24
DNS requests
22
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
1764
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
1764
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
51.124.78.146:443
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
whitelisted
5496
MoUsoCoreWorker.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
5496
MoUsoCoreWorker.exe
51.124.78.146:443
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7356
2L7514.exe
23.197.127.21:443
steamcommunity.com
Akamai International B.V.
US
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
google.com
  • 216.58.206.78
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 23.219.150.101
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
citydisco.bet
unknown
crosshairc.life
unknown
mrodularmall.top
unknown
jowinjoinery.icu
unknown
legenassedk.top
unknown
htardwarehu.icu
unknown

Threats

PID
Process
Class
Message
2196
svchost.exe
A Network Trojan was detected
STEALER [ANY.RUN] Domain has been identified as part of Lumma Stealer's infrastructure (cjlaspcorne .icu)
2196
svchost.exe
Potentially Bad Traffic
ET INFO DNS Query for Suspicious .icu Domain
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2196
svchost.exe
A Network Trojan was detected
STEALER [ANY.RUN] Domain has been identified as part of Lumma Stealer's infrastructure (bugildbett .top)
2196
svchost.exe
A Network Trojan was detected
STEALER [ANY.RUN] Domain has been identified as part of Lumma Stealer's infrastructure (legenassedk .top)
2196
svchost.exe
A Network Trojan was detected
STEALER [ANY.RUN] Domain has been identified as part of Lumma Stealer's infrastructure (mrodularmall .top)
2196
svchost.exe
A Network Trojan was detected
STEALER [ANY.RUN] Domain has been identified as part of Lumma Stealer's infrastructure (htardwarehu .icu)
2196
svchost.exe
A Network Trojan was detected
STEALER [ANY.RUN] Domain has been identified as part of Lumma Stealer's infrastructure (jowinjoinery .icu)
No debug info