File name:

Sigmanly_bab29eb9c903cbde7fbbbbfc2c24e9d2e2898ceacdd645c9768ab196961a97fa

Full analysis: https://app.any.run/tasks/d8d67ed9-a49e-404e-ae02-6e81e218f786
Verdict: Malicious activity
Analysis date: May 15, 2025, 14:58:08
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
upx
golang
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, 3 sections
MD5:

AB2D3E73B81519AD8C8CDEB620CBF5D3

SHA1:

F7060F9B43741477BA7093CCB66833ABB8BD576B

SHA256:

BAB29EB9C903CBDE7FBBBBFC2C24E9D2E2898CEACDD645C9768AB196961A97FA

SSDEEP:

98304:OMklMMwKET40RoSBRX1K9F3cjQKm/DMbDD9ek+2No9XOZln13dm36XOBXSlorW/B:anLiwWYpu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • Sigmanly_bab29eb9c903cbde7fbbbbfc2c24e9d2e2898ceacdd645c9768ab196961a97fa.exe (PID: 7744)

  • SUSPICIOUS

    • Uses WMIC.EXE to obtain physical disk drive information

      • cmd.exe (PID: 7988)

    • Starts CMD.EXE for commands execution

      • Sigmanly_bab29eb9c903cbde7fbbbbfc2c24e9d2e2898ceacdd645c9768ab196961a97fa.exe (PID: 7744)

    • Uses WMIC.EXE to obtain BIOS management information

      • cmd.exe (PID: 7792)

    • Uses WMIC.EXE to obtain CPU information

      • cmd.exe (PID: 8104)

  • INFO

    • The sample compiled with english language support

      • Sigmanly_bab29eb9c903cbde7fbbbbfc2c24e9d2e2898ceacdd645c9768ab196961a97fa.exe (PID: 7744)

    • Checks supported languages

      • Sigmanly_bab29eb9c903cbde7fbbbbfc2c24e9d2e2898ceacdd645c9768ab196961a97fa.exe (PID: 7744)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 8044)
      • WMIC.exe (PID: 8176)
      • WMIC.exe (PID: 7848)

    • Reads the computer name

      • Sigmanly_bab29eb9c903cbde7fbbbbfc2c24e9d2e2898ceacdd645c9768ab196961a97fa.exe (PID: 7744)

    • Checks proxy server information

      • slui.exe (PID: 5008)

    • UPX packer has been detected

      • Sigmanly_bab29eb9c903cbde7fbbbbfc2c24e9d2e2898ceacdd645c9768ab196961a97fa.exe (PID: 7744)

    • Drops encrypted JS script (Microsoft Script Encoder)

      • Sigmanly_bab29eb9c903cbde7fbbbbfc2c24e9d2e2898ceacdd645c9768ab196961a97fa.exe (PID: 7744)

    • Reads the software policy settings

      • slui.exe (PID: 5008)

    • Application based on Golang

      • Sigmanly_bab29eb9c903cbde7fbbbbfc2c24e9d2e2898ceacdd645c9768ab196961a97fa.exe (PID: 7744)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (87.1)
.exe | Generic Win/DOS Executable (6.4)
.exe | DOS Executable Generic (6.4)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Large address aware, No debug
PEType: PE32+
LinkerVersion: 2.43
CodeSize: 3497984
InitializedDataSize: 36864
UninitializedDataSize: 7602176
EntryPoint: 0xa96be0
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 1.2.6.0
ProductVersionNumber: 1.2.6.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: -
CompanyName: Hola
FileDescription: HolaVPN: Fast, Modern, Secure VPN
FileVersion: 1.2.6
InternalName: HolaVPN
LegalCopyright: Copyright (c) 2016-2025 Hola
LegalTrademarks: HolaVPN
OriginalFileName: holavpn.exe
PrivateBuild: -
ProductName: HolaVPN
ProductVersion: 1.2.6
SpecialBuild: -
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
11
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start sigmanly_bab29eb9c903cbde7fbbbbfc2c24e9d2e2898ceacdd645c9768ab196961a97fa.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
5008C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7744"C:\Users\admin\Desktop\Sigmanly_bab29eb9c903cbde7fbbbbfc2c24e9d2e2898ceacdd645c9768ab196961a97fa.exe" C:\Users\admin\Desktop\Sigmanly_bab29eb9c903cbde7fbbbbfc2c24e9d2e2898ceacdd645c9768ab196961a97fa.exe
explorer.exe
User:
admin
Company:
Hola
Integrity Level:
MEDIUM
Description:
HolaVPN: Fast, Modern, Secure VPN
Version:
1.2.6
Modules
Images
c:\users\admin\desktop\sigmanly_bab29eb9c903cbde7fbbbbfc2c24e9d2e2898ceacdd645c9768ab196961a97fa.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\umpdc.dll
7792CMD /C "WMIC BIOS GET SERIALNUMBER"C:\Windows\System32\cmd.exe—Sigmanly_bab29eb9c903cbde7fbbbbfc2c24e9d2e2898ceacdd645c9768ab196961a97fa.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
7800\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7848WMIC BIOS GET SERIALNUMBERC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
7988CMD /C "WMIC DISKDRIVE GET SERIALNUMBER"C:\Windows\System32\cmd.exe—Sigmanly_bab29eb9c903cbde7fbbbbfc2c24e9d2e2898ceacdd645c9768ab196961a97fa.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
7996\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
8044WMIC DISKDRIVE GET SERIALNUMBERC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
8104CMD /C "WMIC CPU GET ProcessorID"C:\Windows\System32\cmd.exe—Sigmanly_bab29eb9c903cbde7fbbbbfc2c24e9d2e2898ceacdd645c9768ab196961a97fa.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
8112\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
4 269
Read events
4 269
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
48
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.163:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2432
SIHClient.exe
GET
200
23.48.23.163:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
2432
SIHClient.exe
GET
200
23.48.23.163:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
2432
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2432
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
304
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2432
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
2432
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2432
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.163:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7744
Sigmanly_bab29eb9c903cbde7fbbbbfc2c24e9d2e2898ceacdd645c9768ab196961a97fa.exe
88.119.165.84:8080
towerbingobongoboom.com
Informacines sistemos ir technologijos, UAB
LT
malicious
6544
svchost.exe
40.126.32.138:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
google.com
  • 216.58.206.78
whitelisted
crl.microsoft.com
  • 23.48.23.163
  • 23.48.23.157
  • 23.48.23.164
  • 23.48.23.155
  • 23.48.23.136
  • 23.48.23.146
  • 23.48.23.185
  • 23.48.23.184
  • 23.48.23.189
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 184.30.21.171
whitelisted
towerbingobongoboom.com
  • 88.119.165.84
malicious
login.live.com
  • 40.126.32.138
  • 20.190.160.67
  • 20.190.160.22
  • 20.190.160.66
  • 20.190.160.130
  • 20.190.160.4
  • 40.126.32.133
  • 20.190.160.17
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Sigmanly_bab29eb9c903cbde7fbbbbfc2c24e9d2e2898ceacdd645c9768ab196961a97fa