File name:

2b862bda2c1965adf06eaf8467fb07c0.exe

Full analysis: https://app.any.run/tasks/f2fa06ff-907b-4399-9ea0-c55745f81875
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: March 24, 2025, 16:59:26
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
lumma
themida
opendir
loader
amadey
botnet
rdp
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

2B862BDA2C1965ADF06EAF8467FB07C0

SHA1:

732EB40CD8998908E6A052BD4F1B6B12FC159636

SHA256:

C27C8F644F8CA6CECACFC6B590BEF2977B41BE11ED3B8A1B81A7C91BBAA42415

SSDEEP:

98304:00V9MlqczLwah6u+8GJP6oE8hae3ZJjFXtJ+GR+qhwd7XjxlTS4Ue/zwEvpap79q:zpz9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • LUMMA mutex has been found

      • 2b862bda2c1965adf06eaf8467fb07c0.exe (PID: 7804)
    • Steals credentials from Web Browsers

      • 2b862bda2c1965adf06eaf8467fb07c0.exe (PID: 7804)
    • Actions looks like stealing of personal data

      • 2b862bda2c1965adf06eaf8467fb07c0.exe (PID: 7804)
    • AMADEY mutex has been found

      • 3V6XXHV8045LMH5KB.exe (PID: 5024)
      • rapes.exe (PID: 4868)
      • rapes.exe (PID: 1180)
      • rapes.exe (PID: 5956)
    • AMADEY has been detected (SURICATA)

      • rapes.exe (PID: 4868)
    • Connects to the CnC server

      • rapes.exe (PID: 4868)
    • AMADEY has been detected (YARA)

      • rapes.exe (PID: 4868)
  • SUSPICIOUS

    • Reads the BIOS version

      • 2b862bda2c1965adf06eaf8467fb07c0.exe (PID: 7804)
      • 3V6XXHV8045LMH5KB.exe (PID: 5024)
      • rapes.exe (PID: 4868)
      • rapes.exe (PID: 5956)
      • rapes.exe (PID: 1180)
    • Potential Corporate Privacy Violation

      • 2b862bda2c1965adf06eaf8467fb07c0.exe (PID: 7804)
    • Process requests binary or script from the Internet

      • 2b862bda2c1965adf06eaf8467fb07c0.exe (PID: 7804)
    • Executable content was dropped or overwritten

      • 2b862bda2c1965adf06eaf8467fb07c0.exe (PID: 7804)
      • 3V6XXHV8045LMH5KB.exe (PID: 5024)
    • Searches for installed software

      • 2b862bda2c1965adf06eaf8467fb07c0.exe (PID: 7804)
    • Connects to the server without a host name

      • 2b862bda2c1965adf06eaf8467fb07c0.exe (PID: 7804)
      • rapes.exe (PID: 4868)
    • Reads security settings of Internet Explorer

      • 3V6XXHV8045LMH5KB.exe (PID: 5024)
      • rapes.exe (PID: 4868)
    • Starts itself from another location

      • 3V6XXHV8045LMH5KB.exe (PID: 5024)
    • Contacting a server suspected of hosting an CnC

      • rapes.exe (PID: 4868)
    • There is functionality for enable RDP (YARA)

      • rapes.exe (PID: 4868)
    • The process executes via Task Scheduler

      • rapes.exe (PID: 5956)
      • rapes.exe (PID: 1180)
  • INFO

    • Reads the computer name

      • 2b862bda2c1965adf06eaf8467fb07c0.exe (PID: 7804)
      • 3V6XXHV8045LMH5KB.exe (PID: 5024)
      • rapes.exe (PID: 4868)
    • Checks supported languages

      • 2b862bda2c1965adf06eaf8467fb07c0.exe (PID: 7804)
      • 3V6XXHV8045LMH5KB.exe (PID: 5024)
      • rapes.exe (PID: 4868)
      • rapes.exe (PID: 5956)
      • rapes.exe (PID: 1180)
    • Reads the machine GUID from the registry

      • 2b862bda2c1965adf06eaf8467fb07c0.exe (PID: 7804)
    • Themida protector has been detected

      • 2b862bda2c1965adf06eaf8467fb07c0.exe (PID: 7804)
      • rapes.exe (PID: 4868)
    • Create files in a temporary directory

      • 2b862bda2c1965adf06eaf8467fb07c0.exe (PID: 7804)
      • 3V6XXHV8045LMH5KB.exe (PID: 5024)
    • Reads the software policy settings

      • 2b862bda2c1965adf06eaf8467fb07c0.exe (PID: 7804)
      • slui.exe (PID: 4408)
    • Process checks computer location settings

      • 3V6XXHV8045LMH5KB.exe (PID: 5024)
    • Checks proxy server information

      • rapes.exe (PID: 4868)
      • slui.exe (PID: 4408)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(4868) rapes.exe
C2176.113.115.6
URLhttp://176.113.115.6/Ni9kiput/index.php
Version5.21
Options
Drop directorybb556cff4a
Drop namerapes.exe
Strings (125)ps1
og:
r=
------
.jpg
rundll32.exe
GET
/Ni9kiput/index.php
<c>
WinDefender
&&
pc:
wb
Norton
rapes.exe
ProgramData\
rundll32
Powershell.exe
/k
kernel32.dll
Sophos
random
POST
cred.dll|clip.dll|
#
un:
Bitdefender
cred.dll
/Plugins/
shell32.dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
|
Doctor Web
e3
2019
00000419
Kaspersky Lab
st=s
%USERPROFILE%
\0000
VideoID
CurrentBuild
dll
ar:
bi:
Content-Type: multipart/form-data; boundary=----
+++
Startup
Avira
ESET
" && ren
msi
------
Content-Disposition: form-data; name="data"; filename="
Main
<d>
bb556cff4a
SYSTEM\ControlSet001\Services\BasicDisplay\Video
360TotalSecurity
=
e1
rb
Comodo
?scr=1
Panda Security
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
" && timeout 1 && del
2025
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
0123456789
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Programs
00000422
lv:
e2
:::
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
SOFTWARE\Microsoft\Windows NT\CurrentVersion
dm:
AVG
DefaultSettings.YResolution
clip.dll
&unit=
AVAST Software
exe
http://
Keyboard Layout\Preload
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
cmd /C RMDIR /s/q
https://
shutdown -s -t 0
5.21
-unicode-
-executionpolicy remotesigned -File "
ComputerName
2022
--
vs:
\
sd:
d1
S-%lu-
" Content-Type: application/octet-stream
%-lu
GetNativeSystemInfo
176.113.115.6
&& Exit"
Content-Type: application/x-www-form-urlencoded
/quiet
abcdefghijklmnopqrstuvwxyz0123456789-_
ProductName
"taskkill /f /im "
00000423
Rem
zip
\App
2016
"
0000043f
os:
cmd
id:
av:
-%lu
DefaultSettings.XResolution
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:20 19:41:41+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 311808
InitializedDataSize: 46592
UninitializedDataSize: -
EntryPoint: 0x301000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
132
Monitored processes
6
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #LUMMA 2b862bda2c1965adf06eaf8467fb07c0.exe 3v6xxhv8045lmh5kb.exe #AMADEY rapes.exe slui.exe rapes.exe no specs rapes.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1180"C:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exe"C:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exesvchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\bb556cff4a\rapes.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
4408C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4868"C:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exe" C:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exe
3V6XXHV8045LMH5KB.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\bb556cff4a\rapes.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Amadey
(PID) Process(4868) rapes.exe
C2176.113.115.6
URLhttp://176.113.115.6/Ni9kiput/index.php
Version5.21
Options
Drop directorybb556cff4a
Drop namerapes.exe
Strings (125)ps1
og:
r=
------
.jpg
rundll32.exe
GET
/Ni9kiput/index.php
<c>
WinDefender
&&
pc:
wb
Norton
rapes.exe
ProgramData\
rundll32
Powershell.exe
/k
kernel32.dll
Sophos
random
POST
cred.dll|clip.dll|
#
un:
Bitdefender
cred.dll
/Plugins/
shell32.dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
|
Doctor Web
e3
2019
00000419
Kaspersky Lab
st=s
%USERPROFILE%
\0000
VideoID
CurrentBuild
dll
ar:
bi:
Content-Type: multipart/form-data; boundary=----
+++
Startup
Avira
ESET
" && ren
msi
------
Content-Disposition: form-data; name="data"; filename="
Main
<d>
bb556cff4a
SYSTEM\ControlSet001\Services\BasicDisplay\Video
360TotalSecurity
=
e1
rb
Comodo
?scr=1
Panda Security
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
" && timeout 1 && del
2025
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
0123456789
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Programs
00000422
lv:
e2
:::
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
SOFTWARE\Microsoft\Windows NT\CurrentVersion
dm:
AVG
DefaultSettings.YResolution
clip.dll
&unit=
AVAST Software
exe
http://
Keyboard Layout\Preload
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
cmd /C RMDIR /s/q
https://
shutdown -s -t 0
5.21
-unicode-
-executionpolicy remotesigned -File "
ComputerName
2022
--
vs:
\
sd:
d1
S-%lu-
" Content-Type: application/octet-stream
%-lu
GetNativeSystemInfo
176.113.115.6
&& Exit"
Content-Type: application/x-www-form-urlencoded
/quiet
abcdefghijklmnopqrstuvwxyz0123456789-_
ProductName
"taskkill /f /im "
00000423
Rem
zip
\App
2016
"
0000043f
os:
cmd
id:
av:
-%lu
DefaultSettings.XResolution
5024"C:\Users\admin\AppData\Local\Temp\3V6XXHV8045LMH5KB.exe"C:\Users\admin\AppData\Local\Temp\3V6XXHV8045LMH5KB.exe
2b862bda2c1965adf06eaf8467fb07c0.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\3v6xxhv8045lmh5kb.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5956"C:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exe"C:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exesvchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\bb556cff4a\rapes.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
7804"C:\Users\admin\Desktop\2b862bda2c1965adf06eaf8467fb07c0.exe" C:\Users\admin\Desktop\2b862bda2c1965adf06eaf8467fb07c0.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\2b862bda2c1965adf06eaf8467fb07c0.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
7 510
Read events
7 507
Write events
3
Delete events
0

Modification events

(PID) Process:(4868) rapes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4868) rapes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4868) rapes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
2
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
50243V6XXHV8045LMH5KB.exeC:\Windows\Tasks\rapes.jobbinary
MD5:AB5DB06F0ED906635793EBCB3B1AC738
SHA256:A0599A413DF9282DBC485BF83DA9622E19C53DB4B6B7B238F9CD8E2DB9EF5E47
50243V6XXHV8045LMH5KB.exeC:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exeexecutable
MD5:ABAF63F73723934CB35B5332D5776100
SHA256:A512BAF13D7076E8CE286C510D8B4195B0857339C6E1C1A487A0A74903230532
78042b862bda2c1965adf06eaf8467fb07c0.exeC:\Users\admin\AppData\Local\Temp\3V6XXHV8045LMH5KB.exeexecutable
MD5:ABAF63F73723934CB35B5332D5776100
SHA256:A512BAF13D7076E8CE286C510D8B4195B0857339C6E1C1A487A0A74903230532
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
28
DNS requests
6
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4868
rapes.exe
POST
200
176.113.115.6:80
http://176.113.115.6/Ni9kiput/index.php
unknown
malicious
7804
2b862bda2c1965adf06eaf8467fb07c0.exe
GET
200
176.113.115.7:80
http://176.113.115.7/mine/random.exe
unknown
malicious
4868
rapes.exe
POST
200
176.113.115.6:80
http://176.113.115.6/Ni9kiput/index.php
unknown
malicious
POST
200
104.21.112.1:443
https://wxayfarer.live/ALosnz
unknown
binary
60 b
malicious
POST
200
104.21.96.1:443
https://wxayfarer.live/ALosnz
unknown
binary
60 b
malicious
POST
200
104.21.112.1:443
https://wxayfarer.live/ALosnz
unknown
binary
34.1 Kb
malicious
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
POST
200
104.21.16.1:443
https://wxayfarer.live/ALosnz
unknown
binary
60 b
malicious
POST
200
104.21.32.1:443
https://wxayfarer.live/ALosnz
unknown
binary
60 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
whitelisted
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7804
2b862bda2c1965adf06eaf8467fb07c0.exe
104.21.64.1:443
wxayfarer.live
CLOUDFLARENET
malicious
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7804
2b862bda2c1965adf06eaf8467fb07c0.exe
176.113.115.7:80
Red Bytes LLC
RU
malicious
4868
rapes.exe
176.113.115.6:80
Red Bytes LLC
RU
malicious
7524
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4408
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.78
whitelisted
wxayfarer.live
  • 104.21.64.1
  • 104.21.112.1
  • 104.21.48.1
  • 104.21.32.1
  • 104.21.16.1
  • 104.21.96.1
  • 104.21.80.1
malicious
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

PID
Process
Class
Message
7804
2b862bda2c1965adf06eaf8467fb07c0.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 29
7804
2b862bda2c1965adf06eaf8467fb07c0.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7804
2b862bda2c1965adf06eaf8467fb07c0.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7804
2b862bda2c1965adf06eaf8467fb07c0.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
7804
2b862bda2c1965adf06eaf8467fb07c0.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
4868
rapes.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 29
4868
rapes.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
4868
rapes.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
4868
rapes.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
No debug info