| File name: | c359645932b44cea5abc0857102c206e729f091f85112275e73d7817f7388af0.exe |
| Full analysis: | https://app.any.run/tasks/304740c8-6eef-4018-b986-be397a3f0b80 |
| Verdict: | Malicious activity |
| Threats: | Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks. |
| Analysis date: | September 03, 2025, 17:28:18 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections |
| MD5: | 2816B7C92F27819B6AC86B2CD8C5CBBA |
| SHA1: | 1E0EA7FAC106CE46C9A88699D41BD5D679D6D662 |
| SHA256: | C359645932B44CEA5ABC0857102C206E729F091F85112275E73D7817F7388AF0 |
| SSDEEP: | 98304:Ln2e2yx5mi6x1cEnEcoKRkZ5YjbdkrpyCZuMX7H2mXv8PCJWkVjZu5+ouBIkb8Ti:QEq5Y18R |
| .exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (37.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (8.8) |
| .exe | | | Win32 Executable (generic) (6) |
| .exe | | | Generic Win/DOS Executable (2.7) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2022:05:24 22:49:06+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14.13 |
| CodeSize: | 25600 |
| InitializedDataSize: | 4147200 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x6a60 |
| OSVersion: | 10 |
| ImageVersion: | 10 |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 11.0.17763.1 |
| ProductVersionNumber: | 11.0.17763.1 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Windows NT 32-bit |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | Microsoft Corporation |
| FileDescription: | Win32 Cabinet Self-Extractor |
| FileVersion: | 11.00.17763.1 (WinBuild.160101.0800) |
| InternalName: | Wextract |
| LegalCopyright: | © Microsoft Corporation. All rights reserved. |
| OriginalFileName: | WEXTRACT.EXE .MUI |
| ProductName: | Internet Explorer |
| ProductVersion: | 11.00.17763.1 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 304 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --field-trial-handle=5700,i,5258382578471322267,1101648073479413296,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=5936 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 133.0.6943.127 Modules
| |||||||||||||||
| 320 | C:\WINDOWS\SysWOW64\WerFault.exe -u -p 1660 -s 544 | C:\Windows\SysWOW64\WerFault.exe | dSPiPTCo.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Problem Reporting Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 320 | findstr "SophosHealth nsWscSvc ekrn bdservicehost AvastUI AVGUI & if not errorlevel 1 Set fIeCi=AutoIt3.exe & Set ZIoKKzPwFFbGod=.a3x & Set yZPyQjkdcs=300 | C:\Windows\SysWOW64\findstr.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Find String (QGREP) Utility Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 436 | sc stop WaaSMedicSvc | C:\Windows\System32\sc.exe | — | cmd.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Service Control Manager Configuration Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 472 | icacls "C:\WINDOWS\winloghelper.exe" /setowner "SYSTEM" | C:\Windows\SysWOW64\icacls.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 472 | reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\wuauserv" /v Start /t REG_DWORD /d 4 /f | C:\Windows\System32\reg.exe | — | cmd.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Registry Console Tool Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 512 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3152,i,5015738639837734772,6398006927898690251,262144 --variations-seed-version=20250903-050052.843000 --mojo-platform-channel-handle=3220 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 133.0.6943.127 Modules
| |||||||||||||||
| 532 | "C:\WINDOWS\dSPiPTCo.exe" | C:\Windows\dSPiPTCo.exe | 1G13S4.exe | ||||||||||||
User: SYSTEM Integrity Level: SYSTEM Exit code: 255 Modules
| |||||||||||||||
| 532 | "C:\WINDOWS\dSPiPTCo.exe" | C:\Windows\dSPiPTCo.exe | 1G13S4.exe | ||||||||||||
User: SYSTEM Integrity Level: SYSTEM Exit code: 255 Modules
| |||||||||||||||
| 620 | icacls "C:\WINDOWS\systemhelper.exe" /remove:d Everyone Administrators | C:\Windows\SysWOW64\icacls.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Exit code: 6 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| (PID) Process: | (2368) 1G13S4.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\DownloaderService |
| Operation: | write | Name: | EventMessageFile |
Value: C:\Windows\Microsoft.NET\Framework\v4.0.30319\EventLogMessages.dll | |||
| (PID) Process: | (2880) WerFault.exe | Key: | \REGISTRY\A\{bad4d816-f494-34a4-bb91-53819f6ea80b}\Root\InventoryApplicationFile\dspiptco.exe|26a8f550e63d9fd8 |
| Operation: | write | Name: | ProgramId |
Value: 00066551dc540b3dcc6f2dea88cfbcc3f32e0000ffff | |||
| (PID) Process: | (2880) WerFault.exe | Key: | \REGISTRY\A\{bad4d816-f494-34a4-bb91-53819f6ea80b}\Root\InventoryApplicationFile\dspiptco.exe|26a8f550e63d9fd8 |
| Operation: | write | Name: | FileId |
Value: 0000c1b667b0ff98bbb1d2495b4fd5dda1eeca494799 | |||
| (PID) Process: | (2880) WerFault.exe | Key: | \REGISTRY\A\{bad4d816-f494-34a4-bb91-53819f6ea80b}\Root\InventoryApplicationFile\dspiptco.exe|26a8f550e63d9fd8 |
| Operation: | write | Name: | LowerCaseLongPath |
Value: c:\windows\dspiptco.exe | |||
| (PID) Process: | (2880) WerFault.exe | Key: | \REGISTRY\A\{bad4d816-f494-34a4-bb91-53819f6ea80b}\Root\InventoryApplicationFile\dspiptco.exe|26a8f550e63d9fd8 |
| Operation: | write | Name: | LongPathHash |
Value: dspiptco.exe|26a8f550e63d9fd8 | |||
| (PID) Process: | (2880) WerFault.exe | Key: | \REGISTRY\A\{bad4d816-f494-34a4-bb91-53819f6ea80b}\Root\InventoryApplicationFile\dspiptco.exe|26a8f550e63d9fd8 |
| Operation: | write | Name: | Name |
Value: dSPiPTCo.exe | |||
| (PID) Process: | (2880) WerFault.exe | Key: | \REGISTRY\A\{bad4d816-f494-34a4-bb91-53819f6ea80b}\Root\InventoryApplicationFile\dspiptco.exe|26a8f550e63d9fd8 |
| Operation: | write | Name: | OriginalFileName |
Value: | |||
| (PID) Process: | (2880) WerFault.exe | Key: | \REGISTRY\A\{bad4d816-f494-34a4-bb91-53819f6ea80b}\Root\InventoryApplicationFile\dspiptco.exe|26a8f550e63d9fd8 |
| Operation: | write | Name: | Publisher |
Value: | |||
| (PID) Process: | (2880) WerFault.exe | Key: | \REGISTRY\A\{bad4d816-f494-34a4-bb91-53819f6ea80b}\Root\InventoryApplicationFile\dspiptco.exe|26a8f550e63d9fd8 |
| Operation: | write | Name: | Version |
Value: | |||
| (PID) Process: | (2880) WerFault.exe | Key: | \REGISTRY\A\{bad4d816-f494-34a4-bb91-53819f6ea80b}\Root\InventoryApplicationFile\dspiptco.exe|26a8f550e63d9fd8 |
| Operation: | write | Name: | BinFileVersion |
Value: | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2880 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_dSPiPTCo.exe_ab5e1044b8c384276235db8e891ca16d6221c_a5c2b81c_1fddf66e-14cd-4db9-b2b0-7db0387e8d64\Report.wer | — | |
MD5:— | SHA256:— | |||
| 3396 | 1G13S4.exe | C:\Windows\winloghelper.exe | executable | |
MD5:156F4A8F006779A3493D9D476F1E8DDA | SHA256:C36ED034D523DA1F54D43176334D4BDA9F9ADCB940948646B43902A620EBDA45 | |||
| 3396 | 1G13S4.exe | C:\Windows\systemhelper.exe | executable | |
MD5:517156BD8DF2DB756D5B89C59877FE4E | SHA256:33CB07C16A39056738F1CAD11A9793AF4514D73796622E00A4D25D3F41766143 | |||
| 2880 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WEREBF2.tmp.WERInternalMetadata.xml | xml | |
MD5:93F7733F9EEF4A4FEC7182322FB55EAA | SHA256:6A3A4EADC2D7676992CBA2FA422F9E6014863CB27CF64AA3CA166E6A2693AEC0 | |||
| 2880 | WerFault.exe | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\CrashDumps\dSPiPTCo.exe.6240.dmp | binary | |
MD5:38988D1C60D5F508381029B0D43C7235 | SHA256:A5A5238996CE95BB645B72C9B492562C2026A0442C0D22341EBDEA87E1608EA6 | |||
| 2880 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WEREC12.tmp.xml | xml | |
MD5:77C5CC21D378315A19BB1FBA3CA9BD2A | SHA256:E03659D24CE30F826FDFEC8541648DAD67618E9F572EE2CA7F9504C2C001E61B | |||
| 3396 | 1G13S4.exe | C:\Users\admin\AppData\Local\Temp\WindowsLogsHelper.xml | xml | |
MD5:00BB4801C7CEF34837114CECE4717E33 | SHA256:223A8EF483BEFE2B6D38DD8CF8A8A59C236295355213B16DF73AE6D77F60C428 | |||
| 5496 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_dSPiPTCo.exe_ab5e1044b8c384276235db8e891ca16d6221c_a5c2b81c_73cbd3ea-d124-4865-95b3-8aa9dcc59510\Report.wer | — | |
MD5:— | SHA256:— | |||
| 1100 | systemhelper.exe | C:\Users\admin\AppData\Local\Temp\U8cRb9f.bat | text | |
MD5:A43FFD6B86EC1D617FD2872FD3118AF5 | SHA256:07BC6A2ED72E02E1988D152188BED752C21AB5282649F22C4C168A176CBDC690 | |||
| 1100 | systemhelper.exe | C:\Users\admin\AppData\Local\Temp\hater\cecho.exe | executable | |
MD5:E783BC59D0ED6CFBD8891F94AE23D1B3 | SHA256:5C1211559DDA10592CFEDD57681F18F4A702410816D36EDA95AEE6C74E3C6A47 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1040 | RUXIMICS.exe | GET | 200 | 23.216.77.6:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | DE | binary | 825 b | whitelisted |
1268 | svchost.exe | GET | 200 | 23.216.77.6:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | DE | binary | 825 b | whitelisted |
5944 | MoUsoCoreWorker.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | NL | binary | 814 b | whitelisted |
1268 | svchost.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | NL | binary | 814 b | whitelisted |
1040 | RUXIMICS.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | NL | binary | 814 b | whitelisted |
— | — | POST | 200 | 129.226.128.168:443 | https://mastwin.in/qsaz | CN | binary | 38.0 Kb | unknown |
6164 | winloghelper.exe | POST | 200 | 94.154.35.25:80 | http://94.154.35.25/di9ku38f/index.php | US | text | 1.89 Kb | unknown |
6164 | winloghelper.exe | POST | 200 | 94.154.35.25:80 | http://94.154.35.25/di9ku38f/index.php | US | text | 8 b | unknown |
— | — | GET | 200 | 142.250.185.195:443 | https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=133 | US | compressed | 75.5 Kb | unknown |
6164 | winloghelper.exe | GET | 200 | 178.16.55.189:80 | http://178.16.55.189/luma/random.exe | DE | executable | 1.71 Mb | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1268 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1040 | RUXIMICS.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | 23.216.77.6:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
1268 | svchost.exe | 23.216.77.6:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
1040 | RUXIMICS.exe | 23.216.77.6:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5944 | MoUsoCoreWorker.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
1268 | svchost.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
washerv.ru |
| malicious |
mastwin.in |
| unknown |
watson.events.data.microsoft.com |
| whitelisted |
clients2.google.com |
| whitelisted |
safebrowsingohttpgateway.googleapis.com |
| whitelisted |
clientservices.googleapis.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
2200 | svchost.exe | Domain Observed Used for C2 Detected | ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (washerv .ru) |
2200 | svchost.exe | Domain Observed Used for C2 Detected | MALWARE [ANY.RUN] Win32/Lumma CnC related domain (washerv .ru) |
2200 | svchost.exe | Domain Observed Used for C2 Detected | ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mastwin .in) |
3628 | 2U9672.exe | Domain Observed Used for C2 Detected | ET MALWARE Observed Win32/Lumma Stealer Related Domain (mastwin .in in TLS SNI) |
6164 | winloghelper.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 16 |
6164 | winloghelper.exe | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s) |
6164 | winloghelper.exe | Malware Command and Control Activity Detected | ET MALWARE Amadey CnC Response |
— | — | Malware Command and Control Activity Detected | MALWARE [ANY.RUN] Win32/Lumma CnC HTTP Activity observed |
6164 | winloghelper.exe | A Network Trojan was detected | MALWARE [ANY.RUN] Win32/Generic related IP address |
6164 | winloghelper.exe | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |
Process | Message |
|---|---|
2U9672.exe |
%s------------------------------------------------
--- Themida Professional ---
--- (c)2012 Oreans Technologies ---
------------------------------------------------
|
IObitUnlocker.exe | PostAction_Delete |
IObitUnlocker.exe | FileCount:268 |
IObitUnlocker.exe | C:\ProgramData\Microsoft\Windows Defender-------- |
IObitUnlocker.exe | C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection-------- |
IObitUnlocker.exe | C:\ProgramData\Microsoft\Windows Security Health-------- |
IObitUnlocker.exe | C:\ProgramData\Microsoft\Storage Health-------- |
IObitUnlocker.exe | C:\Program Files\Windows Defender-------- |
IObitUnlocker.exe | C:\Program Files\Windows Defender Advanced Threat Protection-------- |
IObitUnlocker.exe | C:\Program Files\Windows Security-------- |