| File name: | c359645932b44cea5abc0857102c206e729f091f85112275e73d7817f7388af0.exe |
| Full analysis: | https://app.any.run/tasks/304740c8-6eef-4018-b986-be397a3f0b80 |
| Verdict: | Malicious activity |
| Threats: | Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks. |
| Analysis date: | September 03, 2025, 17:28:18 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections |
| MD5: | 2816B7C92F27819B6AC86B2CD8C5CBBA |
| SHA1: | 1E0EA7FAC106CE46C9A88699D41BD5D679D6D662 |
| SHA256: | C359645932B44CEA5ABC0857102C206E729F091F85112275E73D7817F7388AF0 |
| SSDEEP: | 98304:Ln2e2yx5mi6x1cEnEcoKRkZ5YjbdkrpyCZuMX7H2mXv8PCJWkVjZu5+ouBIkb8Ti:QEq5Y18R |
| .exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (37.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (8.8) |
| .exe | | | Win32 Executable (generic) (6) |
| .exe | | | Generic Win/DOS Executable (2.7) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2022:05:24 22:49:06+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14.13 |
| CodeSize: | 25600 |
| InitializedDataSize: | 4147200 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x6a60 |
| OSVersion: | 10 |
| ImageVersion: | 10 |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 11.0.17763.1 |
| ProductVersionNumber: | 11.0.17763.1 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Windows NT 32-bit |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | Microsoft Corporation |
| FileDescription: | Win32 Cabinet Self-Extractor |
| FileVersion: | 11.00.17763.1 (WinBuild.160101.0800) |
| InternalName: | Wextract |
| LegalCopyright: | © Microsoft Corporation. All rights reserved. |
| OriginalFileName: | WEXTRACT.EXE .MUI |
| ProductName: | Internet Explorer |
| ProductVersion: | 11.00.17763.1 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 304 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --field-trial-handle=5700,i,5258382578471322267,1101648073479413296,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=5936 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 133.0.6943.127 Modules
| |||||||||||||||
| 320 | C:\WINDOWS\SysWOW64\WerFault.exe -u -p 1660 -s 544 | C:\Windows\SysWOW64\WerFault.exe | dSPiPTCo.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Problem Reporting Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 320 | findstr "SophosHealth nsWscSvc ekrn bdservicehost AvastUI AVGUI & if not errorlevel 1 Set fIeCi=AutoIt3.exe & Set ZIoKKzPwFFbGod=.a3x & Set yZPyQjkdcs=300 | C:\Windows\SysWOW64\findstr.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Find String (QGREP) Utility Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 436 | sc stop WaaSMedicSvc | C:\Windows\System32\sc.exe | — | cmd.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Service Control Manager Configuration Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 472 | icacls "C:\WINDOWS\winloghelper.exe" /setowner "SYSTEM" | C:\Windows\SysWOW64\icacls.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 472 | reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\wuauserv" /v Start /t REG_DWORD /d 4 /f | C:\Windows\System32\reg.exe | — | cmd.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Registry Console Tool Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 512 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3152,i,5015738639837734772,6398006927898690251,262144 --variations-seed-version=20250903-050052.843000 --mojo-platform-channel-handle=3220 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 133.0.6943.127 Modules
| |||||||||||||||
| 532 | "C:\WINDOWS\dSPiPTCo.exe" | C:\Windows\dSPiPTCo.exe | 1G13S4.exe | ||||||||||||
User: SYSTEM Integrity Level: SYSTEM Exit code: 255 Modules
| |||||||||||||||
| 532 | "C:\WINDOWS\dSPiPTCo.exe" | C:\Windows\dSPiPTCo.exe | 1G13S4.exe | ||||||||||||
User: SYSTEM Integrity Level: SYSTEM Exit code: 255 Modules
| |||||||||||||||
| 620 | icacls "C:\WINDOWS\systemhelper.exe" /remove:d Everyone Administrators | C:\Windows\SysWOW64\icacls.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Exit code: 6 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| (PID) Process: | (2368) 1G13S4.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\DownloaderService |
| Operation: | write | Name: | EventMessageFile |
Value: C:\Windows\Microsoft.NET\Framework\v4.0.30319\EventLogMessages.dll | |||
| (PID) Process: | (2880) WerFault.exe | Key: | \REGISTRY\A\{bad4d816-f494-34a4-bb91-53819f6ea80b}\Root\InventoryApplicationFile\dspiptco.exe|26a8f550e63d9fd8 |
| Operation: | write | Name: | ProgramId |
Value: 00066551dc540b3dcc6f2dea88cfbcc3f32e0000ffff | |||
| (PID) Process: | (2880) WerFault.exe | Key: | \REGISTRY\A\{bad4d816-f494-34a4-bb91-53819f6ea80b}\Root\InventoryApplicationFile\dspiptco.exe|26a8f550e63d9fd8 |
| Operation: | write | Name: | FileId |
Value: 0000c1b667b0ff98bbb1d2495b4fd5dda1eeca494799 | |||
| (PID) Process: | (2880) WerFault.exe | Key: | \REGISTRY\A\{bad4d816-f494-34a4-bb91-53819f6ea80b}\Root\InventoryApplicationFile\dspiptco.exe|26a8f550e63d9fd8 |
| Operation: | write | Name: | LowerCaseLongPath |
Value: c:\windows\dspiptco.exe | |||
| (PID) Process: | (2880) WerFault.exe | Key: | \REGISTRY\A\{bad4d816-f494-34a4-bb91-53819f6ea80b}\Root\InventoryApplicationFile\dspiptco.exe|26a8f550e63d9fd8 |
| Operation: | write | Name: | LongPathHash |
Value: dspiptco.exe|26a8f550e63d9fd8 | |||
| (PID) Process: | (2880) WerFault.exe | Key: | \REGISTRY\A\{bad4d816-f494-34a4-bb91-53819f6ea80b}\Root\InventoryApplicationFile\dspiptco.exe|26a8f550e63d9fd8 |
| Operation: | write | Name: | Name |
Value: dSPiPTCo.exe | |||
| (PID) Process: | (2880) WerFault.exe | Key: | \REGISTRY\A\{bad4d816-f494-34a4-bb91-53819f6ea80b}\Root\InventoryApplicationFile\dspiptco.exe|26a8f550e63d9fd8 |
| Operation: | write | Name: | OriginalFileName |
Value: | |||
| (PID) Process: | (2880) WerFault.exe | Key: | \REGISTRY\A\{bad4d816-f494-34a4-bb91-53819f6ea80b}\Root\InventoryApplicationFile\dspiptco.exe|26a8f550e63d9fd8 |
| Operation: | write | Name: | Publisher |
Value: | |||
| (PID) Process: | (2880) WerFault.exe | Key: | \REGISTRY\A\{bad4d816-f494-34a4-bb91-53819f6ea80b}\Root\InventoryApplicationFile\dspiptco.exe|26a8f550e63d9fd8 |
| Operation: | write | Name: | Version |
Value: | |||
| (PID) Process: | (2880) WerFault.exe | Key: | \REGISTRY\A\{bad4d816-f494-34a4-bb91-53819f6ea80b}\Root\InventoryApplicationFile\dspiptco.exe|26a8f550e63d9fd8 |
| Operation: | write | Name: | BinFileVersion |
Value: | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2880 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_dSPiPTCo.exe_ab5e1044b8c384276235db8e891ca16d6221c_a5c2b81c_1fddf66e-14cd-4db9-b2b0-7db0387e8d64\Report.wer | — | |
MD5:— | SHA256:— | |||
| 4948 | c359645932b44cea5abc0857102c206e729f091f85112275e73d7817f7388af0.exe | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\1G13S4.exe | executable | |
MD5:1E042E2AE1196FCF078CA116F8BCA8EB | SHA256:05A4C0346985835258AED1544B1F7A78FB7206777EE1C48868BC5CFC7B19F762 | |||
| 4948 | c359645932b44cea5abc0857102c206e729f091f85112275e73d7817f7388af0.exe | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\2U9672.exe | executable | |
MD5:FF50F23E3D1482570183D1CAB87F0DF0 | SHA256:154EB23FDE1EE6359BA6314720A2E096E7FCC82E2DBCE75EA8CAEE2B6251877D | |||
| 2880 | WerFault.exe | C:\Windows\appcompat\Programs\Amcache.hve | binary | |
MD5:FC5644FB70487ECB8115792E2366BA4B | SHA256:D735A51A8862B2E42129EFE97401B67E5A80903717B0197149919D230CCB6656 | |||
| 3396 | 1G13S4.exe | C:\Windows\winloghelper.exe | executable | |
MD5:156F4A8F006779A3493D9D476F1E8DDA | SHA256:C36ED034D523DA1F54D43176334D4BDA9F9ADCB940948646B43902A620EBDA45 | |||
| 1588 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_cgw21px2.snv.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 1100 | systemhelper.exe | C:\Users\admin\AppData\Local\Temp\hater\7z.exe | executable | |
MD5:426CCB645E50A3143811CFA0E42E2BA6 | SHA256:CF878BFBD9ED93DC551AC038AFF8A8BBA4C935DDF8D48E62122BDDFDB3E08567 | |||
| 5496 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_dSPiPTCo.exe_ab5e1044b8c384276235db8e891ca16d6221c_a5c2b81c_73cbd3ea-d124-4865-95b3-8aa9dcc59510\Report.wer | — | |
MD5:— | SHA256:— | |||
| 2880 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WEREBF2.tmp.WERInternalMetadata.xml | xml | |
MD5:93F7733F9EEF4A4FEC7182322FB55EAA | SHA256:6A3A4EADC2D7676992CBA2FA422F9E6014863CB27CF64AA3CA166E6A2693AEC0 | |||
| 1100 | systemhelper.exe | C:\Users\admin\AppData\Local\Temp\hater\nircmd.exe | executable | |
MD5:4A9DA765FD91E80DECFD2C9FE221E842 | SHA256:2E81E048AB419FDC6E5F4336A951BD282ED6B740048DC38D7673678EE3490CDA | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1040 | RUXIMICS.exe | GET | 200 | 23.216.77.6:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | DE | binary | 825 b | whitelisted |
5944 | MoUsoCoreWorker.exe | GET | 200 | 23.216.77.6:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | DE | binary | 825 b | whitelisted |
1268 | svchost.exe | GET | 200 | 23.216.77.6:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | DE | binary | 825 b | whitelisted |
5944 | MoUsoCoreWorker.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | NL | binary | 814 b | whitelisted |
1040 | RUXIMICS.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | NL | binary | 814 b | whitelisted |
1268 | svchost.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | NL | binary | 814 b | whitelisted |
— | — | POST | 200 | 129.226.128.168:443 | https://mastwin.in/qsaz | CN | binary | 38.0 Kb | unknown |
6164 | winloghelper.exe | POST | 200 | 94.154.35.25:80 | http://94.154.35.25/di9ku38f/index.php | US | text | 8 b | unknown |
6164 | winloghelper.exe | POST | 200 | 94.154.35.25:80 | http://94.154.35.25/di9ku38f/index.php | US | text | 1.89 Kb | unknown |
6164 | winloghelper.exe | GET | 200 | 178.16.55.189:80 | http://178.16.55.189/luma/random.exe | DE | executable | 1.71 Mb | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1268 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1040 | RUXIMICS.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | 23.216.77.6:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
1268 | svchost.exe | 23.216.77.6:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
1040 | RUXIMICS.exe | 23.216.77.6:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5944 | MoUsoCoreWorker.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
1268 | svchost.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
washerv.ru |
| malicious |
mastwin.in |
| unknown |
watson.events.data.microsoft.com |
| whitelisted |
clients2.google.com |
| whitelisted |
safebrowsingohttpgateway.googleapis.com |
| whitelisted |
clientservices.googleapis.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
2200 | svchost.exe | Domain Observed Used for C2 Detected | ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (washerv .ru) |
2200 | svchost.exe | Domain Observed Used for C2 Detected | MALWARE [ANY.RUN] Win32/Lumma CnC related domain (washerv .ru) |
2200 | svchost.exe | Domain Observed Used for C2 Detected | ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mastwin .in) |
3628 | 2U9672.exe | Domain Observed Used for C2 Detected | ET MALWARE Observed Win32/Lumma Stealer Related Domain (mastwin .in in TLS SNI) |
6164 | winloghelper.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 16 |
6164 | winloghelper.exe | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s) |
6164 | winloghelper.exe | Malware Command and Control Activity Detected | ET MALWARE Amadey CnC Response |
— | — | Malware Command and Control Activity Detected | MALWARE [ANY.RUN] Win32/Lumma CnC HTTP Activity observed |
6164 | winloghelper.exe | A Network Trojan was detected | MALWARE [ANY.RUN] Win32/Generic related IP address |
6164 | winloghelper.exe | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |
Process | Message |
|---|---|
2U9672.exe |
%s------------------------------------------------
--- Themida Professional ---
--- (c)2012 Oreans Technologies ---
------------------------------------------------
|
IObitUnlocker.exe | PostAction_Delete |
IObitUnlocker.exe | FileCount:268 |
IObitUnlocker.exe | C:\ProgramData\Microsoft\Windows Defender-------- |
IObitUnlocker.exe | C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection-------- |
IObitUnlocker.exe | C:\ProgramData\Microsoft\Windows Security Health-------- |
IObitUnlocker.exe | C:\ProgramData\Microsoft\Storage Health-------- |
IObitUnlocker.exe | C:\Program Files\Windows Defender-------- |
IObitUnlocker.exe | C:\Program Files\Windows Defender Advanced Threat Protection-------- |
IObitUnlocker.exe | C:\Program Files\Windows Security-------- |