File name:

Sigmanly_d74e49dd237c22caf3dd5700bdca67bcc7d636e7f57ee32860c99b283b3a7ecb

Full analysis: https://app.any.run/tasks/939bc078-8dcb-4a8e-8c2a-37e83c4b7624
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: May 15, 2025, 13:37:05
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
lumma
stealer
themida
loader
amadey
botnet
rdp
uac
prysmax
delphi
antivm
enigma
gcleaner
telegram
evasion
auto
generic
stealc
vidar
credentialflusher
inno
installer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

9CA4D729A557E460DC1B69DBDAA539B1

SHA1:

5E6D91AE8861FC31FBE0638B56EB3F82DF4481E5

SHA256:

D74E49DD237C22CAF3DD5700BDCA67BCC7D636E7F57EE32860C99B283B3A7ECB

SSDEEP:

98304:i0joJQxrKTRvFqJhEH4+Sgr2i0mXVHuKDnI2cIclWss+QjCVBPpzUS7jkvMK4lxm:

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • LUMMA mutex has been found

      • Sigmanly_d74e49dd237c22caf3dd5700bdca67bcc7d636e7f57ee32860c99b283b3a7ecb.exe (PID: 7400)
      • MSBuild.exe (PID: 6404)
      • MSBuild.exe (PID: 7720)
      • MSBuild.exe (PID: 896)
    • LUMMA has been detected (YARA)

      • Sigmanly_d74e49dd237c22caf3dd5700bdca67bcc7d636e7f57ee32860c99b283b3a7ecb.exe (PID: 7400)
      • MSBuild.exe (PID: 6404)
      • MSBuild.exe (PID: 896)
      • MSBuild.exe (PID: 7720)
    • Steals credentials from Web Browsers

      • Sigmanly_d74e49dd237c22caf3dd5700bdca67bcc7d636e7f57ee32860c99b283b3a7ecb.exe (PID: 7400)
      • MSBuild.exe (PID: 6404)
      • Ri5HQc5.exe (PID: 5960)
      • MSBuild.exe (PID: 7720)
      • MSBuild.exe (PID: 896)
    • LUMMA has been detected (SURICATA)

      • Sigmanly_d74e49dd237c22caf3dd5700bdca67bcc7d636e7f57ee32860c99b283b3a7ecb.exe (PID: 7400)
      • svchost.exe (PID: 2196)
      • MSBuild.exe (PID: 6404)
      • MSBuild.exe (PID: 7720)
      • MSBuild.exe (PID: 896)
      • MSBuild.exe (PID: 6436)
      • 31e91a1ecd.exe (PID: 4724)
    • Actions looks like stealing of personal data

      • Sigmanly_d74e49dd237c22caf3dd5700bdca67bcc7d636e7f57ee32860c99b283b3a7ecb.exe (PID: 7400)
      • MSBuild.exe (PID: 6404)
      • MSBuild.exe (PID: 7720)
      • MSBuild.exe (PID: 896)
      • Ri5HQc5.exe (PID: 5960)
    • AMADEY mutex has been found

      • M9FJ7RNL8PGG8PS9BP7W.exe (PID: 8044)
      • ramez.exe (PID: 6048)
      • ramez.exe (PID: 1056)
    • Connects to the CnC server

      • svchost.exe (PID: 2196)
      • ramez.exe (PID: 6048)
    • AMADEY has been detected (SURICATA)

      • ramez.exe (PID: 6048)
    • AMADEY has been detected (YARA)

      • ramez.exe (PID: 6048)
    • PRYSMAX mutex has been found

      • Ri5HQc5.exe (PID: 5960)
      • Ri5HQc5.exe (PID: 5212)
    • Bypass User Account Control (Modify registry)

      • Ri5HQc5.exe (PID: 5960)
    • Bypass User Account Control (ComputerDefaults)

      • ComputerDefaults.exe (PID: 7364)
    • Executing a file with an untrusted certificate

      • j6J70wm.exe (PID: 6512)
      • fOj0r8O.exe (PID: 4228)
      • ra02W4S.exe (PID: 7236)
      • HGVm49v.exe (PID: 4336)
    • GCLEANER has been detected (SURICATA)

      • bf06ca71e0.exe (PID: 5416)
      • ra02W4S.exe (PID: 7236)
    • Suspicious browser debugging (Possible cookie theft)

      • chrome.exe (PID: 6516)
      • msedge.exe (PID: 2096)
    • GENERIC has been found (auto)

      • bf06ca71e0.exe (PID: 5416)
    • Adds path to the Windows Defender exclusion list

      • NSudoLG.exe (PID: 4336)
      • cmd.exe (PID: 7144)
    • Changes Windows Defender settings

      • NSudoLG.exe (PID: 4336)
    • Possible tool for stealing has been detected

      • e98298f6b6.exe (PID: 8024)
      • firefox.exe (PID: 9096)
    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 3968)
    • Run PowerShell with an invisible window

      • powershell.exe (PID: 9148)
    • Request from PowerShell that ran from MSHTA.EXE

      • powershell.exe (PID: 9148)
  • SUSPICIOUS

    • Reads the BIOS version

      • Sigmanly_d74e49dd237c22caf3dd5700bdca67bcc7d636e7f57ee32860c99b283b3a7ecb.exe (PID: 7400)
      • M9FJ7RNL8PGG8PS9BP7W.exe (PID: 8044)
      • ramez.exe (PID: 6048)
      • ramez.exe (PID: 1056)
    • Contacting a server suspected of hosting an CnC

      • Sigmanly_d74e49dd237c22caf3dd5700bdca67bcc7d636e7f57ee32860c99b283b3a7ecb.exe (PID: 7400)
      • svchost.exe (PID: 2196)
      • ramez.exe (PID: 6048)
      • MSBuild.exe (PID: 6404)
      • MSBuild.exe (PID: 7720)
      • MSBuild.exe (PID: 896)
      • MSBuild.exe (PID: 6436)
      • 31e91a1ecd.exe (PID: 4724)
    • Executable content was dropped or overwritten

      • Sigmanly_d74e49dd237c22caf3dd5700bdca67bcc7d636e7f57ee32860c99b283b3a7ecb.exe (PID: 7400)
      • M9FJ7RNL8PGG8PS9BP7W.exe (PID: 8044)
      • ramez.exe (PID: 6048)
      • bf06ca71e0.exe (PID: 5416)
      • 2rMt7LPsfKAm.tmp (PID: 7276)
      • 2rMt7LPsfKAm.exe (PID: 7664)
      • globalsynapse398.exe (PID: 3008)
      • cfd179a944.tmp (PID: 4976)
      • cfd179a944.exe (PID: 672)
      • ra02W4S.exe (PID: 7236)
      • rL8uB1WKLHt.exe (PID: 7732)
      • rL8uB1WKLHt.tmp (PID: 7828)
      • 450294b8e9.exe (PID: 8080)
      • csc.exe (PID: 5408)
      • csc.exe (PID: 1004)
      • 7z.exe (PID: 8744)
      • Unlocker.exe (PID: 8600)
      • powershell.exe (PID: 9148)
      • 31e91a1ecd.exe (PID: 4724)
      • csc.exe (PID: 8988)
    • Starts itself from another location

      • M9FJ7RNL8PGG8PS9BP7W.exe (PID: 8044)
    • Connects to the server without a host name

      • Sigmanly_d74e49dd237c22caf3dd5700bdca67bcc7d636e7f57ee32860c99b283b3a7ecb.exe (PID: 7400)
      • ramez.exe (PID: 6048)
      • bf06ca71e0.exe (PID: 5416)
      • svchost.exe (PID: 4284)
      • ra02W4S.exe (PID: 7236)
      • 31e91a1ecd.exe (PID: 4724)
      • powershell.exe (PID: 9148)
    • Potential Corporate Privacy Violation

      • Sigmanly_d74e49dd237c22caf3dd5700bdca67bcc7d636e7f57ee32860c99b283b3a7ecb.exe (PID: 7400)
      • ramez.exe (PID: 6048)
      • bf06ca71e0.exe (PID: 5416)
      • ra02W4S.exe (PID: 7236)
      • powershell.exe (PID: 9148)
      • 31e91a1ecd.exe (PID: 4724)
    • Searches for installed software

      • Sigmanly_d74e49dd237c22caf3dd5700bdca67bcc7d636e7f57ee32860c99b283b3a7ecb.exe (PID: 7400)
      • MSBuild.exe (PID: 6404)
      • MSBuild.exe (PID: 7720)
    • Reads security settings of Internet Explorer

      • M9FJ7RNL8PGG8PS9BP7W.exe (PID: 8044)
      • ramez.exe (PID: 6048)
      • bf06ca71e0.exe (PID: 5416)
    • Process requests binary or script from the Internet

      • ramez.exe (PID: 6048)
      • Sigmanly_d74e49dd237c22caf3dd5700bdca67bcc7d636e7f57ee32860c99b283b3a7ecb.exe (PID: 7400)
      • 31e91a1ecd.exe (PID: 4724)
      • powershell.exe (PID: 9148)
    • There is functionality for enable RDP (YARA)

      • ramez.exe (PID: 6048)
    • The process executes via Task Scheduler

      • ramez.exe (PID: 1056)
      • ramez.exe (PID: 7952)
    • There is functionality for VM detection VirtualBox (YARA)

      • bf06ca71e0.exe (PID: 5416)
    • There is functionality for taking screenshot (YARA)

      • bf06ca71e0.exe (PID: 5416)
      • Ri5HQc5.exe (PID: 5960)
      • MSBuild.exe (PID: 6404)
      • MSBuild.exe (PID: 7720)
      • MSBuild.exe (PID: 896)
    • Changes default file association

      • Ri5HQc5.exe (PID: 5960)
    • Starts CMD.EXE for commands execution

      • Ri5HQc5.exe (PID: 5960)
      • svchost.exe (PID: 4284)
      • cmd.exe (PID: 5204)
      • 450294b8e9.exe (PID: 8080)
      • cmd.exe (PID: 8080)
      • nircmd.exe (PID: 7972)
      • cmd.exe (PID: 8176)
      • cmd.exe (PID: 7144)
      • NSudoLG.exe (PID: 7988)
      • Unlocker.exe (PID: 8812)
      • Unlocker.exe (PID: 8600)
      • 07483a3522.exe (PID: 7256)
    • Process drops legitimate windows executable

      • ramez.exe (PID: 6048)
      • 2rMt7LPsfKAm.tmp (PID: 7276)
      • rL8uB1WKLHt.tmp (PID: 7828)
    • Starts a Microsoft application from unusual location

      • 08IyOOF.exe (PID: 2096)
      • j6J70wm.exe (PID: 6512)
      • fOj0r8O.exe (PID: 4228)
    • Loads DLL from Mozilla Firefox

      • Ri5HQc5.exe (PID: 5960)
    • Get information on the list of running processes

      • Ri5HQc5.exe (PID: 5960)
      • cmd.exe (PID: 7144)
      • cmd.exe (PID: 8016)
    • Uses TASKKILL.EXE to kill process

      • Ri5HQc5.exe (PID: 5960)
      • e98298f6b6.exe (PID: 8024)
      • cmd.exe (PID: 9140)
      • cmd.exe (PID: 8824)
    • Uses TASKKILL.EXE to kill Browsers

      • Ri5HQc5.exe (PID: 5960)
      • e98298f6b6.exe (PID: 8024)
    • Hides errors and continues executing the command without stopping

      • powershell.exe (PID: 7240)
    • Probably obfuscated PowerShell command line is found

      • Ri5HQc5.exe (PID: 5960)
    • Returns all items found within a container (POWERSHELL)

      • powershell.exe (PID: 7240)
    • Starts POWERSHELL.EXE for commands execution

      • Ri5HQc5.exe (PID: 5960)
      • globalsynapse398.exe (PID: 3008)
      • globalsynapse398.exe (PID: 8116)
      • MSBuild.exe (PID: 7360)
      • NSudoLG.exe (PID: 4336)
      • mshta.exe (PID: 8088)
    • The process drops C-runtime libraries

      • 2rMt7LPsfKAm.tmp (PID: 7276)
    • Executes application which crashes

      • HGVm49v.exe (PID: 4336)
      • core.exe (PID: 7328)
      • 6a0e97d504.exe (PID: 5156)
    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • MSBuild.exe (PID: 6184)
      • GEbXN0XNd.exe (PID: 8108)
      • MSBuild.exe (PID: 924)
      • MSBuild.exe (PID: 7360)
      • PVgzE7GMw.exe (PID: 240)
    • Checks for external IP

      • svchost.exe (PID: 2196)
      • svchost.exe (PID: 4284)
    • Base64-obfuscated command line is found

      • MSBuild.exe (PID: 7360)
    • Application launched itself

      • cmd.exe (PID: 5204)
      • cmd.exe (PID: 8080)
      • cmd.exe (PID: 8176)
      • cmd.exe (PID: 7144)
    • Drops 7-zip archiver for unpacking

      • 450294b8e9.exe (PID: 8080)
    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 5408)
      • csc.exe (PID: 1004)
      • csc.exe (PID: 8988)
    • Executing commands from a ".bat" file

      • cmd.exe (PID: 5204)
      • 450294b8e9.exe (PID: 8080)
      • nircmd.exe (PID: 7972)
      • cmd.exe (PID: 8080)
      • cmd.exe (PID: 8176)
      • NSudoLG.exe (PID: 7988)
    • The process bypasses the loading of PowerShell profile settings

      • MSBuild.exe (PID: 7360)
    • The process hide an interactive prompt from the user

      • MSBuild.exe (PID: 7360)
    • BASE64 encoded PowerShell command has been detected

      • MSBuild.exe (PID: 7360)
    • The executable file from the user directory is run by the CMD process

      • nircmd.exe (PID: 7972)
      • NSudoLG.exe (PID: 7988)
      • NSudoLG.exe (PID: 4336)
      • 7z.exe (PID: 8744)
      • Unlocker.exe (PID: 8812)
      • Unlocker.exe (PID: 8600)
    • Starts application with an unusual extension

      • cmd.exe (PID: 8160)
      • cmd.exe (PID: 6708)
      • cmd.exe (PID: 7144)
    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 8160)
      • cmd.exe (PID: 7144)
    • Script adds exclusion path to Windows Defender

      • NSudoLG.exe (PID: 4336)
    • PowerShell delay command usage (probably sleep evasion)

      • powershell.exe (PID: 7996)
    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 7144)
    • Windows service management via SC.EXE

      • sc.exe (PID: 9104)
      • sc.exe (PID: 4880)
      • sc.exe (PID: 7428)
      • sc.exe (PID: 2268)
      • sc.exe (PID: 8512)
      • sc.exe (PID: 8484)
    • Starts SC.EXE for service management

      • cmd.exe (PID: 9040)
      • cmd.exe (PID: 7144)
      • cmd.exe (PID: 5232)
      • cmd.exe (PID: 8828)
    • Found IP address in command line

      • powershell.exe (PID: 9148)
    • Manipulates environment variables

      • powershell.exe (PID: 9148)
    • Probably download files using WebClient

      • mshta.exe (PID: 8088)
    • Drops a system driver (possible attempt to evade defenses)

      • Unlocker.exe (PID: 8600)
    • Starts process via Powershell

      • powershell.exe (PID: 9148)
    • Stops a currently running service

      • sc.exe (PID: 8796)
  • INFO

    • Reads the machine GUID from the registry

      • Sigmanly_d74e49dd237c22caf3dd5700bdca67bcc7d636e7f57ee32860c99b283b3a7ecb.exe (PID: 7400)
      • bf06ca71e0.exe (PID: 5416)
      • MSBuild.exe (PID: 6404)
      • Ri5HQc5.exe (PID: 5960)
      • MSBuild.exe (PID: 7720)
      • MSBuild.exe (PID: 896)
    • Checks supported languages

      • Sigmanly_d74e49dd237c22caf3dd5700bdca67bcc7d636e7f57ee32860c99b283b3a7ecb.exe (PID: 7400)
      • M9FJ7RNL8PGG8PS9BP7W.exe (PID: 8044)
      • ramez.exe (PID: 6048)
      • bf06ca71e0.exe (PID: 5416)
      • ramez.exe (PID: 1056)
      • Ri5HQc5.exe (PID: 5960)
      • 08IyOOF.exe (PID: 2096)
      • MSBuild.exe (PID: 6404)
      • Ri5HQc5.exe (PID: 5212)
      • j6J70wm.exe (PID: 6512)
      • MSBuild.exe (PID: 7720)
      • fOj0r8O.exe (PID: 4228)
      • MSBuild.exe (PID: 896)
    • Reads the software policy settings

      • Sigmanly_d74e49dd237c22caf3dd5700bdca67bcc7d636e7f57ee32860c99b283b3a7ecb.exe (PID: 7400)
      • bf06ca71e0.exe (PID: 5416)
      • MSBuild.exe (PID: 6404)
      • Ri5HQc5.exe (PID: 5960)
      • powershell.exe (PID: 7804)
      • MSBuild.exe (PID: 7720)
      • MSBuild.exe (PID: 896)
    • Reads the computer name

      • Sigmanly_d74e49dd237c22caf3dd5700bdca67bcc7d636e7f57ee32860c99b283b3a7ecb.exe (PID: 7400)
      • M9FJ7RNL8PGG8PS9BP7W.exe (PID: 8044)
      • bf06ca71e0.exe (PID: 5416)
      • ramez.exe (PID: 6048)
      • Ri5HQc5.exe (PID: 5960)
      • Ri5HQc5.exe (PID: 5212)
      • MSBuild.exe (PID: 6404)
      • MSBuild.exe (PID: 7720)
      • MSBuild.exe (PID: 896)
    • Themida protector has been detected

      • Sigmanly_d74e49dd237c22caf3dd5700bdca67bcc7d636e7f57ee32860c99b283b3a7ecb.exe (PID: 7400)
      • ramez.exe (PID: 6048)
    • Create files in a temporary directory

      • M9FJ7RNL8PGG8PS9BP7W.exe (PID: 8044)
      • Sigmanly_d74e49dd237c22caf3dd5700bdca67bcc7d636e7f57ee32860c99b283b3a7ecb.exe (PID: 7400)
      • ramez.exe (PID: 6048)
      • bf06ca71e0.exe (PID: 5416)
      • Ri5HQc5.exe (PID: 5960)
      • powershell.exe (PID: 7804)
      • powershell.exe (PID: 7240)
    • Process checks computer location settings

      • M9FJ7RNL8PGG8PS9BP7W.exe (PID: 8044)
      • ramez.exe (PID: 6048)
    • Checks proxy server information

      • ramez.exe (PID: 6048)
      • bf06ca71e0.exe (PID: 5416)
      • Ri5HQc5.exe (PID: 5960)
    • Enigma protector has been detected

      • bf06ca71e0.exe (PID: 5416)
    • Compiled with Borland Delphi (YARA)

      • bf06ca71e0.exe (PID: 5416)
      • 2rMt7LPsfKAm.tmp (PID: 7276)
    • Creates files or folders in the user directory

      • ramez.exe (PID: 6048)
      • bf06ca71e0.exe (PID: 5416)
    • The sample compiled with english language support

      • ramez.exe (PID: 6048)
      • Ri5HQc5.exe (PID: 5960)
      • 2rMt7LPsfKAm.tmp (PID: 7276)
      • bf06ca71e0.exe (PID: 5416)
      • rL8uB1WKLHt.tmp (PID: 7828)
      • ra02W4S.exe (PID: 7236)
      • 450294b8e9.exe (PID: 8080)
      • Unlocker.exe (PID: 8600)
    • Reads security settings of Internet Explorer

      • ComputerDefaults.exe (PID: 7364)
      • powershell.exe (PID: 7804)
      • powershell.exe (PID: 7240)
    • Returns hidden items found within a container (POWERSHELL)

      • conhost.exe (PID: 856)
      • conhost.exe (PID: 7836)
      • conhost.exe (PID: 6620)
      • conhost.exe (PID: 8036)
      • conhost.exe (PID: 4932)
      • conhost.exe (PID: 2552)
      • conhost.exe (PID: 5156)
      • conhost.exe (PID: 2516)
      • conhost.exe (PID: 4728)
      • conhost.exe (PID: 2284)
      • conhost.exe (PID: 2140)
      • conhost.exe (PID: 536)
      • conhost.exe (PID: 7296)
      • conhost.exe (PID: 8104)
      • conhost.exe (PID: 7872)
      • conhost.exe (PID: 6644)
      • conhost.exe (PID: 2192)
      • conhost.exe (PID: 5728)
      • conhost.exe (PID: 7324)
      • conhost.exe (PID: 7572)
      • conhost.exe (PID: 5212)
      • conhost.exe (PID: 7848)
      • conhost.exe (PID: 856)
      • conhost.exe (PID: 2192)
      • conhost.exe (PID: 6972)
      • conhost.exe (PID: 872)
      • conhost.exe (PID: 7504)
      • conhost.exe (PID: 2552)
      • conhost.exe (PID: 5332)
      • conhost.exe (PID: 7172)
      • conhost.exe (PID: 7336)
      • conhost.exe (PID: 8084)
      • conhost.exe (PID: 7428)
      • conhost.exe (PID: 1748)
      • conhost.exe (PID: 5212)
      • conhost.exe (PID: 6960)
      • conhost.exe (PID: 7352)
      • conhost.exe (PID: 920)
      • conhost.exe (PID: 8952)
      • conhost.exe (PID: 8852)
      • conhost.exe (PID: 8696)
      • conhost.exe (PID: 9048)
      • conhost.exe (PID: 8516)
      • conhost.exe (PID: 8636)
      • conhost.exe (PID: 9148)
      • conhost.exe (PID: 8316)
      • conhost.exe (PID: 8580)
      • conhost.exe (PID: 6108)
      • conhost.exe (PID: 8000)
      • conhost.exe (PID: 9576)
      • conhost.exe (PID: 9020)
      • conhost.exe (PID: 10020)
      • conhost.exe (PID: 10200)
      • conhost.exe (PID: 5332)
      • conhost.exe (PID: 8068)
      • conhost.exe (PID: 9892)
      • conhost.exe (PID: 8628)
      • conhost.exe (PID: 9884)
      • conhost.exe (PID: 10084)
    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 1052)
    • Changes the registry key values via Powershell

      • globalsynapse398.exe (PID: 3008)
      • globalsynapse398.exe (PID: 8116)
    • Application launched itself

      • chrome.exe (PID: 6516)
      • chrome.exe (PID: 2852)
      • chrome.exe (PID: 4408)
      • msedge.exe (PID: 2096)
      • firefox.exe (PID: 9188)
      • firefox.exe (PID: 9096)
      • chrome.exe (PID: 3240)
      • chrome.exe (PID: 9556)
      • chrome.exe (PID: 9324)
      • chrome.exe (PID: 9988)
      • chrome.exe (PID: 10184)
      • chrome.exe (PID: 4488)
      • chrome.exe (PID: 9748)
      • chrome.exe (PID: 8220)
      • chrome.exe (PID: 10160)
      • chrome.exe (PID: 9860)
    • Detects InnoSetup installer (YARA)

      • 2rMt7LPsfKAm.exe (PID: 7664)
      • 2rMt7LPsfKAm.tmp (PID: 7276)
    • Changes the display of characters in the console

      • cmd.exe (PID: 6708)
      • cmd.exe (PID: 8160)
      • cmd.exe (PID: 7144)
    • NirSoft software is detected

      • nircmd.exe (PID: 7972)
    • Checks operating system version

      • cmd.exe (PID: 7144)
    • Starts MODE.COM to configure console settings

      • mode.com (PID: 8008)
    • Auto-launch of the file from Task Scheduler

      • cmd.exe (PID: 3968)
    • The executable file from the user directory is run by the Powershell process

      • TempX4UACKMIO4KTBJXPKMBSIYZMURQFBYN7.EXE (PID: 9596)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Lumma

(PID) Process(7400) Sigmanly_d74e49dd237c22caf3dd5700bdca67bcc7d636e7f57ee32860c99b283b3a7ecb.exe
C2 (9)featurlyin.top/pdal
overcovtcg.top/juhd
meteorplyp.live/lekp
zmedtipp.live/mnvzx
flowerexju.bet/lanz
posseswsnc.top/akds
araucahkbm.live/baneb
blackswmxc.top/bgry
easterxeen.run/zavc
(PID) Process(6404) MSBuild.exe
C2 (9)orjinalecza.net/lxaz
eczakozmetik.net/qop
medikalbitkisel.net/qos
medicalbitkisel.org/mbj
orijinalecza.net/kazd
tortoisgfe.top/paxk
pomelohgj.top/uiads
snakejh.top/adsk
medicalbitkisel.net/juj
(PID) Process(7720) MSBuild.exe
C2 (8)overcovtcg.top/juhd
ninepicchf.bet/lznd
zmedtipp.live/mnvzx
voznessxyy.life/bnaz
blackljjwc.run/banj
interpwthc.digital/juab
blackswmxc.top/bgry
clatteqrpq.digital/kljz
(PID) Process(896) MSBuild.exe
C2 (9)featurlyin.top/pdal
overcovtcg.top/juhd
meteorplyp.live/lekp
zmedtipp.live/mnvzx
flowerexju.bet/lanz
posseswsnc.top/akds
araucahkbm.live/baneb
blackswmxc.top/bgry
easterxeen.run/zavc

Amadey

(PID) Process(6048) ramez.exe
C2185.156.72.96
URLhttp://185.156.72.96/te4h2nus/index.php
Version5.34
Options
Drop directoryd610cf342e
Drop nameramez.exe
Strings (125)lv:
msi
Kaspersky Lab
av:
|
#
"
\App
00000422
dm:
Powershell.exe
ProgramData\
ps1
rundll32
http://
Content-Disposition: form-data; name="data"; filename="
SOFTWARE\Microsoft\Windows NT\CurrentVersion
dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
id:
VideoID
cred.dll|clip.dll|
0000043f
cmd
00000423
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
-executionpolicy remotesigned -File "
2022
------
2016
og:
\0000
CurrentBuild
2019
:::
S-%lu-
" && timeout 1 && del
ProductName
Panda Security
ESET
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
/k
+++
?scr=1
Doctor Web
GET
SYSTEM\ControlSet001\Services\BasicDisplay\Video
/quiet
.jpg
d610cf342e
vs:
sd:
rundll32.exe
"taskkill /f /im "
pc:
random
=
360TotalSecurity
<d>
wb
Content-Type: multipart/form-data; boundary=----
Startup
Norton
&& Exit"
os:
https://
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
2025
Avira
%-lu
zip
POST
" Content-Type: application/octet-stream
Rem
/te4h2nus/index.php
------
5.34
<c>
clip.dll
AVAST Software
\
shell32.dll
" && ren
e3
ramez.exe
kernel32.dll
DefaultSettings.XResolution
d1
DefaultSettings.YResolution
185.156.72.96
r=
cred.dll
--
GetNativeSystemInfo
-%lu
ComputerName
&unit=
Keyboard Layout\Preload
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
ar:
Sophos
%USERPROFILE%
exe
e1
e2
st=s
Programs
0123456789
un:
rb
bi:
abcdefghijklmnopqrstuvwxyz0123456789-_
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
cmd /C RMDIR /s/q
Bitdefender
-unicode-
AVG
WinDefender
&&
shutdown -s -t 0
Comodo
00000419
Content-Type: application/x-www-form-urlencoded
/Plugins/
Main
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:08 12:17:36+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 314880
InitializedDataSize: 37376
UninitializedDataSize: -
EntryPoint: 0x497000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
550
Monitored processes
401
Malicious processes
34
Suspicious processes
13

Behavior graph

Click at the process to see the details
start #LUMMA sigmanly_d74e49dd237c22caf3dd5700bdca67bcc7d636e7f57ee32860c99b283b3a7ecb.exe #LUMMA svchost.exe m9fj7rnl8pgg8ps9bp7w.exe #AMADEY ramez.exe #GCLEANER bf06ca71e0.exe ramez.exe no specs #PRYSMAX ri5hqc5.exe cmd.exe no specs conhost.exe no specs computerdefaults.exe no specs computerdefaults.exe no specs computerdefaults.exe #PRYSMAX ri5hqc5.exe no specs 08iyoof.exe no specs msbuild.exe no specs #LUMMA msbuild.exe slui.exe j6j70wm.exe no specs #LUMMA msbuild.exe vaultcmd.exe no specs conhost.exe no specs cmdkey.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs tasklist.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs foj0r8o.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs tasklist.exe no specs conhost.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs cmdkey.exe no specs tasklist.exe no specs conhost.exe no specs certutil.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs #LUMMA msbuild.exe tasklist.exe no specs conhost.exe no specs certutil.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs #GCLEANER ra02w4s.exe powershell.exe no specs conhost.exe no specs cmdkey.exe no specs conhost.exe no specs cmdkey.exe no specs conhost.exe no specs d1oax1c.exe no specs 2rmt7lpsfkam.exe 2rmt7lpsfkam.tmp globalsynapse398.exe powershell.exe no specs conhost.exe no specs msbuild.exe no specs #LUMMA msbuild.exe tasklist.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs hgvm49v.exe gebxn0xnd.exe msbuild.exe 8gtjmsmelkt.exe no specs werfault.exe no specs e5jg7mm.exe no specs cfd179a944.exe cfd179a944.tmp info.exe conhost.exe no specs core.exe msbuild.exe svchost.exe werfault.exe no specs rl8ub1wklht.exe 6a0e97d504.exe rl8ub1wklht.tmp globalsynapse398.exe no specs powershell.exe no specs conhost.exe no specs ramez.exe no specs msbuild.exe no specs msbuild.exe no specs msbuild.exe werfault.exe no specs #LUMMA 31e91a1ecd.exe pvgze7gmw.exe mymd9zip8.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs 450294b8e9.exe chrome.exe no specs chrome.exe no specs csc.exe cmd.exe no specs conhost.exe no specs cvtres.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs nircmd.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs nsudolg.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs mode.com no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs tasklist.exe no specs chrome.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs tasklist.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs taskkill.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs find.exe no specs nsudolg.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs #CREDENTIALFLUSHER e98298f6b6.exe no specs taskkill.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs csc.exe msedge.exe no specs cvtres.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs taskkill.exe no specs conhost.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs findstr.exe no specs taskkill.exe no specs conhost.exe no specs 7z.exe unlocker.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs #CREDENTIALFLUSHER firefox.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs firefox.exe taskkill.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs find.exe no specs sc.exe no specs sc.exe no specs unlocker.exe cmd.exe no specs conhost.exe no specs sc.exe no specs firefox.exe no specs 07483a3522.exe no specs firefox.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs schtasks.exe no specs iobitunlocker.exe no specs firefox.exe no specs firefox.exe no specs chrome.exe chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe powershell.exe conhost.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs iobitunlocker.exe no specs chrome.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs tempx4uackmio4ktbjxpkmbsiyzmurqfbyn7.exe no specs chrome.exe no specs s1oedqsx6cha1sqgtytmi1gbbaluv2w.exe no specs chrome.exe no specs powershell.exe no specs chrome.exe no specs conhost.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs firefox.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs chrome.exe no specs conhost.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs chrome.exe no specs conhost.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
240"C:\Users\admin\AppData\Roaming\F1PWN1v9dqj\PVgzE7GMw.exe"C:\Users\admin\AppData\Roaming\F1PWN1v9dqj\PVgzE7GMw.exe
ra02W4S.exe
User:
admin
Company:
Fault-tolerant DNS Ltd.
Integrity Level:
MEDIUM
Description:
Provides Adapt Workflow capabilities
Version:
1.14.390.3088
Modules
Images
c:\users\admin\appdata\roaming\f1pwn1v9dqj\pvgze7gmw.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
300"taskkill" /IM maxthon.exeC:\Windows\System32\taskkill.exeRi5HQc5.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
456\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exepowershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
496"taskkill" /F /IM chrome.exeC:\Windows\System32\taskkill.exeRi5HQc5.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
516"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1952 --field-trial-handle=1956,i,18045644619286716558,7506760382793878868,262144 --variations-seed-version /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
1
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
536\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exetaskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
616reg query "HKLM\System\CurrentControlSet\Services\WdBoot" C:\Windows\System32\reg.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
668"tasklist"C:\Windows\System32\tasklist.exeRi5HQc5.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
672"C:\Users\admin\AppData\Local\Temp\10118340101\cfd179a944.exe" C:\Users\admin\AppData\Local\Temp\10118340101\cfd179a944.exe
ramez.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
MyApp Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\10118340101\cfd179a944.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
744"C:\Users\admin\AppData\Local\Temp\10118330101\e5jg7MM.exe" C:\Users\admin\AppData\Local\Temp\10118330101\e5jg7MM.exeramez.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\10118330101\e5jg7mm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
172 134
Read events
171 970
Write events
156
Delete events
8

Modification events

(PID) Process:(6048) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6048) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6048) ramez.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5416) bf06ca71e0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Enigma Protector\BB3DF1FDBB935E9B-50AFA6E27F8A32AF\1D23E801FF916F1C-DF69CE3484AE41BB
Operation:writeName:AEF6E8B3
Value:
131F8A4BC3DE68A2588FC5B83747
(PID) Process:(5960) Ri5HQc5.exeKey:HKEY_CLASSES_ROOT\ms-settings\Shell\open\command
Operation:writeName:DelegateExecute
Value:
(PID) Process:(7364) ComputerDefaults.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(7364) ComputerDefaults.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7364) ComputerDefaults.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7364) ComputerDefaults.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5416) bf06ca71e0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
102
Suspicious files
207
Text files
234
Unknown types
0

Dropped files

PID
Process
Filename
Type
5416bf06ca71e0.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\text[1]text
MD5:5E847B1CC501E8A09997640FED7DB52F
SHA256:C06903CB5A25E63794907092B488A8580074C872272A9FC51CEF5E76EEECF7A2
5416bf06ca71e0.exeC:\Users\admin\AppData\Local\Temp\F59E91F8binary
MD5:91267AD1E6E3B1BAACAEB0296F7223BD
SHA256:CE5958694F937603D7891BF5A7E4BD88A282E1BBB3285C0A68801389464AD6A1
6048ramez.exeC:\Users\admin\AppData\Local\Temp\10118250101\Ri5HQc5.exeexecutable
MD5:1B4C65E3106C8E09AB2761055A495C17
SHA256:C2A00DE7DF412D235732A283B86123374A9A0A44665257CC4C00997974C581F4
7400Sigmanly_d74e49dd237c22caf3dd5700bdca67bcc7d636e7f57ee32860c99b283b3a7ecb.exeC:\Users\admin\AppData\Local\Temp\M9FJ7RNL8PGG8PS9BP7W.exeexecutable
MD5:B024F652A94D64CFFC7DBF2E54F9F680
SHA256:0762262EE8CA6BB6FFCBB1003088ECF3C6945C2B34B818E4EA8C96F378F5017D
6048ramez.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\j6J70wm[1].exeexecutable
MD5:6FD840902E72F5F19F4F4CCFF1781DD6
SHA256:E3E5B7A32D43370DC2616EA5EA12D9D773E95BE3F6C26D34FFB9BFA6E0D50D6E
6048ramez.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\random[1].exeexecutable
MD5:B20DFC438760671893EC3E49DF9AFA35
SHA256:4A991D77AFD122CBFEDC7D61F0EDF90F2907640A25C17FA4B9390E64A926E704
6048ramez.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\08IyOOF[1].exeexecutable
MD5:1729908D017EAB89835357E4B5F5F78B
SHA256:E13F38636C5776A92885F62831BC323F843256C147EAFCD79EAFE96762A6145A
5960Ri5HQc5.exeC:\Users\admin\AppData\Local\Temp\Prysmax\Apps\Credentials\Credentials_1\S-1-5-21-1693682860-607145093-2874071422-1001\136a6807-03f4-4648-9145-17fee5c37b33binary
MD5:199584A1B51F4347835E0BF177073F21
SHA256:79064CA48D730ADDF764B905F7A41DF0118F086D46954AE34C31B9AA53525E7F
6048ramez.exeC:\Users\admin\AppData\Local\Temp\10118260101\08IyOOF.exeexecutable
MD5:1729908D017EAB89835357E4B5F5F78B
SHA256:E13F38636C5776A92885F62831BC323F843256C147EAFCD79EAFE96762A6145A
8044M9FJ7RNL8PGG8PS9BP7W.exeC:\Users\admin\AppData\Local\Temp\d610cf342e\ramez.exeexecutable
MD5:B024F652A94D64CFFC7DBF2E54F9F680
SHA256:0762262EE8CA6BB6FFCBB1003088ECF3C6945C2B34B818E4EA8C96F378F5017D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
183
TCP/UDP connections
247
DNS requests
154
Threats
140

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.48.23.157:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
4208
RUXIMICS.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
2104
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
4208
RUXIMICS.exe
GET
200
23.48.23.157:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
7400
Sigmanly_d74e49dd237c22caf3dd5700bdca67bcc7d636e7f57ee32860c99b283b3a7ecb.exe
GET
200
185.156.72.2:80
http://185.156.72.2/mine/random.exe
unknown
unknown
7988
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
whitelisted
7988
SIHClient.exe
GET
200
23.48.23.159:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
whitelisted
7988
SIHClient.exe
GET
200
23.48.23.159:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
whitelisted
7988
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
7988
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
40.127.240.158:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
whitelisted
4208
RUXIMICS.exe
40.127.240.158:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2104
svchost.exe
40.127.240.158:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7400
Sigmanly_d74e49dd237c22caf3dd5700bdca67bcc7d636e7f57ee32860c99b283b3a7ecb.exe
104.21.40.104:443
overcovtcg.top
CLOUDFLARENET
malicious
2104
svchost.exe
23.48.23.157:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4208
RUXIMICS.exe
23.48.23.157:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4208
RUXIMICS.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.181.238
whitelisted
client.wns.windows.com
  • 172.211.123.249
  • 172.211.123.248
whitelisted
meteorplyp.live
malicious
flowerexju.bet
malicious
zmedtipp.live
malicious
easterxeen.run
malicious
araucahkbm.live
malicious
overcovtcg.top
  • 104.21.40.104
  • 172.67.150.184
malicious
crl.microsoft.com
  • 23.48.23.157
  • 23.48.23.177
  • 23.48.23.175
  • 23.48.23.151
  • 23.48.23.183
  • 23.48.23.150
  • 23.48.23.169
  • 23.48.23.176
  • 23.48.23.149
  • 23.48.23.159
  • 23.48.23.189
  • 23.48.23.179
  • 23.48.23.163
  • 23.48.23.185
  • 23.48.23.191
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (flowerexju .bet)
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (easterxeen .run)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (meteorplyp .live)
7400
Sigmanly_d74e49dd237c22caf3dd5700bdca67bcc7d636e7f57ee32860c99b283b3a7ecb.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (overcovtcg .top) in TLS SNI
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (overcovtcg .top)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zmedtipp .live)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (araucahkbm .live)
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
7400
Sigmanly_d74e49dd237c22caf3dd5700bdca67bcc7d636e7f57ee32860c99b283b3a7ecb.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (overcovtcg .top) in TLS SNI
No debug info