| File name: | Sigmanly_d74e49dd237c22caf3dd5700bdca67bcc7d636e7f57ee32860c99b283b3a7ecb |
| Full analysis: | https://app.any.run/tasks/939bc078-8dcb-4a8e-8c2a-37e83c4b7624 |
| Verdict: | Malicious activity |
| Threats: | Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks. |
| Analysis date: | May 15, 2025, 13:37:05 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections |
| MD5: | 9CA4D729A557E460DC1B69DBDAA539B1 |
| SHA1: | 5E6D91AE8861FC31FBE0638B56EB3F82DF4481E5 |
| SHA256: | D74E49DD237C22CAF3DD5700BDCA67BCC7D636E7F57EE32860C99B283B3A7ECB |
| SSDEEP: | 98304:i0joJQxrKTRvFqJhEH4+Sgr2i0mXVHuKDnI2cIclWss+QjCVBPpzUS7jkvMK4lxm: |
| .exe | | | Generic Win/DOS Executable (50) |
|---|---|---|
| .exe | | | DOS Executable Generic (49.9) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2025:05:08 12:17:36+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14 |
| CodeSize: | 314880 |
| InitializedDataSize: | 37376 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x497000 |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 240 | "C:\Users\admin\AppData\Roaming\F1PWN1v9dqj\PVgzE7GMw.exe" | C:\Users\admin\AppData\Roaming\F1PWN1v9dqj\PVgzE7GMw.exe | ra02W4S.exe | ||||||||||||
User: admin Company: Fault-tolerant DNS Ltd. Integrity Level: MEDIUM Description: Provides Adapt Workflow capabilities Version: 1.14.390.3088 Modules
| |||||||||||||||
| 300 | "taskkill" /IM maxthon.exe | C:\Windows\System32\taskkill.exe | — | Ri5HQc5.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Terminates Processes Exit code: 128 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 456 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 496 | "taskkill" /F /IM chrome.exe | C:\Windows\System32\taskkill.exe | — | Ri5HQc5.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Terminates Processes Exit code: 128 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 516 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1952 --field-trial-handle=1956,i,18045644619286716558,7506760382793878868,262144 --variations-seed-version /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 1 Version: 122.0.6261.70 Modules
| |||||||||||||||
| 536 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | taskkill.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 616 | reg query "HKLM\System\CurrentControlSet\Services\WdBoot" | C:\Windows\System32\reg.exe | — | cmd.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Registry Console Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 668 | "tasklist" | C:\Windows\System32\tasklist.exe | — | Ri5HQc5.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Lists the current running tasks Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 672 | "C:\Users\admin\AppData\Local\Temp\10118340101\cfd179a944.exe" | C:\Users\admin\AppData\Local\Temp\10118340101\cfd179a944.exe | ramez.exe | ||||||||||||
User: admin Company: Integrity Level: MEDIUM Description: MyApp Setup Exit code: 0 Version: Modules
| |||||||||||||||
| 744 | "C:\Users\admin\AppData\Local\Temp\10118330101\e5jg7MM.exe" | C:\Users\admin\AppData\Local\Temp\10118330101\e5jg7MM.exe | — | ramez.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| (PID) Process: | (6048) ramez.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6048) ramez.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6048) ramez.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (5416) bf06ca71e0.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Enigma Protector\BB3DF1FDBB935E9B-50AFA6E27F8A32AF\1D23E801FF916F1C-DF69CE3484AE41BB |
| Operation: | write | Name: | AEF6E8B3 |
Value: 131F8A4BC3DE68A2588FC5B83747 | |||
| (PID) Process: | (5960) Ri5HQc5.exe | Key: | HKEY_CLASSES_ROOT\ms-settings\Shell\open\command |
| Operation: | write | Name: | DelegateExecute |
Value: | |||
| (PID) Process: | (7364) ComputerDefaults.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer |
| Operation: | write | Name: | SlowContextMenuEntries |
Value: 6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000 | |||
| (PID) Process: | (7364) ComputerDefaults.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7364) ComputerDefaults.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7364) ComputerDefaults.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (5416) bf06ca71e0.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5416 | bf06ca71e0.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\text[1] | text | |
MD5:5E847B1CC501E8A09997640FED7DB52F | SHA256:C06903CB5A25E63794907092B488A8580074C872272A9FC51CEF5E76EEECF7A2 | |||
| 5416 | bf06ca71e0.exe | C:\Users\admin\AppData\Local\Temp\F59E91F8 | binary | |
MD5:91267AD1E6E3B1BAACAEB0296F7223BD | SHA256:CE5958694F937603D7891BF5A7E4BD88A282E1BBB3285C0A68801389464AD6A1 | |||
| 6048 | ramez.exe | C:\Users\admin\AppData\Local\Temp\10118250101\Ri5HQc5.exe | executable | |
MD5:1B4C65E3106C8E09AB2761055A495C17 | SHA256:C2A00DE7DF412D235732A283B86123374A9A0A44665257CC4C00997974C581F4 | |||
| 7400 | Sigmanly_d74e49dd237c22caf3dd5700bdca67bcc7d636e7f57ee32860c99b283b3a7ecb.exe | C:\Users\admin\AppData\Local\Temp\M9FJ7RNL8PGG8PS9BP7W.exe | executable | |
MD5:B024F652A94D64CFFC7DBF2E54F9F680 | SHA256:0762262EE8CA6BB6FFCBB1003088ECF3C6945C2B34B818E4EA8C96F378F5017D | |||
| 6048 | ramez.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\j6J70wm[1].exe | executable | |
MD5:6FD840902E72F5F19F4F4CCFF1781DD6 | SHA256:E3E5B7A32D43370DC2616EA5EA12D9D773E95BE3F6C26D34FFB9BFA6E0D50D6E | |||
| 6048 | ramez.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\random[1].exe | executable | |
MD5:B20DFC438760671893EC3E49DF9AFA35 | SHA256:4A991D77AFD122CBFEDC7D61F0EDF90F2907640A25C17FA4B9390E64A926E704 | |||
| 6048 | ramez.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\08IyOOF[1].exe | executable | |
MD5:1729908D017EAB89835357E4B5F5F78B | SHA256:E13F38636C5776A92885F62831BC323F843256C147EAFCD79EAFE96762A6145A | |||
| 5960 | Ri5HQc5.exe | C:\Users\admin\AppData\Local\Temp\Prysmax\Apps\Credentials\Credentials_1\S-1-5-21-1693682860-607145093-2874071422-1001\136a6807-03f4-4648-9145-17fee5c37b33 | binary | |
MD5:199584A1B51F4347835E0BF177073F21 | SHA256:79064CA48D730ADDF764B905F7A41DF0118F086D46954AE34C31B9AA53525E7F | |||
| 6048 | ramez.exe | C:\Users\admin\AppData\Local\Temp\10118260101\08IyOOF.exe | executable | |
MD5:1729908D017EAB89835357E4B5F5F78B | SHA256:E13F38636C5776A92885F62831BC323F843256C147EAFCD79EAFE96762A6145A | |||
| 8044 | M9FJ7RNL8PGG8PS9BP7W.exe | C:\Users\admin\AppData\Local\Temp\d610cf342e\ramez.exe | executable | |
MD5:B024F652A94D64CFFC7DBF2E54F9F680 | SHA256:0762262EE8CA6BB6FFCBB1003088ECF3C6945C2B34B818E4EA8C96F378F5017D | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2104 | svchost.exe | GET | 200 | 23.48.23.157:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
4208 | RUXIMICS.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
2104 | svchost.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
4208 | RUXIMICS.exe | GET | 200 | 23.48.23.157:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
7400 | Sigmanly_d74e49dd237c22caf3dd5700bdca67bcc7d636e7f57ee32860c99b283b3a7ecb.exe | GET | 200 | 185.156.72.2:80 | http://185.156.72.2/mine/random.exe | unknown | — | — | unknown |
7988 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl | unknown | — | — | whitelisted |
7988 | SIHClient.exe | GET | 200 | 23.48.23.159:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl | unknown | — | — | whitelisted |
7988 | SIHClient.exe | GET | 200 | 23.48.23.159:80 | http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl | unknown | — | — | whitelisted |
7988 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
7988 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4208 | RUXIMICS.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
2104 | svchost.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
3216 | svchost.exe | 172.211.123.249:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
7400 | Sigmanly_d74e49dd237c22caf3dd5700bdca67bcc7d636e7f57ee32860c99b283b3a7ecb.exe | 104.21.40.104:443 | overcovtcg.top | CLOUDFLARENET | — | malicious |
2104 | svchost.exe | 23.48.23.157:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4208 | RUXIMICS.exe | 23.48.23.157:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
2104 | svchost.exe | 23.35.229.160:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4208 | RUXIMICS.exe | 23.35.229.160:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
meteorplyp.live |
| malicious |
flowerexju.bet |
| malicious |
zmedtipp.live |
| malicious |
easterxeen.run |
| malicious |
araucahkbm.live |
| malicious |
overcovtcg.top |
| malicious |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
2196 | svchost.exe | Domain Observed Used for C2 Detected | ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (flowerexju .bet) |
2196 | svchost.exe | Potentially Bad Traffic | ET DNS Query to a *.top domain - Likely Hostile |
2196 | svchost.exe | Domain Observed Used for C2 Detected | ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (easterxeen .run) |
2196 | svchost.exe | Domain Observed Used for C2 Detected | ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (meteorplyp .live) |
7400 | Sigmanly_d74e49dd237c22caf3dd5700bdca67bcc7d636e7f57ee32860c99b283b3a7ecb.exe | Domain Observed Used for C2 Detected | ET MALWARE Observed Win32/Lumma Stealer Related Domain (overcovtcg .top) in TLS SNI |
2196 | svchost.exe | Domain Observed Used for C2 Detected | ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (overcovtcg .top) |
2196 | svchost.exe | Domain Observed Used for C2 Detected | ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zmedtipp .live) |
2196 | svchost.exe | Domain Observed Used for C2 Detected | ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (araucahkbm .live) |
— | — | Potentially Bad Traffic | ET INFO HTTP Request to a *.top domain |
7400 | Sigmanly_d74e49dd237c22caf3dd5700bdca67bcc7d636e7f57ee32860c99b283b3a7ecb.exe | Domain Observed Used for C2 Detected | ET MALWARE Observed Win32/Lumma Stealer Related Domain (overcovtcg .top) in TLS SNI |