Malware analysis 7zFM.exe Malicious activity | ANY.RUN

Add for printing

File name:	7zFM.exe
Full analysis:	https://app.any.run/tasks/0c942083-89e9-442d-b077-95ff03891946
Verdict:	Malicious activity
Threats:	Rhadamanthys is a C++ information-stealing malware that extracts sensitive data from infiltrated machines. Its layered operational chain and advanced evasion tactics make it a major risk in cybersecurity landscapes. Malware Trends Tracker >>>
Analysis date:	June 15, 2025, 16:20:12
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	python rhadamanthys
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:	ECF577B1A11714B94D4E4CC786D95B8E
SHA1:	9D07B13E585C284091058F2824424BFCF01CF026
SHA256:	F4065C5C4B490A42AFF8F3325138AEEA6993E8FE9816C132F3FBADFF06EBF929
SSDEEP:	49152:yXlAQ6e7yts0X4gRG6Kj7cSNkBPufeB0rrknYXA2WjLwE6d0uZU0tTThgLzYwFgu:Gu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 30 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (133.0.6943.127)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (133.0.3065.92)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (136.0)
Mozilla Maintenance Service (136.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- RHADAMANTHYS has been detected (YARA)
  - 7zFM.exe (PID: 4232)
SUSPICIOUS
- Executable content was dropped or overwritten
  - 7zFM.exe (PID: 2492)
  - encry.exe (PID: 3148)
- Drops 7-zip archiver for unpacking
  - 7zFM.exe (PID: 2492)
- Reads security settings of Internet Explorer
  - 7zFM.exe (PID: 2492)
- Process drops legitimate windows executable
  - encry.exe (PID: 3148)
- The process drops C-runtime libraries
  - encry.exe (PID: 3148)
- Process drops python dynamic module
  - encry.exe (PID: 3148)
- Loads Python modules
  - encry.exe (PID: 6380)
- Connects to SMTP port
  - encry.exe (PID: 6380)
- Application launched itself
  - encry.exe (PID: 3148)
INFO
- Checks supported languages
  - 7zFM.exe (PID: 2492)
  - 7zFM.exe (PID: 4232)
  - encry.exe (PID: 3148)
  - encry.exe (PID: 6380)
- Reads the machine GUID from the registry
  - 7zFM.exe (PID: 2492)
  - encry.exe (PID: 6380)
- The sample compiled with english language support
  - 7zFM.exe (PID: 2492)
  - encry.exe (PID: 3148)
- Reads the computer name
  - 7zFM.exe (PID: 2492)
  - 7zFM.exe (PID: 4232)
  - encry.exe (PID: 3148)
  - encry.exe (PID: 6380)
- Process checks computer location settings
  - 7zFM.exe (PID: 2492)
- Creates files or folders in the user directory
  - 7zFM.exe (PID: 2492)
- Create files in a temporary directory
  - encry.exe (PID: 3148)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Generic CIL Executable (.NET, Mono, etc.) (55.8)
.exe	\|	Win64 Executable (generic) (21)
.scr	\|	Windows screen saver (9.9)
.dll	\|	Win32 Dynamic Link Library (generic) (5)
.exe	\|	Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2012:10:07 23:50:07+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	8
CodeSize:	46592
InitializedDataSize:	16896
UninitializedDataSize:	-
EntryPoint:	0xd532
OSVersion:	4
ImageVersion:	-
SubsystemVersion:	4
Subsystem:	Windows GUI
FileVersionNumber:	1.0.0.0
ProductVersionNumber:	1.0.0.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Win32
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Unicode
FileDescription:	exeBase
FileVersion:	1.0.0.0
InternalName:	exeBase.exe
LegalCopyright:	Copyright © 2012
OriginalFileName:	exeBase.exe
ProductName:	exeBase
ProductVersion:	1.0.0.0
AssemblyVersion:	1.0.0.0

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

136

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

2492

"C:\Users\admin\AppData\Local\Temp\7zFM.exe"

C:\Users\admin\AppData\Local\Temp\7zFM.exe

explorer.exe

User:

admin

Integrity Level:

MEDIUM

Description:

exeBase

Exit code:

Version:

1.0.0.0

Modules

Images
c:\users\admin\appdata\local\temp\7zfm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll

3148

"C:\Users\admin\AppData\Roaming\encry.exe"

C:\Users\admin\AppData\Roaming\encry.exe

7zFM.exe

User:

admin

Integrity Level:

MEDIUM

Exit code:

Modules

Images
c:\users\admin\appdata\roaming\encry.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

4232

"C:\Users\admin\AppData\Roaming\7zFM.exe"

C:\Users\admin\AppData\Roaming\7zFM.exe

7zFM.exe

User:

admin

Company:

Igor Pavlov

Integrity Level:

MEDIUM

Description:

7-Zip File Manager

Version:

24.09

Modules

Images
c:\users\admin\appdata\roaming\7zfm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll

6380

"C:\Users\admin\AppData\Roaming\encry.exe"

C:\Users\admin\AppData\Roaming\encry.exe

encry.exe

User:

admin

Integrity Level:

MEDIUM

Exit code:

Modules

Images
c:\users\admin\appdata\roaming\encry.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

Add for printing

Total events

901

Read events

901

Write events

Delete events

Modification events

No data

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
3148	encry.exe	C:\Users\admin\AppData\Local\Temp\_MEI31482\_decimal.pyd		executable
		MD5:584652F877074FE71D7B1F8EEA1F849E	SHA256:E0F93185CD64F1DB3B9D1D20D620A691C5C453094B14D3B2BA2837F908F13304
3148	encry.exe	C:\Users\admin\AppData\Local\Temp\_MEI31482\_socket.pyd		executable
		MD5:1AD8628499A107382153348A14A1DFC7	SHA256:7A20FE96274F554CC527C65F42A8DE9CF0C201852BEDDDC12E44D9106BAB728F
3148	encry.exe	C:\Users\admin\AppData\Local\Temp\_MEI31482\base_library.zip		compressed
		MD5:476797C80F0003B31CA02B75D4332545	SHA256:0409872305A979F7F7E2FF9D17BD6DBCEE1FBAF1E1F189353373309BC6438D37
3148	encry.exe	C:\Users\admin\AppData\Local\Temp\_MEI31482\_bz2.pyd		executable
		MD5:51CA0713F8FD5F142625A44DF7ED7100	SHA256:8768315B1E0E81CCD0D96C3D6A863803F5DD1DE6AF849285C439D61ABD32B647
3148	encry.exe	C:\Users\admin\AppData\Local\Temp\_MEI31482\_hashlib.pyd		executable
		MD5:692837EB1FCB73EF33A1474B18DFC7CD	SHA256:D674D53F7E2F906FBAF0D19AB871F9CFF53956D40B3CE003A2B4B44B549D4B92
2492	7zFM.exe	C:\Users\admin\AppData\Roaming\encry.exe		executable
		MD5:52A4D103BBC8BA983B48941FB4357782	SHA256:425B6358666151299274392F5C4E7F8545F9C90DA8D76809822708A131557FCB
3148	encry.exe	C:\Users\admin\AppData\Local\Temp\_MEI31482\VCRUNTIME140.dll		executable
		MD5:32DA96115C9D783A0769312C0482A62D	SHA256:8B10C53241726B0ACC9F513157E67FCB01C166FEC69E5E38CA6AADA8F9A3619F
2492	7zFM.exe	C:\Users\admin\AppData\Roaming\7zFM.exe		executable
		MD5:6CA7989BDA0E7884A638388EAC04F5BD	SHA256:9FECF813248F963734AB1BCEDB567666B3799D73B63B3CAFFF55F54ED7FEB6FF
3148	encry.exe	C:\Users\admin\AppData\Local\Temp\_MEI31482\cryptography-45.0.3.dist-info\INSTALLER		text
		MD5:365C9BFEB7D89244F2CE01C1DE44CB85	SHA256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
3148	encry.exe	C:\Users\admin\AppData\Local\Temp\_MEI31482\cryptography-45.0.3.dist-info\RECORD		csv
		MD5:7B10C15C868B09AFE658E1707A0A6DEA	SHA256:AA07A43C9ECE6BE2A240F5B242931FE605966DD6A2DF730B55F056CF0CA13C13

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
4944	svchost.exe	GET	200	2.23.77.188:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	2.16.168.114:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	2.16.253.202:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
3768	SIHClient.exe	GET	200	2.16.253.202:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted
3768	SIHClient.exe	GET	200	2.16.253.202:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
1268	svchost.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4680	RUXIMICS.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
6380	encry.exe	142.251.5.109:587	smtp.gmail.com	GOOGLE	US	whitelisted
2336	svchost.exe	172.211.123.248:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	FR	whitelisted
4944	svchost.exe	40.126.31.129:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4944	svchost.exe	2.23.77.188:80	ocsp.digicert.com	AKAMAI-AS	DE	whitelisted
5944	MoUsoCoreWorker.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	51.104.136.2 51.124.78.146	whitelisted
google.com	142.250.186.142	whitelisted
smtp.gmail.com	142.251.5.109	whitelisted
client.wns.windows.com	172.211.123.248	whitelisted
login.live.com	40.126.31.129 40.126.31.2 20.190.159.64 40.126.31.130 40.126.31.0 40.126.31.67 20.190.159.68 20.190.159.71	whitelisted
ocsp.digicert.com	2.23.77.188	whitelisted
nexusrules.officeapps.live.com	52.111.227.13	whitelisted
crl.microsoft.com	2.16.168.114 2.16.168.124	whitelisted
www.microsoft.com	2.16.253.202	whitelisted
slscr.update.microsoft.com	20.12.23.50	whitelisted

Threats

No threats detected

Add for printing

No debug info

General Info

7zFM.exe

ECF577B1A11714B94D4E4CC786D95B8E

9D07B13E585C284091058F2824424BFCF01CF026

F4065C5C4B490A42AFF8F3325138AEEA6993E8FE9816C132F3FBADFF06EBF929

49152:yXlAQ6e7yts0X4gRG6Kj7cSNkBPufeB0rrknYXA2WjLwE6d0uZU0tTThgLzYwFgu:Gu

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

RHADAMANTHYS has been detected (YARA)

SUSPICIOUS

Executable content was dropped or overwritten

Drops 7-zip archiver for unpacking

Reads security settings of Internet Explorer

Process drops legitimate windows executable

The process drops C-runtime libraries

Process drops python dynamic module

Loads Python modules

Connects to SMTP port

Application launched itself

INFO

Checks supported languages

Reads the machine GUID from the registry

The sample compiled with english language support

Reads the computer name

Process checks computer location settings

Creates files or folders in the user directory

Create files in a temporary directory

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings