amadey | 9f7d849e26b45382639da7c45256fbe0963ce63554bb9c8b20dfa9216c9947bd

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20250207-en
resource tags

arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
submitted
08-02-2025 15:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

random.exe
Size

1.8MB
MD5

5b7618b4200c4288b830a4c0bbe23348
SHA1

5676c7ed0d9203a7ffe9197bae7da5f85c56106b
SHA256

9f7d849e26b45382639da7c45256fbe0963ce63554bb9c8b20dfa9216c9947bd
SHA512

a914c364f053aafb85d4fdaefa9d046a498713d4bf78bf4d0bdb286cc921f6d5160d5a1a7a4f101b46aac4e67e295e7a1a954e9573d95457df7b37a4ab21fd78
SSDEEP

49152:8/08HRt4iYyXvvCLN8ZnysbKFHiY8VnVfut:8/0C+9yyN8EfFCZVc

Score

10^/10

amadey fed3aa defense_evasion discovery trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

http://185.215.113.16

Attributes

install_dir
44111dbc49
install_file
axplong.exe
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
url_paths
/Jo89Ku7d/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	random.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe

Downloads MZ/PE file 3 IoCs

flow	pid	Process
40	1620	Process not Found
44	2556	axplong.exe
44	2556	axplong.exe

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-705198581-2062733989-3666524522-1000\Control Panel\International\Geo\Nation	axplong.exe
Key value queried	\REGISTRY\USER\S-1-5-21-705198581-2062733989-3666524522-1000\Control Panel\International\Geo\Nation	random.exe

Executes dropped EXE 6 IoCs

pid	Process
2556	axplong.exe
1880	axplong.exe
2520	goldik12321.exe
2252	goldik12321.exe
3188	axplong.exe
1756	axplong.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-705198581-2062733989-3666524522-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-705198581-2062733989-3666524522-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-705198581-2062733989-3666524522-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-705198581-2062733989-3666524522-1000\Software\Wine	random.exe
Key opened	\REGISTRY\USER\S-1-5-21-705198581-2062733989-3666524522-1000\Software\Wine	axplong.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
4124	random.exe
2556	axplong.exe
1880	axplong.exe
3188	axplong.exe
1756	axplong.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2520 set thread context of 2252	2520	goldik12321.exe	101

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\axplong.job	random.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3708	2520	WerFault.exe	100

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	goldik12321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	goldik12321.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3684	MicrosoftEdgeUpdate.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4124	random.exe
4124	random.exe
2556	axplong.exe
2556	axplong.exe
1880	axplong.exe
1880	axplong.exe
3188	axplong.exe
3188	axplong.exe
1756	axplong.exe
1756	axplong.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4124	random.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 2556	4124	random.exe	89
PID 4124 wrote to memory of 2556	4124	random.exe	89
PID 4124 wrote to memory of 2556	4124	random.exe	89
PID 2556 wrote to memory of 2520	2556	axplong.exe	100
PID 2556 wrote to memory of 2520	2556	axplong.exe	100
PID 2556 wrote to memory of 2520	2556	axplong.exe	100
PID 2520 wrote to memory of 2252	2520	goldik12321.exe	101
PID 2520 wrote to memory of 2252	2520	goldik12321.exe	101
PID 2520 wrote to memory of 2252	2520	goldik12321.exe	101
PID 2520 wrote to memory of 2252	2520	goldik12321.exe	101
PID 2520 wrote to memory of 2252	2520	goldik12321.exe	101
PID 2520 wrote to memory of 2252	2520	goldik12321.exe	101
PID 2520 wrote to memory of 2252	2520	goldik12321.exe	101
PID 2520 wrote to memory of 2252	2520	goldik12321.exe	101
PID 2520 wrote to memory of 2252	2520	goldik12321.exe	101

C:\Users\Admin\AppData\Local\Temp\random.exe
"C:\Users\Admin\AppData\Local\Temp\random.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
  "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Downloads MZ/PE file
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Users\Admin\AppData\Local\Temp\1015307001\goldik12321.exe
    "C:\Users\Admin\AppData\Local\Temp\1015307001\goldik12321.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2520
  - - C:\Users\Admin\AppData\Local\Temp\1015307001\goldik12321.exe
      "C:\Users\Admin\AppData\Local\Temp\1015307001\goldik12321.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2252
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 816
      4⤵
      Program crash
      PID:3708

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1880

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjcwNzRCOTItNTM5RS00OEJBLThDMzktNzhEMTZDM0I5QUUxfSIgdXNlcmlkPSJ7MkUwNUJDODAtODFGNy00QUUxLUJGMzMtRUU0M0Y0RTFBMDRCfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QTk4OTlGMkMtMDQyMS00Q0MyLUE1NkMtMERGMzU2OTBFRTUxfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU4NjAiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODIxNjMwOTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MDM2MTY1NzM2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:3684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2520 -ip 2520
1⤵
PID:3776

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3188

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1015307001\goldik12321.exe

Filesize
501KB

MD5
c80b4443546055bfdc0f3edc5b88abe8

SHA1
4df4951f787aca9b1fbeafa4590614fa9db9db4a

SHA256
6d15b1a8ef83b775e3a71618c88a2e1b4dbffb8b81afe61552e8af2d77214d64

SHA512
1388114d4cf91a7ae5bc1c37a1caae5e3c17cfd02a2730fa3398582ad8896d8f7a94bf7f730d855cebe9dff1af31abafc3d82e831514a16d5f17333879d5c324

Download Submit
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

Filesize
1.8MB

MD5
5b7618b4200c4288b830a4c0bbe23348

SHA1
5676c7ed0d9203a7ffe9197bae7da5f85c56106b

SHA256
9f7d849e26b45382639da7c45256fbe0963ce63554bb9c8b20dfa9216c9947bd

SHA512
a914c364f053aafb85d4fdaefa9d046a498713d4bf78bf4d0bdb286cc921f6d5160d5a1a7a4f101b46aac4e67e295e7a1a954e9573d95457df7b37a4ab21fd78

Download Submit
memory/1756-82-0x0000000000D10000-0x00000000011CF000-memory.dmp

Filesize
4.7MB

Download
memory/1756-81-0x0000000000D10000-0x00000000011CF000-memory.dmp

Filesize
4.7MB

Download
memory/1880-26-0x0000000000D11000-0x0000000000D3F000-memory.dmp

Filesize
184KB

Download
memory/1880-24-0x0000000000D10000-0x00000000011CF000-memory.dmp

Filesize
4.7MB

Download
memory/1880-23-0x0000000000D10000-0x00000000011CF000-memory.dmp

Filesize
4.7MB

Download
memory/1880-25-0x0000000000D10000-0x00000000011CF000-memory.dmp

Filesize
4.7MB

Download
memory/1880-27-0x0000000000D10000-0x00000000011CF000-memory.dmp

Filesize
4.7MB

Download
memory/2252-70-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2252-68-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2520-65-0x0000000000750000-0x00000000007D0000-memory.dmp

Filesize
512KB

Download
memory/2520-66-0x00000000056A0000-0x0000000005C44000-memory.dmp

Filesize
5.6MB

Download
memory/2556-35-0x0000000000D10000-0x00000000011CF000-memory.dmp

Filesize
4.7MB

Download
memory/2556-18-0x0000000000D11000-0x0000000000D3F000-memory.dmp

Filesize
184KB

Download
memory/2556-20-0x0000000000D10000-0x00000000011CF000-memory.dmp

Filesize
4.7MB

Download
memory/2556-28-0x0000000000D10000-0x00000000011CF000-memory.dmp

Filesize
4.7MB

Download
memory/2556-19-0x0000000000D10000-0x00000000011CF000-memory.dmp

Filesize
4.7MB

Download
memory/2556-29-0x0000000000D10000-0x00000000011CF000-memory.dmp

Filesize
4.7MB

Download
memory/2556-30-0x0000000000D10000-0x00000000011CF000-memory.dmp

Filesize
4.7MB

Download
memory/2556-21-0x0000000000D10000-0x00000000011CF000-memory.dmp

Filesize
4.7MB

Download
memory/2556-42-0x0000000000D10000-0x00000000011CF000-memory.dmp

Filesize
4.7MB

Download
memory/2556-47-0x0000000000D10000-0x00000000011CF000-memory.dmp

Filesize
4.7MB

Download
memory/2556-49-0x0000000000D10000-0x00000000011CF000-memory.dmp

Filesize
4.7MB

Download
memory/2556-78-0x0000000000D10000-0x00000000011CF000-memory.dmp

Filesize
4.7MB

Download
memory/2556-17-0x0000000000D10000-0x00000000011CF000-memory.dmp

Filesize
4.7MB

Download
memory/2556-84-0x0000000000D10000-0x00000000011CF000-memory.dmp

Filesize
4.7MB

Download
memory/2556-83-0x0000000000D10000-0x00000000011CF000-memory.dmp

Filesize
4.7MB

Download
memory/2556-79-0x0000000000D10000-0x00000000011CF000-memory.dmp

Filesize
4.7MB

Download
memory/2556-77-0x0000000000D10000-0x00000000011CF000-memory.dmp

Filesize
4.7MB

Download
memory/2556-76-0x0000000000D10000-0x00000000011CF000-memory.dmp

Filesize
4.7MB

Download
memory/2556-74-0x0000000000D10000-0x00000000011CF000-memory.dmp

Filesize
4.7MB

Download
memory/2556-75-0x0000000000D10000-0x00000000011CF000-memory.dmp

Filesize
4.7MB

Download
memory/3188-73-0x0000000000D10000-0x00000000011CF000-memory.dmp

Filesize
4.7MB

Download
memory/3188-72-0x0000000000D10000-0x00000000011CF000-memory.dmp

Filesize
4.7MB

Download
memory/4124-0-0x0000000000770000-0x0000000000C2F000-memory.dmp

Filesize
4.7MB

Download
memory/4124-3-0x0000000000770000-0x0000000000C2F000-memory.dmp

Filesize
4.7MB

Download
memory/4124-2-0x0000000000771000-0x000000000079F000-memory.dmp

Filesize
184KB

Download
memory/4124-1-0x0000000077264000-0x0000000077266000-memory.dmp

Filesize
8KB

Download
memory/4124-4-0x0000000000770000-0x0000000000C2F000-memory.dmp

Filesize
4.7MB

Download
memory/4124-16-0x0000000000770000-0x0000000000C2F000-memory.dmp

Filesize
4.7MB

Download