amadey | 4340a82e2b3b894a4e47e9d0c4c3d28fa9e64ddbe47c2c5a1753ee8b64a77446

Analysis

max time kernel
92s
max time network
145s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250619-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250619-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
04/10/2025, 22:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 2.6MB
Sample251004-2vmvnaxwdt
SHA256 532ff9804abd665f80ac0e6fbc9644f4fda0a1124c68131547a13f38bb4c538f
MD5 008fd0b8b26c67a2dfc6aa1cdb01f4d9
SHA1 d775a3eaf7937248c71d2c904dce65cdcec3ddf2
SHA512 8665a11d1eec8b5450fbf74a2e205599e0826fac6f5ad906d13b6dace09c651d8fb92f4d1f111856fc0436f8d5f448efd6984db200c1b2c3ecb29a3310db4c49
SSDEEP 49152:l4H8jaEf0XrdIHQ3KHtTOvXkbP+yi4dAj44OW8pBfmjbHQqVmUkulUYpp1:l4hGP4OBfm/QamIX1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

a9321e discovery amadey spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

5.63

Botnet

a9321e

http://mi.barbertingling.com

Attributes

install_dir
8808bf0623
install_file
Snqgiekz.exe
strings_key
4b1e57e0bf1078cff12f0d12c508abe8
url_paths
/kaWt2QXfpPueNM/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detects Amadey x86-bit Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1396-43-0x0000000000400000-0x000000000046F000-memory.dmp	family_amadey_v2

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 4412 set thread context of 2208	4412	Setup.exe	88
PID 2208 set thread context of 4900	2208	MicrosoftEdgeUpdate.exe	91
PID 2208 set thread context of 4940	2208	MicrosoftEdgeUpdate.exe	93
PID 2208 set thread context of 936	2208	MicrosoftEdgeUpdate.exe	95
PID 2208 set thread context of 3788	2208	MicrosoftEdgeUpdate.exe	97
PID 2208 set thread context of 5052	2208	MicrosoftEdgeUpdate.exe	98
PID 2208 set thread context of 5068	2208	MicrosoftEdgeUpdate.exe	99
PID 2208 set thread context of 792	2208	MicrosoftEdgeUpdate.exe	100
PID 2208 set thread context of 560	2208	MicrosoftEdgeUpdate.exe	101
PID 2208 set thread context of 1396	2208	MicrosoftEdgeUpdate.exe	102
PID 2208 set thread context of 5020	2208	MicrosoftEdgeUpdate.exe	103

Loads dropped DLL 1 IoCs

pid	Process
2208	MicrosoftEdgeUpdate.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4412	Setup.exe
4412	Setup.exe
4412	Setup.exe
4412	Setup.exe
2208	MicrosoftEdgeUpdate.exe
2208	MicrosoftEdgeUpdate.exe
2208	MicrosoftEdgeUpdate.exe
2208	MicrosoftEdgeUpdate.exe
2208	MicrosoftEdgeUpdate.exe
2208	MicrosoftEdgeUpdate.exe
2208	MicrosoftEdgeUpdate.exe
2208	MicrosoftEdgeUpdate.exe
2208	MicrosoftEdgeUpdate.exe
2208	MicrosoftEdgeUpdate.exe
2208	MicrosoftEdgeUpdate.exe
2208	MicrosoftEdgeUpdate.exe
2208	MicrosoftEdgeUpdate.exe
2208	MicrosoftEdgeUpdate.exe
2208	MicrosoftEdgeUpdate.exe
2208	MicrosoftEdgeUpdate.exe
2208	MicrosoftEdgeUpdate.exe
2208	MicrosoftEdgeUpdate.exe
2208	MicrosoftEdgeUpdate.exe
2208	MicrosoftEdgeUpdate.exe
2208	MicrosoftEdgeUpdate.exe
2208	MicrosoftEdgeUpdate.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4412	Setup.exe
4412	Setup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 2208	4412	Setup.exe	88
PID 4412 wrote to memory of 2208	4412	Setup.exe	88
PID 4412 wrote to memory of 2208	4412	Setup.exe	88
PID 4412 wrote to memory of 2208	4412	Setup.exe	88
PID 4412 wrote to memory of 2208	4412	Setup.exe	88
PID 2208 wrote to memory of 4900	2208	MicrosoftEdgeUpdate.exe	91
PID 2208 wrote to memory of 4900	2208	MicrosoftEdgeUpdate.exe	91
PID 2208 wrote to memory of 4900	2208	MicrosoftEdgeUpdate.exe	91
PID 2208 wrote to memory of 4900	2208	MicrosoftEdgeUpdate.exe	91
PID 2208 wrote to memory of 4900	2208	MicrosoftEdgeUpdate.exe	91
PID 2208 wrote to memory of 4900	2208	MicrosoftEdgeUpdate.exe	91
PID 2208 wrote to memory of 4900	2208	MicrosoftEdgeUpdate.exe	91
PID 2208 wrote to memory of 4900	2208	MicrosoftEdgeUpdate.exe	91
PID 2208 wrote to memory of 4900	2208	MicrosoftEdgeUpdate.exe	91
PID 2208 wrote to memory of 4900	2208	MicrosoftEdgeUpdate.exe	91
PID 2208 wrote to memory of 4900	2208	MicrosoftEdgeUpdate.exe	91
PID 2208 wrote to memory of 4900	2208	MicrosoftEdgeUpdate.exe	91
PID 2208 wrote to memory of 4900	2208	MicrosoftEdgeUpdate.exe	91
PID 4900 wrote to memory of 2208	4900	chrome.exe	88
PID 2208 wrote to memory of 4940	2208	MicrosoftEdgeUpdate.exe	93
PID 2208 wrote to memory of 4940	2208	MicrosoftEdgeUpdate.exe	93
PID 2208 wrote to memory of 4940	2208	MicrosoftEdgeUpdate.exe	93
PID 2208 wrote to memory of 4940	2208	MicrosoftEdgeUpdate.exe	93
PID 2208 wrote to memory of 4940	2208	MicrosoftEdgeUpdate.exe	93
PID 2208 wrote to memory of 4940	2208	MicrosoftEdgeUpdate.exe	93
PID 2208 wrote to memory of 4940	2208	MicrosoftEdgeUpdate.exe	93
PID 2208 wrote to memory of 4940	2208	MicrosoftEdgeUpdate.exe	93
PID 2208 wrote to memory of 4940	2208	MicrosoftEdgeUpdate.exe	93
PID 2208 wrote to memory of 4940	2208	MicrosoftEdgeUpdate.exe	93
PID 2208 wrote to memory of 4940	2208	MicrosoftEdgeUpdate.exe	93
PID 2208 wrote to memory of 4940	2208	MicrosoftEdgeUpdate.exe	93
PID 2208 wrote to memory of 4940	2208	MicrosoftEdgeUpdate.exe	93
PID 4940 wrote to memory of 2208	4940	msedge.exe	88
PID 2208 wrote to memory of 936	2208	MicrosoftEdgeUpdate.exe	95
PID 2208 wrote to memory of 936	2208	MicrosoftEdgeUpdate.exe	95
PID 2208 wrote to memory of 936	2208	MicrosoftEdgeUpdate.exe	95
PID 2208 wrote to memory of 936	2208	MicrosoftEdgeUpdate.exe	95
PID 2208 wrote to memory of 936	2208	MicrosoftEdgeUpdate.exe	95
PID 2208 wrote to memory of 936	2208	MicrosoftEdgeUpdate.exe	95
PID 2208 wrote to memory of 936	2208	MicrosoftEdgeUpdate.exe	95
PID 2208 wrote to memory of 936	2208	MicrosoftEdgeUpdate.exe	95
PID 2208 wrote to memory of 936	2208	MicrosoftEdgeUpdate.exe	95
PID 2208 wrote to memory of 936	2208	MicrosoftEdgeUpdate.exe	95
PID 2208 wrote to memory of 936	2208	MicrosoftEdgeUpdate.exe	95
PID 2208 wrote to memory of 3788	2208	MicrosoftEdgeUpdate.exe	97
PID 2208 wrote to memory of 3788	2208	MicrosoftEdgeUpdate.exe	97
PID 2208 wrote to memory of 3788	2208	MicrosoftEdgeUpdate.exe	97
PID 2208 wrote to memory of 3788	2208	MicrosoftEdgeUpdate.exe	97
PID 2208 wrote to memory of 3788	2208	MicrosoftEdgeUpdate.exe	97
PID 2208 wrote to memory of 3788	2208	MicrosoftEdgeUpdate.exe	97
PID 2208 wrote to memory of 3788	2208	MicrosoftEdgeUpdate.exe	97
PID 2208 wrote to memory of 3788	2208	MicrosoftEdgeUpdate.exe	97
PID 2208 wrote to memory of 3788	2208	MicrosoftEdgeUpdate.exe	97
PID 2208 wrote to memory of 3788	2208	MicrosoftEdgeUpdate.exe	97
PID 2208 wrote to memory of 3788	2208	MicrosoftEdgeUpdate.exe	97
PID 2208 wrote to memory of 5052	2208	MicrosoftEdgeUpdate.exe	98
PID 2208 wrote to memory of 5052	2208	MicrosoftEdgeUpdate.exe	98
PID 2208 wrote to memory of 5052	2208	MicrosoftEdgeUpdate.exe	98
PID 2208 wrote to memory of 5052	2208	MicrosoftEdgeUpdate.exe	98
PID 2208 wrote to memory of 5052	2208	MicrosoftEdgeUpdate.exe	98
PID 2208 wrote to memory of 5052	2208	MicrosoftEdgeUpdate.exe	98
PID 2208 wrote to memory of 5052	2208	MicrosoftEdgeUpdate.exe	98
PID 2208 wrote to memory of 5052	2208	MicrosoftEdgeUpdate.exe	98
PID 2208 wrote to memory of 5052	2208	MicrosoftEdgeUpdate.exe	98

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Users\Admin\AppData\Local\Temp\h9tepmpw\MicrosoftEdgeUpdate.exe
  C:\Users\Admin\AppData\Local\Temp\h9tepmpw\MicrosoftEdgeUpdate.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:5068
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:560
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\SysWOW64\rundll32.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1396
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\SysWOW64\rundll32.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5020

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4936

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

380ABE2.tmp

Path C:\Users\Admin\AppData\Local\Temp\380ABE2.tmp
Size 40B
SHA256 1da28a72a4d43e5341170bf9b6e1cff9b1e28de510afa8e0d85fedea764855e9
MD5 3873ed708066fecb678fa745ca1a9321
SHA1 f48d5f0d1032fdb2cd2764f51b53acbe56a43693
SHA512 6e2ce179af3286d1068fb94094d609f911befb1e5aaaa0ecc6de1acf8edb438ce99be4cbd074d508b141edd24862b9162d637a8fcaababbb8afb76b4d1656460
MD5 SHA1 SHA512

Submit Download

FDB85AB.tmp

Path C:\Users\Admin\AppData\Local\Temp\FDB85AB.tmp
Size 1.2MB
SHA256 77066943f356a611dd3b243e623ecf4d65483282cbc5334d9b0322d5fc588a07
MD5 1dffdc71ac5a0b993e3b954304246b52
SHA1 b753f9b2093c28454479eb98ee1a0691b4220c73
SHA512 1bbe21003d98e18779762c7ff05f7c451315c424696fab76bdfc6f0b74a5a9d425d5e1ad9fc66c209d0ad70d44b624a518912f8e5d71264323ce9b81bfb24f51
SSDEEP 24576:/PEjdx0b0Je46AMW+yCjbmgHB4QZzoLz/I8ABZFZcE:/PER2oJ3pcdbmQVMH/k9yE
MD5 SHA1 SHA512 SSDEEP

Submit Download

MicrosoftEdgeUpdate.exe

Path C:\Users\Admin\AppData\Local\Temp\h9tepmpw\MicrosoftEdgeUpdate.exe
Size 201KB
SHA256 f8f3ace5c3c404342251e16381132f0453514e03e9c65cf387a21cd288552200
MD5 41680b5d08d0f18ec731b58a73de4781
SHA1 30eb01cd07f55adaca44edcdcfbc152148078669
SHA512 f936c26a26c5268a142f56c7ca0277efea42404a405679ac23060085ffe96702871ec8d2e0db5534878a03948e99f9464cb8a9da20784f9b0308be9ad30891ce
SSDEEP 3072:vHrfzYBc6X/YoW4l/DReos0gXf+EvC6C36eCWdMuoB+ISzBqUGxNtvKAbFP3cSEZ:GAel/DRfkTC3dM7B+mCL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/560-23-0x00000120067E0000-0x00000120067E2000-memory.dmp

Download

memory/792-22-0x000001C4AA480000-0x000001C4AA482000-memory.dmp

Download

memory/936-17-0x000001F464060000-0x000001F464062000-memory.dmp

Download

memory/1396-26-0x0000000000B10000-0x0000000000B63000-memory.dmp

Download

memory/1396-43-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/1396-25-0x00000000007B0000-0x00000000007B3000-memory.dmp

Download

memory/1396-24-0x0000000000700000-0x000000000074E000-memory.dmp

Download

memory/2208-20-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2208-12-0x00007FFCCB730000-0x00007FFCCB928000-memory.dmp

Download

memory/2208-14-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2208-41-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2208-8-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/3788-18-0x0000024CC26D0000-0x0000024CC26D2000-memory.dmp

Download

memory/4412-3-0x00007FFCAD9EB000-0x00007FFCAD9EC000-memory.dmp

Download

memory/4412-4-0x00007FFCAD9D0000-0x00007FFCADB42000-memory.dmp

Download

memory/4412-6-0x00007FFCAD9D0000-0x00007FFCADB42000-memory.dmp

Download

memory/4412-13-0x00007FFCAD9EB000-0x00007FFCAD9EC000-memory.dmp

Download

memory/4412-0-0x00007FFCAD9D0000-0x00007FFCADB42000-memory.dmp

Download

memory/4900-15-0x000001FDE1D90000-0x000001FDE1D92000-memory.dmp

Download

memory/4940-16-0x000001C8FFCF0000-0x000001C8FFCF2000-memory.dmp

Download

memory/5020-39-0x00000000030A0000-0x00000000036B0000-memory.dmp

Download

memory/5020-32-0x00000000004A0000-0x00000000004A3000-memory.dmp

Download

memory/5020-31-0x0000000000700000-0x0000000000CE0000-memory.dmp

Download

memory/5020-38-0x00000000030A0000-0x00000000036B0000-memory.dmp

Download

memory/5020-37-0x00000000030A0000-0x00000000036B0000-memory.dmp

Download

memory/5020-33-0x00000000030A0000-0x00000000036B0000-memory.dmp

Download

memory/5052-19-0x00000204AE7A0000-0x00000204AE7A2000-memory.dmp

Download

memory/5068-21-0x000002077B2C0000-0x000002077B2C2000-memory.dmp

Download