amadey | 80c1c0be9297cc8e6ac2f37cd4e982ae68abba1f24af7569106fbd7a1fcb4132

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 06:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_9157556b1724bc210d1de66db0d83a38_amadey_elex_luca-stealer_lynx_medusalocker_njrat.exe
Size 3.0MB
Sample260809-hejcrawtbv
SHA256 80c1c0be9297cc8e6ac2f37cd4e982ae68abba1f24af7569106fbd7a1fcb4132
MD5 9157556b1724bc210d1de66db0d83a38
SHA1 0a848e00e596df0ae41b7349b664c79cbaa8010b
SHA512 02086fbce35dc252560a11835df2896004f76e299b89748d6bd230281627ca9519407bdea8472d41f6d23d78538a4fa05bde68913dc567f6b81c7359e2e8073b
SSDEEP 49152:KmPLJE3KwhYzwVvzFdPy/5YAMDesGhnr0:xPLJE3KwhWwVLmYvysEnr
TLSH
T1D0E55B52B585A1DFC48E1674E537EE469A1C07F9BB2048C3ED2C65BA6E33DC016B6C2C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery amadey trojan

Malware Config

Signatures

Family: Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Amadey x86-bit Payload 2 IoCs

resource	yara_rule
behavioral2/memory/2912-0-0x0000000000EA0000-0x00000000011AE000-memory.dmp	family_amadey_v2
behavioral2/memory/2912-1-0x0000000000EA0000-0x00000000011AE000-memory.dmp	family_amadey_v2

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4124	2912	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_9157556b1724bc210d1de66db0d83a38_amadey_elex_luca-stealer_lynx_medusalocker_njrat.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_9157556b1724bc210d1de66db0d83a38_amadey_elex_luca-stealer_lynx_medusalocker_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_9157556b1724bc210d1de66db0d83a38_amadey_elex_luca-stealer_lynx_medusalocker_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 240
  2⤵
  - Program crash
  PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2912 -ip 2912
1⤵
PID:3356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2912-0-0x0000000000EA0000-0x00000000011AE000-memory.dmp

Download

memory/2912-1-0x0000000000EA0000-0x00000000011AE000-memory.dmp