amadey | a98842b1fd6ad0e707ceb1cb3471fc58befabef5cfd4ef62c806c5a58cca7767

Analysis

max time kernel
148s
max time network
98s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/09/2026, 23:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_a98842b1fd6ad0e707ceb1cb3471fc58befabef5cfd4ef62c806c5a58cca7767.exe
Size 286KB
Sample260911-3n3szaxwfv
SHA256 a98842b1fd6ad0e707ceb1cb3471fc58befabef5cfd4ef62c806c5a58cca7767
MD5 bd6610f657b1560afa6558c3fe6de0ee
SHA1 2cecb9c5d82016bce72743fa24db8bb4cecf9620
SHA512 3868bf65415399ea883df5cb2e1985f85a7bd242bfd8a29bdb2aee227afee556185a6980df23114533953cd70e6857f8d2bb7975fd50302c0738ced936d03166
SSDEEP 6144:dNNIdn7AZM7ZqtNVORRDrt0AO24c9vAx0tOgD+u0QISoxCr:fNId7AZM7o70DRYG2kogr
TLSH
T172542259FEFF5163DADD40FDAC1ADE4046A55D266ECCE2EA784E13102B0A321093E5B2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

fbf543 discovery execution amadey persistence trojan

Malware Config

Extracted

Family

amadey

Version

5.55

Botnet

fbf543

http://94.154.35.25

Attributes

install_dir
96a319e745
install_file
Srxelqcif.exe
strings_key
f8bfac017914b836f3106c5bcd0878fe
url_paths
/di9ku38f/index.php

rc4.plain

Signatures

Family: Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Amadey x86-bit Payload 2 IoCs

resource	yara_rule
behavioral2/memory/2672-2-0x0000000005760000-0x00000000057D8000-memory.dmp	family_amadey_v2
behavioral2/files/0x000f00000001c579-8.dat	family_amadey_v2

Executes dropped EXE 2 IoCs

pid	Process
4464	xvuljP29.Kg43
424	xvuljP29.Kg43

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4460	icacls.exe
4312	icacls.exe
3420	icacls.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4092	cmd.exe
2860	cmd.exe
4528	cmd.exe
5068	cmd.exe
3800	cmd.exe
5844	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_a98842b1fd6ad0e707ceb1cb3471fc58befabef5cfd4ef62c806c5a58cca7767.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvuljP29.Kg43
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
856	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2672	jaffacakes118_a98842b1fd6ad0e707ceb1cb3471fc58befabef5cfd4ef62c806c5a58cca7767.exe
Token: SeRestorePrivilege	3420	icacls.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 4092	2672	jaffacakes118_a98842b1fd6ad0e707ceb1cb3471fc58befabef5cfd4ef62c806c5a58cca7767.exe	85
PID 4092 wrote to memory of 3420	4092	cmd.exe	87
PID 2672 wrote to memory of 2860	2672	jaffacakes118_a98842b1fd6ad0e707ceb1cb3471fc58befabef5cfd4ef62c806c5a58cca7767.exe	88
PID 2860 wrote to memory of 4460	2860	cmd.exe	90
PID 2672 wrote to memory of 4528	2672	jaffacakes118_a98842b1fd6ad0e707ceb1cb3471fc58befabef5cfd4ef62c806c5a58cca7767.exe	91
PID 4528 wrote to memory of 4312	4528	cmd.exe	93
PID 2672 wrote to memory of 3800	2672	jaffacakes118_a98842b1fd6ad0e707ceb1cb3471fc58befabef5cfd4ef62c806c5a58cca7767.exe	94
PID 2672 wrote to memory of 5068	2672	jaffacakes118_a98842b1fd6ad0e707ceb1cb3471fc58befabef5cfd4ef62c806c5a58cca7767.exe	95
PID 5068 wrote to memory of 856	5068	cmd.exe	98
PID 3800 wrote to memory of 4464	3800	cmd.exe	99
PID 5844 wrote to memory of 424	5844	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a98842b1fd6ad0e707ceb1cb3471fc58befabef5cfd4ef62c806c5a58cca7767.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a98842b1fd6ad0e707ceb1cb3471fc58befabef5cfd4ef62c806c5a58cca7767.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c icacls "C:\Users\Admin\Desktop\xvuljP29.Kg43" /setowner "SYSTEM"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\Desktop\xvuljP29.Kg43" /setowner "SYSTEM"
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3420
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c icacls "C:\Users\Admin\Desktop\xvuljP29.Kg43" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\Desktop\xvuljP29.Kg43" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4460
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c icacls "C:\Users\Admin\Desktop\xvuljP29.Kg43" /remove:d Everyone Administrators
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\Desktop\xvuljP29.Kg43" /remove:d Everyone Administrators
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4312
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c start "" "C:\Users\Admin\Desktop\xvuljP29.Kg43"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Users\Admin\Desktop\xvuljP29.Kg43
    "C:\Users\Admin\Desktop\xvuljP29.Kg43"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4464
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "OHQrVeuU" /xml "C:\Users\Admin\AppData\Local\Temp\OHQrVeuU.xml" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "OHQrVeuU" /xml "C:\Users\Admin\AppData\Local\Temp\OHQrVeuU.xml" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:856

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1852

C:\Windows\system32\cmd.exe
"cmd.exe" /c start "" "C:\Users\Admin\Desktop\xvuljP29.Kg43"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5844
- C:\Users\Admin\Desktop\xvuljP29.Kg43
  "C:\Users\Admin\Desktop\xvuljP29.Kg43"
  2⤵
  - Executes dropped EXE
  PID:424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OHQrVeuU.xml

Path C:\Users\Admin\AppData\Local\Temp\OHQrVeuU.xml
Size 2KB
SHA256 76e56c816a9439995cc69b442f32aa198e540ffbd76233c598707ca08afa52f7
MD5 d751d9b9507daa6d7aa4f495a160d41a
SHA1 85c7aae71c7ed65ba82100dd526520748d38f789
SHA512 b9a8366122a6314471b91a86b9514cd3d3ce13bc333ff245c96d37157c697c2588cf3022298de80365523092c4eeb1c2fa6d6da4ffe29e4fe528e55f0830da1f
TLSH
T1BD51054367EE1119F1F76B6CAEB720614AA7BD855D39C46D00AC240DCBF3E2285607B7
MD5 SHA1 SHA512 TLSH

Submit Download

xvuljP29.Kg43

Path C:\Users\Admin\Desktop\xvuljP29.Kg43
Size 416KB
SHA256 c36ed034d523da1f54d43176334d4bda9f9adcb940948646b43902a620ebda45
MD5 156f4a8f006779a3493d9d476f1e8dda
SHA1 c1b667b0ff98bbb1d2495b4fd5dda1eeca494799
SHA512 da674d456daec0f6bd41e1c62e0e74b1cc0e9269fe467e1ea90a5b15cd0d4505556634e1ce0ce962b61a94e7357d3f414628101a12cefa1d50a4ed38584e2200
SSDEEP 6144:lHF0VKkWrb4QC1uwzV3ohQU1d+/mN9peVHzsAyuWZGUf/Sdfy9103T7fms4AO5kP:lHF0VKkWrb4QDwR4QWdyzsAlWZBR8qM
TLSH
T186944B217813C032D66191721F79FFF685ADA8259B7109DB7BC40F769E202E26A31F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2672-0-0x00000000749F2000-0x00000000749F3000-memory.dmp

Download

memory/2672-1-0x0000000000B30000-0x0000000000B7E000-memory.dmp

Download

memory/2672-2-0x0000000005760000-0x00000000057D8000-memory.dmp

Download

memory/2672-3-0x0000000002F60000-0x0000000002F66000-memory.dmp

Download

memory/2672-4-0x00000000081B0000-0x000000000876A000-memory.dmp

Download

memory/2672-7-0x00000000749E0000-0x000000007519C000-memory.dmp

Download

memory/2672-12-0x00000000749E0000-0x000000007519C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads