amadey | 1c2bd1425fb37d4ec88f7a698b77797325f771a6acc60f9cee0fa94d68d04296

Analysis

max time kernel
148s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/09/2026, 23:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_1c2bd1425fb37d4ec88f7a698b77797325f771a6acc60f9cee0fa94d68d04296.exe
Size 287KB
Sample260911-3pcm6sgg39
SHA256 1c2bd1425fb37d4ec88f7a698b77797325f771a6acc60f9cee0fa94d68d04296
MD5 bf6c000315c029b36d11ed6a3dd11ad7
SHA1 6133ee86588e1fcbc2226234b13884e0322282f6
SHA512 8d756cd907e6c97a716eaf98c7f9b1687b76e546fefb9ab8dabb54bd164fecae6167d1d8db96a560c8b3906be23eb6b3312ad9d33bc8dde405e1397c7b9f398f
SSDEEP 6144:CJ9D0zOK5BMEeGGhQhh7prewkkJP1IKjxfB9oJEj2qJzbxuL89vy:Cj382EZGCz7pawkGPK2B9+EyYzVdvy
TLSH
T14354122F8D9EC87AEF6D56BEFA20150C93331E744D90C28B8D5D818E9E34EC6911562B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

fbf543 discovery execution amadey persistence trojan

Malware Config

Extracted

Family

amadey

Version

5.55

Botnet

fbf543

http://94.154.35.25

Attributes

install_dir
96a319e745
install_file
Srxelqcif.exe
strings_key
f8bfac017914b836f3106c5bcd0878fe
url_paths
/di9ku38f/index.php

rc4.plain

Signatures

Family: Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Amadey x86-bit Payload 2 IoCs

resource	yara_rule
behavioral2/memory/5612-2-0x0000000005820000-0x0000000005898000-memory.dmp	family_amadey_v2
behavioral2/files/0x000e00000001c4c8-8.dat	family_amadey_v2

Executes dropped EXE 2 IoCs

pid	Process
2476	GmU595iU.b6Alt
4616	GmU595iU.b6Alt

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4116	icacls.exe
3004	icacls.exe
1772	icacls.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1872	cmd.exe
2460	cmd.exe
1124	cmd.exe
4144	cmd.exe
5696	cmd.exe
3292	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GmU595iU.b6Alt
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_1c2bd1425fb37d4ec88f7a698b77797325f771a6acc60f9cee0fa94d68d04296.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
576	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5612	jaffacakes118_1c2bd1425fb37d4ec88f7a698b77797325f771a6acc60f9cee0fa94d68d04296.exe
Token: SeRestorePrivilege	4116	icacls.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5612 wrote to memory of 3292	5612	jaffacakes118_1c2bd1425fb37d4ec88f7a698b77797325f771a6acc60f9cee0fa94d68d04296.exe	86
PID 3292 wrote to memory of 4116	3292	cmd.exe	88
PID 5612 wrote to memory of 1872	5612	jaffacakes118_1c2bd1425fb37d4ec88f7a698b77797325f771a6acc60f9cee0fa94d68d04296.exe	89
PID 1872 wrote to memory of 3004	1872	cmd.exe	91
PID 5612 wrote to memory of 2460	5612	jaffacakes118_1c2bd1425fb37d4ec88f7a698b77797325f771a6acc60f9cee0fa94d68d04296.exe	92
PID 2460 wrote to memory of 1772	2460	cmd.exe	94
PID 5612 wrote to memory of 1124	5612	jaffacakes118_1c2bd1425fb37d4ec88f7a698b77797325f771a6acc60f9cee0fa94d68d04296.exe	95
PID 5612 wrote to memory of 4144	5612	jaffacakes118_1c2bd1425fb37d4ec88f7a698b77797325f771a6acc60f9cee0fa94d68d04296.exe	97
PID 4144 wrote to memory of 576	4144	cmd.exe	99
PID 1124 wrote to memory of 2476	1124	cmd.exe	100
PID 5696 wrote to memory of 4616	5696	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1c2bd1425fb37d4ec88f7a698b77797325f771a6acc60f9cee0fa94d68d04296.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1c2bd1425fb37d4ec88f7a698b77797325f771a6acc60f9cee0fa94d68d04296.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5612
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c icacls "C:\Users\Admin\Desktop\GmU595iU.b6Alt" /setowner "SYSTEM"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\Desktop\GmU595iU.b6Alt" /setowner "SYSTEM"
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4116
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c icacls "C:\Users\Admin\Desktop\GmU595iU.b6Alt" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\Desktop\GmU595iU.b6Alt" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:3004
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c icacls "C:\Users\Admin\Desktop\GmU595iU.b6Alt" /remove:d Everyone Administrators
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\Desktop\GmU595iU.b6Alt" /remove:d Everyone Administrators
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:1772
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c start "" "C:\Users\Admin\Desktop\GmU595iU.b6Alt"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Users\Admin\Desktop\GmU595iU.b6Alt
    "C:\Users\Admin\Desktop\GmU595iU.b6Alt"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2476
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "6LNbGfXV" /xml "C:\Users\Admin\AppData\Local\Temp\6LNbGfXV.xml" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "6LNbGfXV" /xml "C:\Users\Admin\AppData\Local\Temp\6LNbGfXV.xml" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:576

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:3704

C:\Windows\system32\cmd.exe
"cmd.exe" /c start "" "C:\Users\Admin\Desktop\GmU595iU.b6Alt"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5696
- C:\Users\Admin\Desktop\GmU595iU.b6Alt
  "C:\Users\Admin\Desktop\GmU595iU.b6Alt"
  2⤵
  - Executes dropped EXE
  PID:4616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6LNbGfXV.xml

Path C:\Users\Admin\AppData\Local\Temp\6LNbGfXV.xml
Size 2KB
SHA256 7a1a609498f80e8f7370f8b752ae95efe20b5f38a9434bc35f054f53924312ce
MD5 23ef9b07a8fbb292b298a82665ee3740
SHA1 95ae935ae86807a4427a9cab7749b51f156c00a2
SHA512 1f105fce5dde88c4e3229bf7834d63e59ab0e8847a9db72422fe26dc78a5f13a690f77570204ad14644f0c42a0324d41aec4e62f7a535f63c237157bb9bd8010
TLSH
T16051154367EE1109F1F76B6CAEB764614AA7BD455D39C46D00AC240CCBF3E2285607B7
MD5 SHA1 SHA512 TLSH

Submit Download

GmU595iU.b6Alt

Path C:\Users\Admin\Desktop\GmU595iU.b6Alt
Size 416KB
SHA256 c36ed034d523da1f54d43176334d4bda9f9adcb940948646b43902a620ebda45
MD5 156f4a8f006779a3493d9d476f1e8dda
SHA1 c1b667b0ff98bbb1d2495b4fd5dda1eeca494799
SHA512 da674d456daec0f6bd41e1c62e0e74b1cc0e9269fe467e1ea90a5b15cd0d4505556634e1ce0ce962b61a94e7357d3f414628101a12cefa1d50a4ed38584e2200
SSDEEP 6144:lHF0VKkWrb4QC1uwzV3ohQU1d+/mN9peVHzsAyuWZGUf/Sdfy9103T7fms4AO5kP:lHF0VKkWrb4QDwR4QWdyzsAlWZBR8qM
TLSH
T186944B217813C032D66191721F79FFF685ADA8259B7109DB7BC40F769E202E26A31F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5612-0-0x00000000750E2000-0x00000000750E3000-memory.dmp

Download

memory/5612-1-0x0000000000E60000-0x0000000000EAE000-memory.dmp

Download

memory/5612-2-0x0000000005820000-0x0000000005898000-memory.dmp

Download

memory/5612-3-0x0000000001880000-0x0000000001886000-memory.dmp

Download

memory/5612-4-0x00000000083B0000-0x000000000896A000-memory.dmp

Download

memory/5612-7-0x00000000750D0000-0x000000007588C000-memory.dmp

Download

memory/5612-12-0x00000000750D0000-0x000000007588C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads