amadey | 8ee1bd72fa98f361002dc3eb8225b2fcfa19d39dafdb3052e5d105d5b2eed56a

Analysis

max time kernel
148s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/09/2026, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_8ee1bd72fa98f361002dc3eb8225b2fcfa19d39dafdb3052e5d105d5b2eed56a.exe
Size 282KB
Sample260911-3pjfqagg46
SHA256 8ee1bd72fa98f361002dc3eb8225b2fcfa19d39dafdb3052e5d105d5b2eed56a
MD5 0a6302d0b7f3a1855443d8ace408563c
SHA1 1db0237d807392d69395894d408003a73031393a
SHA512 0d536a4249407b88fd80f9318cc0b78f90bb813affb06fd2540b018083e9901dd1e324182de51125efbc7bf106cca382a224ca833ac3973f5c3fe54aea4ca1d7
SSDEEP 6144:C4ebcfh1Z591bP/DAtM+oiIOjTlBR1EYdGnK+MihMYBOWnn:leb8h/bB7AW+9nlKMaKCroWnn
TLSH
T10A542219479EA770F717D9BF60FF90918520EF961954FA4F4849E82A23C232D445B38B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

fbf543 discovery execution amadey persistence trojan

Malware Config

Extracted

Family

amadey

Version

5.55

Botnet

fbf543

http://94.154.35.25

Attributes

install_dir
96a319e745
install_file
Srxelqcif.exe
strings_key
f8bfac017914b836f3106c5bcd0878fe
url_paths
/di9ku38f/index.php

rc4.plain

Signatures

Family: Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Amadey x86-bit Payload 2 IoCs

resource	yara_rule
behavioral2/memory/1704-2-0x0000000002600000-0x0000000002678000-memory.dmp	family_amadey_v2
behavioral2/files/0x001600000001c54f-8.dat	family_amadey_v2

Executes dropped EXE 2 IoCs

pid	Process
956	m9pQXgWL.EQAO
2804	m9pQXgWL.EQAO

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2872	icacls.exe
5080	icacls.exe
2464	icacls.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2932	cmd.exe
2820	cmd.exe
4260	cmd.exe
3316	cmd.exe
2128	cmd.exe
5084	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	m9pQXgWL.EQAO
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_8ee1bd72fa98f361002dc3eb8225b2fcfa19d39dafdb3052e5d105d5b2eed56a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6032	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1704	jaffacakes118_8ee1bd72fa98f361002dc3eb8225b2fcfa19d39dafdb3052e5d105d5b2eed56a.exe
Token: SeRestorePrivilege	5080	icacls.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 5084	1704	jaffacakes118_8ee1bd72fa98f361002dc3eb8225b2fcfa19d39dafdb3052e5d105d5b2eed56a.exe	86
PID 5084 wrote to memory of 5080	5084	cmd.exe	88
PID 1704 wrote to memory of 2932	1704	jaffacakes118_8ee1bd72fa98f361002dc3eb8225b2fcfa19d39dafdb3052e5d105d5b2eed56a.exe	89
PID 2932 wrote to memory of 2464	2932	cmd.exe	91
PID 1704 wrote to memory of 2820	1704	jaffacakes118_8ee1bd72fa98f361002dc3eb8225b2fcfa19d39dafdb3052e5d105d5b2eed56a.exe	92
PID 2820 wrote to memory of 2872	2820	cmd.exe	94
PID 1704 wrote to memory of 4260	1704	jaffacakes118_8ee1bd72fa98f361002dc3eb8225b2fcfa19d39dafdb3052e5d105d5b2eed56a.exe	95
PID 1704 wrote to memory of 3316	1704	jaffacakes118_8ee1bd72fa98f361002dc3eb8225b2fcfa19d39dafdb3052e5d105d5b2eed56a.exe	96
PID 3316 wrote to memory of 6032	3316	cmd.exe	99
PID 4260 wrote to memory of 956	4260	cmd.exe	100
PID 2128 wrote to memory of 2804	2128	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_8ee1bd72fa98f361002dc3eb8225b2fcfa19d39dafdb3052e5d105d5b2eed56a.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_8ee1bd72fa98f361002dc3eb8225b2fcfa19d39dafdb3052e5d105d5b2eed56a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c icacls "C:\Users\Admin\Desktop\m9pQXgWL.EQAO" /setowner "SYSTEM"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\Desktop\m9pQXgWL.EQAO" /setowner "SYSTEM"
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5080
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c icacls "C:\Users\Admin\Desktop\m9pQXgWL.EQAO" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\Desktop\m9pQXgWL.EQAO" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2464
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c icacls "C:\Users\Admin\Desktop\m9pQXgWL.EQAO" /remove:d Everyone Administrators
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\Desktop\m9pQXgWL.EQAO" /remove:d Everyone Administrators
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2872
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c start "" "C:\Users\Admin\Desktop\m9pQXgWL.EQAO"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Users\Admin\Desktop\m9pQXgWL.EQAO
    "C:\Users\Admin\Desktop\m9pQXgWL.EQAO"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:956
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "B7QOO6rF" /xml "C:\Users\Admin\AppData\Local\Temp\B7QOO6rF.xml" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "B7QOO6rF" /xml "C:\Users\Admin\AppData\Local\Temp\B7QOO6rF.xml" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6032

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5344

C:\Windows\system32\cmd.exe
"cmd.exe" /c start "" "C:\Users\Admin\Desktop\m9pQXgWL.EQAO"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Users\Admin\Desktop\m9pQXgWL.EQAO
  "C:\Users\Admin\Desktop\m9pQXgWL.EQAO"
  2⤵
  - Executes dropped EXE
  PID:2804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B7QOO6rF.xml

Path C:\Users\Admin\AppData\Local\Temp\B7QOO6rF.xml
Size 2KB
SHA256 edb6f56983eb59d190775e96ac188e2ca4164fd0c5e0e4763205fdffd0e2cc32
MD5 46da5e4f69e295a2ce2a0b94265f91dc
SHA1 901f1091e96675a9f0d1d5dc34f204e2f4d061ae
SHA512 8e45462c5d79456c7f2862e5191e3b8ac4340ca64c59db5aa8f837c135db219582f002e96f47cc81f1b6c3705459a2da87f71dd538b30712babf19f869aeb33c
TLSH
T1B651264367EE1109F1F7AB6CAEB720614AA7BD455D39C46D00AC240CCBF3E2285607B7
MD5 SHA1 SHA512 TLSH

Submit Download

m9pQXgWL.EQAO

Path C:\Users\Admin\Desktop\m9pQXgWL.EQAO
Size 416KB
SHA256 c36ed034d523da1f54d43176334d4bda9f9adcb940948646b43902a620ebda45
MD5 156f4a8f006779a3493d9d476f1e8dda
SHA1 c1b667b0ff98bbb1d2495b4fd5dda1eeca494799
SHA512 da674d456daec0f6bd41e1c62e0e74b1cc0e9269fe467e1ea90a5b15cd0d4505556634e1ce0ce962b61a94e7357d3f414628101a12cefa1d50a4ed38584e2200
SSDEEP 6144:lHF0VKkWrb4QC1uwzV3ohQU1d+/mN9peVHzsAyuWZGUf/Sdfy9103T7fms4AO5kP:lHF0VKkWrb4QDwR4QWdyzsAlWZBR8qM
TLSH
T186944B217813C032D66191721F79FFF685ADA8259B7109DB7BC40F769E202E26A31F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1704-0-0x00000000744C2000-0x00000000744C3000-memory.dmp

Download

memory/1704-1-0x0000000000160000-0x00000000001AC000-memory.dmp

Download

memory/1704-2-0x0000000002600000-0x0000000002678000-memory.dmp

Download

memory/1704-3-0x0000000002680000-0x0000000002686000-memory.dmp

Download

memory/1704-4-0x00000000077F0000-0x0000000007DAA000-memory.dmp

Download

memory/1704-7-0x00000000744B0000-0x0000000074C6C000-memory.dmp

Download

memory/1704-12-0x00000000744B0000-0x0000000074C6C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads