amadey | 6e285b78792f06c15e4832c830670af1f06caa3d32c5d2ec4489d2e24fd04d93

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/09/2026, 23:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_6e285b78792f06c15e4832c830670af1f06caa3d32c5d2ec4489d2e24fd04d93.exe
Size 285KB
Sample260911-3qcdssgg67
SHA256 6e285b78792f06c15e4832c830670af1f06caa3d32c5d2ec4489d2e24fd04d93
MD5 25e8d65bda47d864282d4f7b17a12ac7
SHA1 bfa92d16bfd558ce6816673d1b3aafde8b3d2ae3
SHA512 2fa5ea5d21c93112fec16e297f24591e22e3e868e55cc50f7f6b079cc1d376b986cb88bd2cf18416574a2e9555afafde4dcd5d24c5bc4d8aefb47cf7c3721b3d
SSDEEP 6144:QD0eyA56WrZmsFQ1vt1JMZAn7XhCCs2H1tG3RXMMSzsTdU2xlO6y:QIPA5HLst1mAnrMTY+NLSwa2nC
TLSH
T100542222EAFDA637C90690FD4601506A47E6B231D225F69F7DD132676CC2FD60C2AA13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

fbf543 discovery execution amadey persistence trojan

Malware Config

Extracted

Family

amadey

Version

5.55

Botnet

fbf543

http://94.154.35.25

Attributes

install_dir
96a319e745
install_file
Srxelqcif.exe
strings_key
f8bfac017914b836f3106c5bcd0878fe
url_paths
/di9ku38f/index.php

rc4.plain

Signatures

Family: Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Amadey x86-bit Payload 2 IoCs

resource	yara_rule
behavioral2/memory/3320-2-0x0000000007650000-0x00000000076C8000-memory.dmp	family_amadey_v2
behavioral2/files/0x001100000001c4d7-8.dat	family_amadey_v2

Executes dropped EXE 2 IoCs

pid	Process
1352	8Rg9O5Yv.K9v2k
5832	8Rg9O5Yv.K9v2k

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4504	icacls.exe
4908	icacls.exe
2300	icacls.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4964	cmd.exe
4144	cmd.exe
2272	cmd.exe
4576	cmd.exe
4276	cmd.exe
460	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8Rg9O5Yv.K9v2k
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_6e285b78792f06c15e4832c830670af1f06caa3d32c5d2ec4489d2e24fd04d93.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5716	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3320	jaffacakes118_6e285b78792f06c15e4832c830670af1f06caa3d32c5d2ec4489d2e24fd04d93.exe
Token: SeRestorePrivilege	4504	icacls.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 4964	3320	jaffacakes118_6e285b78792f06c15e4832c830670af1f06caa3d32c5d2ec4489d2e24fd04d93.exe	86
PID 4964 wrote to memory of 4504	4964	cmd.exe	88
PID 3320 wrote to memory of 4144	3320	jaffacakes118_6e285b78792f06c15e4832c830670af1f06caa3d32c5d2ec4489d2e24fd04d93.exe	89
PID 4144 wrote to memory of 4908	4144	cmd.exe	91
PID 3320 wrote to memory of 2272	3320	jaffacakes118_6e285b78792f06c15e4832c830670af1f06caa3d32c5d2ec4489d2e24fd04d93.exe	92
PID 2272 wrote to memory of 2300	2272	cmd.exe	94
PID 3320 wrote to memory of 4576	3320	jaffacakes118_6e285b78792f06c15e4832c830670af1f06caa3d32c5d2ec4489d2e24fd04d93.exe	95
PID 3320 wrote to memory of 4276	3320	jaffacakes118_6e285b78792f06c15e4832c830670af1f06caa3d32c5d2ec4489d2e24fd04d93.exe	96
PID 4276 wrote to memory of 5716	4276	cmd.exe	99
PID 4576 wrote to memory of 1352	4576	cmd.exe	100
PID 460 wrote to memory of 5832	460	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6e285b78792f06c15e4832c830670af1f06caa3d32c5d2ec4489d2e24fd04d93.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6e285b78792f06c15e4832c830670af1f06caa3d32c5d2ec4489d2e24fd04d93.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c icacls "C:\Users\Admin\Desktop\8Rg9O5Yv.K9v2k" /setowner "SYSTEM"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\Desktop\8Rg9O5Yv.K9v2k" /setowner "SYSTEM"
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4504
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c icacls "C:\Users\Admin\Desktop\8Rg9O5Yv.K9v2k" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\Desktop\8Rg9O5Yv.K9v2k" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4908
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c icacls "C:\Users\Admin\Desktop\8Rg9O5Yv.K9v2k" /remove:d Everyone Administrators
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\Desktop\8Rg9O5Yv.K9v2k" /remove:d Everyone Administrators
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2300
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c start "" "C:\Users\Admin\Desktop\8Rg9O5Yv.K9v2k"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Users\Admin\Desktop\8Rg9O5Yv.K9v2k
    "C:\Users\Admin\Desktop\8Rg9O5Yv.K9v2k"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1352
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "OKq1UsWj" /xml "C:\Users\Admin\AppData\Local\Temp\OKq1UsWj.xml" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "OKq1UsWj" /xml "C:\Users\Admin\AppData\Local\Temp\OKq1UsWj.xml" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5716

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4848

C:\Windows\system32\cmd.exe
"cmd.exe" /c start "" "C:\Users\Admin\Desktop\8Rg9O5Yv.K9v2k"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:460
- C:\Users\Admin\Desktop\8Rg9O5Yv.K9v2k
  "C:\Users\Admin\Desktop\8Rg9O5Yv.K9v2k"
  2⤵
  - Executes dropped EXE
  PID:5832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OKq1UsWj.xml

Path C:\Users\Admin\AppData\Local\Temp\OKq1UsWj.xml
Size 2KB
SHA256 24b1da37eb8f721ab3cc3229db6fdb6ade3f2531cf8d3b69473d0621256f0bc4
MD5 7100ebdc441ab9375246e4f9a59749f0
SHA1 765f532bb470be6b6dc2a09582aecba43bdb5db5
SHA512 805ffa841d2fe5d05d6a07138d5c9875b830215f09999eb8af7f5e0bee0b3cbb4c0f5632c5b32d3f432be68fb49e0a417caa1be60a072bbcbf9549d89e69fd71
TLSH
T1C751274367EE1109F1F7AB6CAEB710614AA7BD855D39C46D00AC240CCBF3E2289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

8Rg9O5Yv.K9v2k

Path C:\Users\Admin\Desktop\8Rg9O5Yv.K9v2k
Size 416KB
SHA256 c36ed034d523da1f54d43176334d4bda9f9adcb940948646b43902a620ebda45
MD5 156f4a8f006779a3493d9d476f1e8dda
SHA1 c1b667b0ff98bbb1d2495b4fd5dda1eeca494799
SHA512 da674d456daec0f6bd41e1c62e0e74b1cc0e9269fe467e1ea90a5b15cd0d4505556634e1ce0ce962b61a94e7357d3f414628101a12cefa1d50a4ed38584e2200
SSDEEP 6144:lHF0VKkWrb4QC1uwzV3ohQU1d+/mN9peVHzsAyuWZGUf/Sdfy9103T7fms4AO5kP:lHF0VKkWrb4QDwR4QWdyzsAlWZBR8qM
TLSH
T186944B217813C032D66191721F79FFF685ADA8259B7109DB7BC40F769E202E26A31F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3320-0-0x00000000747F2000-0x00000000747F3000-memory.dmp

Download

memory/3320-1-0x0000000000820000-0x000000000086E000-memory.dmp

Download

memory/3320-2-0x0000000007650000-0x00000000076C8000-memory.dmp

Download

memory/3320-3-0x0000000002AD0000-0x0000000002AD6000-memory.dmp

Download

memory/3320-4-0x0000000007CE0000-0x000000000829A000-memory.dmp

Download

memory/3320-7-0x00000000747E0000-0x0000000074F9C000-memory.dmp

Download

memory/3320-12-0x00000000747E0000-0x0000000074F9C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads