amadey | 0ae2042ebd0a6be3774e1551435b7f12571974c54996cf34a97838af9740c473

Analysis

max time kernel
148s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 10:46

Target
jaffacakes118_0ae2042ebd0a6be3774e1551435b7f12571974c54996cf34a97838af9740c473.exe
Size 353KB
Sample260912-mtxwxaxtev
SHA256 0ae2042ebd0a6be3774e1551435b7f12571974c54996cf34a97838af9740c473
MD5 a04d6daa0ea1cbd0ccd6aa5725ee3b76
SHA1 ce0cf26c60c8a6ccffa71f851a3ac0c14f6d9681
SHA512 5f74e3d9dae5c4d54c480a5e56f36770d2322c05af91e8c7463435b9d3fa4429bef6d97b6a70e367383d8e0b1f1246a1bc0964a6152c032f0f819fca9db2498f
SSDEEP 6144:X3v0h16ucu2HJ+6LV4Y5JSN8ti0l4jdREqtaJEEVHhTBWGzKtyVb:8hLcEgV4Y5JSNaiHdREqtSEEZSPtyV
TLSH
T1447412F2DFD8ECE8C5F183FCC72A5925D229EA89160D54C3E9D2BF138806A4891D58D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Amadey x86-bit Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4952-1-0x0000000140000000-0x000000014008C000-memory.dmp	family_amadey_v2

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\NVDL_2.sys	jaffacakes118_0ae2042ebd0a6be3774e1551435b7f12571974c54996cf34a97838af9740c473.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1268	sc.exe
2724	sc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

pid	Process
2340	cmd.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
824	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	4952	jaffacakes118_0ae2042ebd0a6be3774e1551435b7f12571974c54996cf34a97838af9740c473.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 1268	4952	jaffacakes118_0ae2042ebd0a6be3774e1551435b7f12571974c54996cf34a97838af9740c473.exe	86
PID 4952 wrote to memory of 2724	4952	jaffacakes118_0ae2042ebd0a6be3774e1551435b7f12571974c54996cf34a97838af9740c473.exe	88
PID 4952 wrote to memory of 2340	4952	jaffacakes118_0ae2042ebd0a6be3774e1551435b7f12571974c54996cf34a97838af9740c473.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0ae2042ebd0a6be3774e1551435b7f12571974c54996cf34a97838af9740c473.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0ae2042ebd0a6be3774e1551435b7f12571974c54996cf34a97838af9740c473.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\SYSTEM32\sc.exe
  sc delete NVDL_2 > NUL 2>&1
  2⤵
  - Launches sc.exe
  PID:1268
- C:\Windows\SYSTEM32\sc.exe
  sc create NVDL_2 type= kernel start= demand error= normal binPath= "\??\C:\Windows\System32\drivers\NVDL_2.sys" DisplayName= "NVIDIA Graphics Adapter" > NUL 2>&1
  2⤵
  - Launches sc.exe
  PID:2724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - Executes a command shell one-liner
  PID:2340