amadey | 5d4379e7b27743026e343ae19225006d898f236bc074a5d5755fcba1dcac07ff

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 08:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_ae082b0de32a082a7882e510ac1a9f53_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 286KB
Sample260930-kk2sdsba62
SHA256 5d4379e7b27743026e343ae19225006d898f236bc074a5d5755fcba1dcac07ff
MD5 ae082b0de32a082a7882e510ac1a9f53
SHA1 4a43bf9a7519403d13d049d9eff8a46df9e0ba2c
SHA512 058880567eba5f97c421c6b679130079b9814095a45ede6ec7974ad1c44fe50b43b3c5d587a84b8d644c8d5bf38d5c6d0eae4b659fdea142e3af400f3cc31d2a
SSDEEP 6144:wTZQcxA3Qj3FIcKekO3UEijfxZSDtCQyx9Tz/JPzi0:8Z3v3FIcKbEilqtCLtJP
TLSH
T12254BE20BAA0C035E0B712F8597983B8B82D7AB15B3491CB62D616FE67346E4DC31797
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery amadey trojan

Malware Config

Signatures

Family: Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Amadey x86-bit Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1560-2-0x00000000007B0000-0x00000000007E3000-memory.dmp	family_amadey_v2

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4624	1560	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_ae082b0de32a082a7882e510ac1a9f53_amadey_elex_rhadamanthys_smoke-loader_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-30_ae082b0de32a082a7882e510ac1a9f53_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_ae082b0de32a082a7882e510ac1a9f53_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 272
  2⤵
  - Program crash
  PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1560 -ip 1560
1⤵
PID:3264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1560-1-0x00000000005D0000-0x00000000006D0000-memory.dmp

Download

memory/1560-2-0x00000000007B0000-0x00000000007E3000-memory.dmp