Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/10/2026, 07:16
Behavioral task
behavioral1
Sample
1b4779847164a3dbf7459ff95c29c6668a4d19024c9f31f5c878e041e94df1ec.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
General
- Target 1b4779847164a3dbf7459ff95c29c6668a4d19024c9f31f5c878e041e94df1ec.exe
- Size 11.9MB
- Sample261015-h33rasfs7k
- SHA256 1b4779847164a3dbf7459ff95c29c6668a4d19024c9f31f5c878e041e94df1ec
- MD5 6a8742a01286e799a0ad3d4b1114e678
- SHA1 5ca8ae10cfcdbdd3d3837220c6b00bb204e54212
- SHA512 08cec236dee28dffbc6e0e9d0fb63baab663a3f5c0f97f26e8f2118aaf9082cbc0120b4954c8896fa6b15560b1b73c8c225e125911fa25ee8e891ec74caabb78
- SSDEEP 196608:/oHx4dV+vTf6CDsUae7/EmDQG393q0uxhNxr5FTDzUt:f+eysQsmDQGt6pxT3FM
- TLSH T12DC6E086BAF7A29FC347DCF4C9D2ADAAE15A4BA05310472BE878B037F71251D01D164B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
amadey
Version
-
4.13
Botnet
-
bd4155
C2
-
http://185.172.128.5
Attributes
-
install_dir
4fdb51ccdc
-
install_file
Utsysc.exe
-
strings_key
11bb398ff31ee80d2c37571aecd1d36d
-
url_paths
/v8sjh3hs8/index.php
rc4.plain
Signatures
- Detects Amadey x86-bit Payload 1 IoCs
resource yara_rule behavioral2/memory/4276-0-0x0000000000400000-0x0000000000FDF000-memory.dmp family_amadey_v2 - Program crash 1 IoCs
pid pid_target Process procid_target 4528 4276 WerFault.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b4779847164a3dbf7459ff95c29c6668a4d19024c9f31f5c878e041e94df1ec.exe"C:\Users\Admin\AppData\Local\Temp\1b4779847164a3dbf7459ff95c29c6668a4d19024c9f31f5c878e041e94df1ec.exe"1⤵PID:4276
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 2242⤵
- Program crash
PID:4528
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4276 -ip 42761⤵PID:1216