amadey | 04ef642ea5f51c774c5f879827f989c5070efd2767c4d7d4022b1111ac6f7a94

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 22:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
10a320ba7543dcad47f4fef1c330f8c6.exe
Size 440KB
Sample261024-189e5sev7m
SHA256 04ef642ea5f51c774c5f879827f989c5070efd2767c4d7d4022b1111ac6f7a94
MD5 10a320ba7543dcad47f4fef1c330f8c6
SHA1 f9dcd5060a7d57b2b10e54f753af69c649e07bcf
SHA512 66a6c6d671d01e1c1fe4cf1a50518afa675b6b1029534fbacb0ddbc0f5da82fe1474a14ea66ecae3bb4881ed37927969044924af2965306a0b95410ead5358cd
SSDEEP 6144:EWgDaADwKk5dC6iI+KcjRr3lPeriztKjT1UXS+cnhUiAOxDTaVFh3pg:EWgDaADwKH971PerixehRkFh3pg
TLSH
T1A3A45B203857C032D66191B10E7AFFF695ADA8259B3109DBB7D40E779D202D26B31F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery amadey trojan

Malware Config

Extracted

Family

amadey

Version

5.92

http://193.178.158.107
http://196.251.107.186

Attributes

install_dir
17082f4eef
install_file
Wfeuilcmo.exe
strings_key
51ac028ab14af136529d7c2c3cc0f1b4
url_paths
/Bjsw3DlG1/index.php

/8jdjZhdf7/index.php

rc4.plain

Signatures

Family: Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Amadey x86-bit Payload 1 IoCs

resource	yara_rule
behavioral1/files/0x00180000000242da-3.dat	family_amadey_v2

Executes dropped EXE 3 IoCs

pid	Process
3192	synchost.exe
1508	synchost.exe
2516	synchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\synchost.job	synchost.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	synchost.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	synchost.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 3192	452	10a320ba7543dcad47f4fef1c330f8c6.exe	85

C:\Users\Admin\AppData\Local\Temp\10a320ba7543dcad47f4fef1c330f8c6.exe
"C:\Users\Admin\AppData\Local\Temp\10a320ba7543dcad47f4fef1c330f8c6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:452
- C:\Users\Admin\AppData\Roaming\synchost.exe
  "C:\Users\Admin\AppData\Roaming\synchost.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3192

C:\Users\Admin\AppData\Roaming\synchost.exe
C:\Users\Admin\AppData\Roaming\synchost.exe
1⤵
- Executes dropped EXE
PID:1508

C:\Users\Admin\AppData\Roaming\synchost.exe
C:\Users\Admin\AppData\Roaming\synchost.exe
1⤵
- Executes dropped EXE
PID:2516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

synchost.exe

Path C:\Users\Admin\AppData\Roaming\synchost.exe
Size 422KB
SHA256 88364b809237dd0f6698322c7361eeff373fff410c46bd55300e2b1047778b4a
MD5 60c0b2c5f67d19ee1929ed2734294678
SHA1 2e7a5a360c5b93b6edf055acc70b276fd7bbdc28
SHA512 706081aefb92017b2b7a0f518d82796e09072b4b1d2b451f120d8c252267a0e112a3caf37681a9c122ce37de6d392afa9922edf83de221f89c1807250a162388
SSDEEP 6144:1WgDaADwKk5dC6iI+KcjRr3lPeriztKjT1UXS+cnhUiAOxDTaVFh3pg:1WgDaADwKH971PerixehRkFh3pg
TLSH
T124945B203857C032D66191B10E7AFFF685ADA8259B7109DBB7D40E779D202D26B31F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download