| File name: | 2025-05-18_b672fbd389b94bf5449ceafe32346037_amadey_black-basta_cobalt-strike_elex_luca-stealer_smoke-loader |
| Full analysis: | https://app.any.run/tasks/fe3b240c-66f8-47e4-9132-07828f04bccc |
| Verdict: | Malicious activity |
| Threats: | Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks. |
| Analysis date: | May 18, 2025, 13:34:44 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections |
| MD5: | B672FBD389B94BF5449CEAFE32346037 |
| SHA1: | 5380630E67ED935A0E0ACA94DC88ECEECD0BDC38 |
| SHA256: | 2106190991EFC4291F4211DD54DDB7444E7BF51503842A1380A4A1D902D888B6 |
| SSDEEP: | 6144:AJEGTYya7Ad20rxuTwKEA2lLlB1HM6TSg6M09HWthx:zyyALQkKEAQxB1s6+g6Pyx |
| .exe | | | Win64 Executable (generic) (64.6) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (15.4) |
| .exe | | | Win32 Executable (generic) (10.5) |
| .exe | | | Generic Win/DOS Executable (4.6) |
| .exe | | | DOS Executable Generic (4.6) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2025:05:17 14:31:58+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14.29 |
| CodeSize: | 317952 |
| InitializedDataSize: | 123392 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x28c3a |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1040 | "C:\Users\admin\AppData\Local\Temp\56e51a1e3a\nudwee.exe" | C:\Users\admin\AppData\Local\Temp\56e51a1e3a\nudwee.exe | — | svchost.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 4560 | "C:\Users\admin\Desktop\2025-05-18_b672fbd389b94bf5449ceafe32346037_amadey_black-basta_cobalt-strike_elex_luca-stealer_smoke-loader.exe" | C:\Users\admin\Desktop\2025-05-18_b672fbd389b94bf5449ceafe32346037_amadey_black-basta_cobalt-strike_elex_luca-stealer_smoke-loader.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 4652 | "C:\Users\admin\AppData\Local\Temp\56e51a1e3a\nudwee.exe" | C:\Users\admin\AppData\Local\Temp\56e51a1e3a\nudwee.exe | — | svchost.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 4736 | "C:\Users\admin\AppData\Local\Temp\56e51a1e3a\nudwee.exe" | C:\Users\admin\AppData\Local\Temp\56e51a1e3a\nudwee.exe | — | svchost.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 5344 | "C:\Users\admin\AppData\Local\Temp\56e51a1e3a\nudwee.exe" | C:\Users\admin\AppData\Local\Temp\56e51a1e3a\nudwee.exe | 2025-05-18_b672fbd389b94bf5449ceafe32346037_amadey_black-basta_cobalt-strike_elex_luca-stealer_smoke-loader.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
Amadey(PID) Process(5344) nudwee.exe C2185.156.72.8 URLhttp://185.156.72.8/rob75u9v/index.php Version5.34 Options Drop directory56e51a1e3a Drop namenudwee.exe Strings (125)lv: msi Kaspersky Lab av: | # nudwee.exe " \App 00000422 dm: Powershell.exe ProgramData\ ps1 rundll32 http:// Content-Disposition: form-data; name="data"; filename=" SOFTWARE\Microsoft\Windows NT\CurrentVersion dll SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders id: VideoID cred.dll|clip.dll| 0000043f cmd 00000423 SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName 185.156.72.8 -executionpolicy remotesigned -File " 2022 ------ 2016 og: \0000 CurrentBuild 2019 ::: S-%lu- " && timeout 1 && del ProductName Panda Security ESET SOFTWARE\Microsoft\Windows\CurrentVersion\Run /k +++ ?scr=1 Doctor Web GET SYSTEM\ControlSet001\Services\BasicDisplay\Video /quiet .jpg vs: sd: rundll32.exe "taskkill /f /im " pc: random = 360TotalSecurity <d> wb Content-Type: multipart/form-data; boundary=---- Startup Norton && Exit" os: https:// SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /rob75u9v/index.php 2025 Avira %-lu zip POST "
Content-Type: application/octet-stream Rem ------ 5.34 <c> clip.dll AVAST Software \ shell32.dll " && ren e3 kernel32.dll DefaultSettings.XResolution d1 DefaultSettings.YResolution r= cred.dll -- GetNativeSystemInfo -%lu ComputerName &unit= Keyboard Layout\Preload SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders ar: Sophos %USERPROFILE% exe e1 e2 st=s Programs 0123456789 un: rb bi: abcdefghijklmnopqrstuvwxyz0123456789-_ SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\ cmd /C RMDIR /s/q Bitdefender -unicode- AVG WinDefender && 56e51a1e3a shutdown -s -t 0 Comodo 00000419 Content-Type: application/x-www-form-urlencoded /Plugins/ Main | |||||||||||||||
| 5400 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| (PID) Process: | (5344) nudwee.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (5344) nudwee.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (5344) nudwee.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4560 | 2025-05-18_b672fbd389b94bf5449ceafe32346037_amadey_black-basta_cobalt-strike_elex_luca-stealer_smoke-loader.exe | C:\Windows\Tasks\nudwee.job | binary | |
MD5:F7825F3E5488493A2AA913E203DA3C5F | SHA256:4A6FC225758416081E6A6A4127AAAAA360EC7B284131796A392C935BD4DB70C3 | |||
| 4560 | 2025-05-18_b672fbd389b94bf5449ceafe32346037_amadey_black-basta_cobalt-strike_elex_luca-stealer_smoke-loader.exe | C:\Users\admin\AppData\Local\Temp\56e51a1e3a\nudwee.exe | executable | |
MD5:B672FBD389B94BF5449CEAFE32346037 | SHA256:2106190991EFC4291F4211DD54DDB7444E7BF51503842A1380A4A1D902D888B6 | |||
| 5344 | nudwee.exe | C:\Users\admin\AppData\Local\Temp\693682860607 | binary | |
MD5:EE0108E2F703FA73A16258FDFFEC7ED4 | SHA256:AF4B8ED4353763307C7641BC674B9071FDE51E6E46B093A5675A184775D36E67 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2104 | svchost.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
2516 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl | unknown | — | — | whitelisted |
5344 | nudwee.exe | POST | 200 | 185.156.72.8:80 | http://185.156.72.8/rob75u9v/index.php | unknown | — | — | malicious |
2516 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl | unknown | — | — | whitelisted |
5344 | nudwee.exe | GET | 403 | 185.156.72.8:80 | http://185.156.72.8/rob75u9v/Plugins/clip64.dll | unknown | — | — | malicious |
2104 | svchost.exe | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5344 | nudwee.exe | POST | 200 | 185.156.72.8:80 | http://185.156.72.8/rob75u9v/index.php | unknown | — | — | malicious |
5344 | nudwee.exe | POST | 200 | 185.156.72.8:80 | http://185.156.72.8/rob75u9v/index.php | unknown | — | — | malicious |
5344 | nudwee.exe | GET | 403 | 185.156.72.8:80 | http://185.156.72.8/px.exe | unknown | — | — | malicious |
5344 | nudwee.exe | GET | 403 | 185.156.72.8:80 | http://185.156.72.8/cx.exe | unknown | — | — | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2104 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4024 | RUXIMICS.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2104 | svchost.exe | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
2104 | svchost.exe | 23.35.229.160:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
3216 | svchost.exe | 172.211.123.249:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
5344 | nudwee.exe | 185.156.72.8:80 | — | Tov Vaiz Partner | RU | malicious |
6544 | svchost.exe | 20.190.160.66:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |
nexusrules.officeapps.live.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
5344 | nudwee.exe | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s) |
5344 | nudwee.exe | Malware Command and Control Activity Detected | ET MALWARE Amadey CnC Response |
5344 | nudwee.exe | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |
5344 | nudwee.exe | Potentially Bad Traffic | ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile |
5344 | nudwee.exe | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |
5344 | nudwee.exe | Potentially Bad Traffic | ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile |
5344 | nudwee.exe | A Network Trojan was detected | ET MALWARE Amadey Bot Activity (POST) M1 |
5344 | nudwee.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 7 |
5344 | nudwee.exe | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |
5344 | nudwee.exe | Potentially Bad Traffic | ET INFO Dotted Quad Host DLL Request |