| File name: | _3907a88fa142d0fc99be51a4421fb0558a6ba960c1a614d839f6f4f173a336f9.exe |
| Full analysis: | https://app.any.run/tasks/831de96c-0cfb-4ecd-9cf4-04446dfa0c03 |
| Verdict: | Malicious activity |
| Threats: | Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks. |
| Analysis date: | May 27, 2026, 23:19:04 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 6 sections |
| MD5: | 950231C031E667B92B11FE26D5FAA0ED |
| SHA1: | 70C489B43AB0AD103815F55A470F04369D96192D |
| SHA256: | 3907A88FA142D0FC99BE51A4421FB0558A6BA960C1A614D839F6F4F173A336F9 |
| SSDEEP: | 49152:IfKs6r4NOVd64XjYAo1SYT/ltMNrYWv38kmz91uhJkz1tfXOT2KXqZdmkhrZ8xTD:pY4XjYAo1SYT/lW1dm51uhJkz1lX1yqc |
MALICIOUS
Executing a file with an untrusted certificate
- Bwale.exe (PID: 8984)
- Bwale.exe (PID: 8224)
- Bwale.exe (PID: 3108)
AMADEY has been detected (SURICATA)
- Bwale.exe (PID: 8984)
SUSPICIOUS
Executable content was dropped or overwritten
- _3907a88fa142d0fc99be51a4421fb0558a6ba960c1a614d839f6f4f173a336f9.exe (PID: 4608)
Starts itself from another location
- _3907a88fa142d0fc99be51a4421fb0558a6ba960c1a614d839f6f4f173a336f9.exe (PID: 4608)
Contacting a server suspected of hosting an CnC
- Bwale.exe (PID: 8984)
The process executes via Task Scheduler
- Bwale.exe (PID: 8224)
- Bwale.exe (PID: 3108)
INFO
Checks supported languages
- _3907a88fa142d0fc99be51a4421fb0558a6ba960c1a614d839f6f4f173a336f9.exe (PID: 4608)
- Bwale.exe (PID: 8984)
- Bwale.exe (PID: 8224)
- Bwale.exe (PID: 3108)
Reads security settings of Internet Explorer
- _3907a88fa142d0fc99be51a4421fb0558a6ba960c1a614d839f6f4f173a336f9.exe (PID: 4608)
- Bwale.exe (PID: 8984)
Reads the computer name
- _3907a88fa142d0fc99be51a4421fb0558a6ba960c1a614d839f6f4f173a336f9.exe (PID: 4608)
- Bwale.exe (PID: 8984)
Create files in a temporary directory
- _3907a88fa142d0fc99be51a4421fb0558a6ba960c1a614d839f6f4f173a336f9.exe (PID: 4608)
Process checks computer location settings
- _3907a88fa142d0fc99be51a4421fb0558a6ba960c1a614d839f6f4f173a336f9.exe (PID: 4608)
Application based on Golang
- Bwale.exe (PID: 8984)
There is functionality for taking screenshot (YARA)
- Bwale.exe (PID: 8984)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (76.4) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (12.5) |
| .exe | | | Generic Win/DOS Executable (5.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 0000:00:00 00:00:00 |
| ImageFileCharacteristics: | Executable, 32-bit, No debug |
| PEType: | PE32 |
| LinkerVersion: | 3 |
| CodeSize: | 560640 |
| InitializedDataSize: | 86528 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x5cf00 |
| OSVersion: | 6.1 |
| ImageVersion: | 1 |
| SubsystemVersion: | 6.1 |
| Subsystem: | Windows GUI |
Total processes
155
Monitored processes
5
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 3108 | "C:\Users\admin\AppData\Local\Temp\adb7f46c0c\Bwale.exe" | C:\Users\admin\AppData\Local\Temp\adb7f46c0c\Bwale.exe | — | svchost.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 4608 | "C:\Users\admin\Desktop\_3907a88fa142d0fc99be51a4421fb0558a6ba960c1a614d839f6f4f173a336f9.exe" | C:\Users\admin\Desktop\_3907a88fa142d0fc99be51a4421fb0558a6ba960c1a614d839f6f4f173a336f9.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 7816 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 8224 | "C:\Users\admin\AppData\Local\Temp\adb7f46c0c\Bwale.exe" | C:\Users\admin\AppData\Local\Temp\adb7f46c0c\Bwale.exe | — | svchost.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 8984 | "C:\Users\admin\AppData\Local\Temp\adb7f46c0c\Bwale.exe" | C:\Users\admin\AppData\Local\Temp\adb7f46c0c\Bwale.exe | _3907a88fa142d0fc99be51a4421fb0558a6ba960c1a614d839f6f4f173a336f9.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
Total events
4 514
Read events
4 510
Write events
4
Delete events
0
Modification events
| (PID) Process: | (7816) slui.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\3d\52C64B7E |
| Operation: | write | Name: | @%SystemRoot%\System32\sppcomapi.dll,-3200 |
Value: Software Licensing | |||
| (PID) Process: | (8984) Bwale.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (8984) Bwale.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (8984) Bwale.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
Executable files
1
Suspicious files
1
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4608 | _3907a88fa142d0fc99be51a4421fb0558a6ba960c1a614d839f6f4f173a336f9.exe | C:\Windows\Tasks\Bwale.job | binary | |
MD5:1485C06518B218A3285CEA7D31B9CCAF | SHA256:0B745779A753B8B9B1CF9E7E2B3B9CFB96A21FE5785DA5FD523B720886C425DA | |||
| 4608 | _3907a88fa142d0fc99be51a4421fb0558a6ba960c1a614d839f6f4f173a336f9.exe | C:\Users\admin\AppData\Local\Temp\adb7f46c0c\Bwale.exe | executable | |
MD5:950231C031E667B92B11FE26D5FAA0ED | SHA256:3907A88FA142D0FC99BE51A4421FB0558A6BA960C1A614D839F6F4F173A336F9 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
21
DNS requests
7
Threats
3
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3340 | svchost.exe | GET | 200 | 23.216.77.6:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | NL | binary | 825 b | whitelisted |
3340 | svchost.exe | GET | 200 | 23.52.181.212:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | US | binary | 814 b | whitelisted |
5276 | MoUsoCoreWorker.exe | GET | 200 | 23.52.181.212:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | US | binary | 814 b | whitelisted |
7816 | slui.exe | POST | 503 | 48.192.1.64:443 | https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail | US | — | — | whitelisted |
7816 | slui.exe | POST | 503 | 48.192.1.64:443 | https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail | US | html | 190 b | whitelisted |
8984 | Bwale.exe | POST | 200 | 91.92.242.236:80 | http://91.92.242.236/oPvjr94jfe/index.php | SC | text | 9 b | malicious |
8984 | Bwale.exe | POST | 200 | 91.92.242.236:80 | http://91.92.242.236/oPvjr94jfe/index.php | SC | text | 7 b | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
5276 | MoUsoCoreWorker.exe | 57.153.246.3:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
4 | System | 192.168.100.255:137 | — | Not routed | — | whitelisted |
9208 | slui.exe | 48.192.1.64:443 | activation-v2.sls.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
3340 | svchost.exe | 57.153.246.3:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
— | — | 92.123.104.63:443 | www.bing.com | AKAMAI-ASN1 | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | Not routed | — | whitelisted |
3340 | svchost.exe | 23.216.77.6:80 | crl.microsoft.com | AKAMAI-ASN1 | NL | whitelisted |
3340 | svchost.exe | 23.52.181.212:80 | www.microsoft.com | AKAMAI-AS | US | whitelisted |
5276 | MoUsoCoreWorker.exe | 23.52.181.212:80 | www.microsoft.com | AKAMAI-AS | US | whitelisted |
3340 | svchost.exe | 48.209.6.48:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
activation-v2.sls.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
8984 | Bwale.exe | Misc activity | INFO [ANY.RUN] Connection to IP from commonly abused ASN (AS214943 RAILNET) |
8984 | Bwale.exe | Malware Command and Control Activity Detected | BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s) |
8984 | Bwale.exe | Malware Command and Control Activity Detected | ET MALWARE Amadey CnC Response |