| File name: | E6D5DE0F24C9E8CE95EC860FDF075B29.exe |
| Full analysis: | https://app.any.run/tasks/f5fd399e-1ebc-4e79-9934-6d44f7edbfe8 |
| Verdict: | Malicious activity |
| Threats: | Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks. |
| Analysis date: | August 01, 2025, 05:06:30 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections |
| MD5: | E6D5DE0F24C9E8CE95EC860FDF075B29 |
| SHA1: | 337EE2092A62EFC052A5BD47EBAE21309D6D3B43 |
| SHA256: | 6D2B844AD0114DD3EC1731FA828132DC70AD045004C9C643279F71E774E14E14 |
| SSDEEP: | 98304:ln2h5aq9PFsQRW0FlA70GU/zAQn/g/LKKL/lC0iyUXheMd2NWXHr8seMSvMKif9v:7Zn866FoGm |
| .exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (37.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (8.8) |
| .exe | | | Win32 Executable (generic) (6) |
| .exe | | | Generic Win/DOS Executable (2.7) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2022:05:24 22:49:06+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14.13 |
| CodeSize: | 25600 |
| InitializedDataSize: | 4925952 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x6a60 |
| OSVersion: | 10 |
| ImageVersion: | 10 |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 11.0.17763.1 |
| ProductVersionNumber: | 11.0.17763.1 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Windows NT 32-bit |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | Microsoft Corporation |
| FileDescription: | Win32 Cabinet Self-Extractor |
| FileVersion: | 11.00.17763.1 (WinBuild.160101.0800) |
| InternalName: | Wextract |
| LegalCopyright: | © Microsoft Corporation. All rights reserved. |
| OriginalFileName: | WEXTRACT.EXE .MUI |
| ProductName: | Internet Explorer |
| ProductVersion: | 11.00.17763.1 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 188 | reg query "HKU\S-1-5-19" | C:\Windows\System32\reg.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Console Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 188 | reg query "HKLM\System\CurrentControlSet\Services\MDCoreSvc" | C:\Windows\System32\reg.exe | — | cmd.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Registry Console Tool Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 304 | tasklist | C:\Windows\System32\tasklist.exe | — | cmd.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Lists the current running tasks Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 472 | C:\Windows\SysWOW64\explorer.exe | C:\Windows\SysWOW64\explorer.exe | — | 8PdcY8X.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Version: 10.0.19041.3758 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 504 | "C:\w0HZ6G0\jAk6FVw8.exe" | C:\w0HZ6G0\jAk6FVw8.exe | fSMYR68E.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
Amadey(PID) Process(504) jAk6FVw8.exe C294.154.35.25 URLhttp://94.154.35.25/di9ku38f/index.php Version5.55 Options Drop directory96a319e745 Drop nameSrxelqcif.exe Strings (125)os: " && timeout 1 && del \App && | shutdown -s -t 0 Panda Security r= ::: " && ren pc: random ProductName bi: # POST 2016 msi Content-Type: application/x-www-form-urlencoded 0123456789 0000043f un: st=s S-%lu- SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName AVAST Software cmd Content-Disposition: form-data; name="data"; filename=" SOFTWARE\Microsoft\Windows NT\CurrentVersion lv: <c> SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders 00000423 <d> cred.dll|clip.dll| exe og: Srxelqcif.exe Powershell.exe Comodo 5.55 && Exit" Startup %-lu DefaultSettings.YResolution SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\ 00000422 rundll32 2019 ps1 ar: %USERPROFILE% vs: -executionpolicy remotesigned -File " shell32.dll /k WinDefender ------ http:// cred.dll Main Bitdefender .jpg ?scr=1 "taskkill /f /im " rb CurrentBuild id: Doctor Web SOFTWARE\Microsoft\Windows\CurrentVersion\Run 94.154.35.25 ESET Sophos 00000419 VideoID dm: 96a319e745 Keyboard Layout\Preload AVG ------ SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce 2025 -- " DefaultSettings.XResolution /quiet Norton SYSTEM\ControlSet001\Services\BasicDisplay\Video dll zip = ProgramData\ cmd /C RMDIR /s/q /Plugins/ e1 Programs d1 &unit= Rem ComputerName 2022 rundll32.exe e3 e2 Content-Type: multipart/form-data; boundary=---- -%lu clip.dll av: kernel32.dll GetNativeSystemInfo 360TotalSecurity \0000 "
Content-Type: application/octet-stream SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders +++ Kaspersky Lab Avira \ GET /di9ku38f/index.php sd: abcdefghijklmnopqrstuvwxyz0123456789-_ wb https:// -unicode- | |||||||||||||||
| 512 | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\1E08s6.exe | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\1E08s6.exe | E6D5DE0F24C9E8CE95EC860FDF075B29.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 512 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3064,i,10569411956637408946,7925708704977106550,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=3028 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 133.0.6943.127 Modules
| |||||||||||||||
| 620 | /x -standby-timeout-dc 0 | C:\Windows\System32\powercfg.exe | — | ls1FDZl.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Power Settings Command-Line Tool Exit code: 3221226324 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 684 | NSudoLG -U:T -P:E -UseCurrentConsole C:\Users\admin\AppData\Local\Temp\y9Hto7f.bat any_word | C:\Users\admin\AppData\Local\Temp\Work\NSudoLG.exe | — | cmd.exe | |||||||||||
User: admin Company: M2-Team Integrity Level: HIGH Description: NSudo Launcher Exit code: 0 Version: 9.0.2676.0 Modules
| |||||||||||||||
| 768 | reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" | C:\Windows\System32\reg.exe | — | cmd.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Registry Console Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| (PID) Process: | (5436) reg.exe | Key: | HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize |
| Operation: | write | Name: | AppsUseLightTheme |
Value: 0 | |||
| (PID) Process: | (2504) nircmd.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
| Operation: | write | Name: | C:\WINDOWS\System32\cmd.exe.FriendlyAppName |
Value: Windows Command Processor | |||
| (PID) Process: | (2504) nircmd.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
| Operation: | write | Name: | C:\WINDOWS\System32\cmd.exe.ApplicationCompany |
Value: Microsoft Corporation | |||
| (PID) Process: | (6332) reg.exe | Key: | HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize |
| Operation: | write | Name: | AppsUseLightTheme |
Value: 0 | |||
| (PID) Process: | (504) jAk6FVw8.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (504) jAk6FVw8.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (504) jAk6FVw8.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (4164) reg.exe | Key: | HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize |
| Operation: | write | Name: | AppsUseLightTheme |
Value: 0 | |||
| (PID) Process: | (4856) reg.exe | Key: | HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize |
| Operation: | write | Name: | AppsUseLightTheme |
Value: 0 | |||
| (PID) Process: | (504) jAk6FVw8.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | 76995f989d.exe |
Value: C:\Users\admin\AppData\Local\Temp\10283040101\76995f989d.exe | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7048 | 2g8113.exe | C:\w0HZ6G0\pQSzSyAf.zip | compressed | |
MD5:AB6EE96E141005500BE31BCA28023E34 | SHA256:CF152AD95D4E8ACA519A31776F3B010B3540ADC27A1AA6E041724A2EEA115D9B | |||
| 7048 | 2g8113.exe | C:\w0HZ6G0\Mj7TYuJI.exe | executable | |
MD5:426CCB645E50A3143811CFA0E42E2BA6 | SHA256:CF878BFBD9ED93DC551AC038AFF8A8BBA4C935DDF8D48E62122BDDFDB3E08567 | |||
| 7048 | 2g8113.exe | C:\w0HZ6G0\DNqCKF65.exe | executable | |
MD5:F2932E15E61344AD196E3B478C088350 | SHA256:05680A9BB2B08D0CCD25D1D274F78C971609AE2C95D3427F780C46ECFBC296C1 | |||
| 3720 | DNqCKF65.exe | C:\Users\admin\AppData\Local\Temp\y9Hto7f.bat | text | |
MD5:C2DF80F14AD294A279ED4F4F251960A5 | SHA256:D6E5A4BFA17BC9B9D9AF48FB6CEE2024477F309B48E670F8F49B7720205AAA43 | |||
| 3720 | DNqCKF65.exe | C:\Users\admin\AppData\Local\Temp\Work\nircmd.exe | executable | |
MD5:4A9DA765FD91E80DECFD2C9FE221E842 | SHA256:2E81E048AB419FDC6E5F4336A951BD282ED6B740048DC38D7673678EE3490CDA | |||
| 6340 | E6D5DE0F24C9E8CE95EC860FDF075B29.exe | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\2g8113.exe | executable | |
MD5:2DAC651DF2196423BF3E5296CEB93A61 | SHA256:D7AB100EEC217AE7EDDE5AD39EC0775E7EBCA760ED758C63C412A6253DE6A9D5 | |||
| 7048 | 2g8113.exe | C:\w0HZ6G0\fSMYR68E.exe | executable | |
MD5:F108EEC016FC381866F431CB9BEDE311 | SHA256:3D5FEFCAE2589CEF6B68954167FCA4851FBD74AAD3228D6FAB4347D6ED95047F | |||
| 3720 | DNqCKF65.exe | C:\Users\admin\AppData\Local\Temp\Work\7z.exe | executable | |
MD5:426CCB645E50A3143811CFA0E42E2BA6 | SHA256:CF878BFBD9ED93DC551AC038AFF8A8BBA4C935DDF8D48E62122BDDFDB3E08567 | |||
| 3720 | DNqCKF65.exe | C:\Users\admin\AppData\Local\Temp\Work\cecho.exe | executable | |
MD5:E783BC59D0ED6CFBD8891F94AE23D1B3 | SHA256:5C1211559DDA10592CFEDD57681F18F4A702410816D36EDA95AEE6C74E3C6A47 | |||
| 3720 | DNqCKF65.exe | C:\Users\admin\AppData\Local\Temp\Work\NSudoLG.exe | executable | |
MD5:423129DDB24FB923F35B2DD5787B13DD | SHA256:5094AD359D8CF6DC5324598605C35F68519CC5AF9C7ED5427E02A6B28121E4C7 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
504 | jAk6FVw8.exe | POST | 200 | 94.154.35.25:80 | http://94.154.35.25/di9ku38f/index.php | US | text | 8 b | malicious |
504 | jAk6FVw8.exe | GET | 200 | 45.141.233.196:80 | http://45.141.233.196/newdef/random.exe | DE | executable | 2.12 Mb | unknown |
4520 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | DE | binary | 471 b | whitelisted |
504 | jAk6FVw8.exe | GET | 200 | 45.141.233.196:80 | http://45.141.233.196/luma/random.exe | DE | executable | 1.72 Mb | unknown |
504 | jAk6FVw8.exe | POST | 200 | 94.154.35.25:80 | http://94.154.35.25/di9ku38f/index.php | US | text | 4 b | malicious |
504 | jAk6FVw8.exe | GET | 200 | 45.141.233.196:80 | http://45.141.233.196/files/7677226784/6olpur0.exe | DE | executable | 825 Kb | unknown |
504 | jAk6FVw8.exe | POST | 200 | 94.154.35.25:80 | http://94.154.35.25/di9ku38f/index.php | US | text | 4 b | malicious |
504 | jAk6FVw8.exe | GET | 200 | 45.141.233.196:80 | http://45.141.233.196/test/amnew.exe | DE | executable | 416 Kb | unknown |
504 | jAk6FVw8.exe | GET | 200 | 45.141.233.196:80 | http://45.141.233.196/files/7002513081/ls1FDZl.exe | DE | executable | 7.53 Mb | unknown |
7356 | huran.exe | POST | 200 | 45.141.233.196:80 | http://45.141.233.196/ho4lu3dk/index.php | DE | text | 7 b | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1268 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5288 | RUXIMICS.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
512 | 1E08s6.exe | 104.102.49.106:443 | steamcommunity.com | AKAMAI-AS | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
504 | jAk6FVw8.exe | 94.154.35.25:80 | — | WINDSTREAM | US | malicious |
504 | jAk6FVw8.exe | 45.141.233.196:80 | — | Euro Crypt EOOD | DE | unknown |
4520 | svchost.exe | 20.190.160.131:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4520 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
perpenab.icu |
| malicious |
royaltbn.xyz |
| malicious |
columnez.shop |
| malicious |
mixp.digital |
| malicious |
woodenso.top |
| malicious |
foundrr.bet |
| malicious |
onyxistn.bet |
| malicious |
keulkgl.fun |
| malicious |
Process | Message |
|---|---|
1E08s6.exe |
%s------------------------------------------------
--- Themida Professional ---
--- (c)2012 Oreans Technologies ---
------------------------------------------------
|
ee7efab4f3.exe |
%s------------------------------------------------
--- Themida Professional ---
--- (c)2012 Oreans Technologies ---
------------------------------------------------
|
IObitUnlocker.exe | PostAction_Delete |
IObitUnlocker.exe | FileCount:264 |
IObitUnlocker.exe | C:\ProgramData\Microsoft\Windows Defender-------- |
IObitUnlocker.exe | C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection-------- |
IObitUnlocker.exe | C:\ProgramData\Microsoft\Windows Security Health-------- |
IObitUnlocker.exe | C:\ProgramData\Microsoft\Storage Health-------- |
IObitUnlocker.exe | C:\Program Files\Windows Defender-------- |
IObitUnlocker.exe | C:\Program Files\Windows Defender Advanced Threat Protection-------- |