File name:

Work.exe

Full analysis: https://app.any.run/tasks/7012c85d-eb53-43dc-96b9-44ea6b044d1f
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: May 22, 2025, 23:56:22
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
amadey
botnet
stealer
delphi
inno
installer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

777B523753DFD477E0CB553892E403B9

SHA1:

60195650BB33EAED745D02CE20B4BD775EA9C108

SHA256:

7623B74488D2413A84E80AE2C03D73C67E9B91350660BDC0C45B0D11CEF57BC6

SSDEEP:

196608:mFf8c/CDOABjm3NkiBqO5TC7R4FBSwDCUI9DtU:mCDO8jm3N5BqO9C7WvSSCU0U

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • Work.exe (PID: 7152)
      • nudwee.exe (PID: 5800)
      • nudwee.exe (PID: 2616)
      • nudwee.exe (PID: 5400)
      • nudwee.exe (PID: 6640)
      • nudwee.exe (PID: 3300)
      • nudwee.exe (PID: 6392)

    • AMADEY has been detected (SURICATA)

      • nudwee.exe (PID: 5800)

    • Connects to the CnC server

      • nudwee.exe (PID: 5800)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Work.exe (PID: 7152)

    • Reads security settings of Internet Explorer

      • Work.exe (PID: 7152)
      • nudwee.exe (PID: 5800)

    • Starts itself from another location

      • Work.exe (PID: 7152)

    • The process executes via Task Scheduler

      • nudwee.exe (PID: 2616)
      • nudwee.exe (PID: 5400)
      • nudwee.exe (PID: 3300)
      • nudwee.exe (PID: 6640)
      • nudwee.exe (PID: 6392)

    • Contacting a server suspected of hosting an CnC

      • nudwee.exe (PID: 5800)

    • Connects to the server without a host name

      • nudwee.exe (PID: 5800)

  • INFO

    • The sample compiled with english language support

      • Work.exe (PID: 7152)

    • Checks supported languages

      • Work.exe (PID: 7152)
      • nudwee.exe (PID: 5800)
      • nudwee.exe (PID: 2616)
      • nudwee.exe (PID: 5400)
      • nudwee.exe (PID: 6640)
      • nudwee.exe (PID: 3300)
      • nudwee.exe (PID: 6392)

    • Create files in a temporary directory

      • Work.exe (PID: 7152)
      • nudwee.exe (PID: 5800)

    • Reads the computer name

      • Work.exe (PID: 7152)
      • nudwee.exe (PID: 5800)

    • Process checks computer location settings

      • Work.exe (PID: 7152)

    • Detects InnoSetup installer (YARA)

      • nudwee.exe (PID: 5800)
      • nudwee.exe (PID: 2616)
      • nudwee.exe (PID: 5400)
      • nudwee.exe (PID: 6640)
      • nudwee.exe (PID: 3300)

    • Compiled with Borland Delphi (YARA)

      • nudwee.exe (PID: 5800)
      • nudwee.exe (PID: 5400)
      • nudwee.exe (PID: 6640)
      • nudwee.exe (PID: 3300)
      • nudwee.exe (PID: 2616)

    • Checks proxy server information

      • nudwee.exe (PID: 5800)
      • slui.exe (PID: 4628)

    • Reads the software policy settings

      • slui.exe (PID: 4628)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 EXE PECompact compressed (generic) (83)
.exe | Win32 Executable (generic) (9)
.exe | Generic Win/DOS Executable (3.9)
.exe | DOS Executable Generic (3.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:05 14:08:23+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.42
CodeSize: 23040
InitializedDataSize: 3729920
UninitializedDataSize: -
EntryPoint: 0x3600
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.1
ProductVersionNumber: 1.0.0.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: ASUSTeK COMPUTER INC.
FileDescription: -
FileVersion: 22.140.0.4
InternalName: Bluetooth_DCH_Intel_Z_V22.140.0.4_28203.exe
LegalCopyright: © ASUSTeK COMPUTER INC. All rights reserved.
OriginalFileName: Bluetooth_DCH_Intel_Z_V22.140.0.4_28203.exe
ProductName: Intel Bluetooth Driver
ProductVersion: 22.140.0.4
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
12
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start work.exe #AMADEY nudwee.exe nudwee.exe no specs slui.exe nudwee.exe no specs nudwee.exe no specs nudwee.exe no specs ucpdmgr.exe no specs conhost.exe no specs ucpdmgr.exe no specs conhost.exe no specs nudwee.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2192"C:\WINDOWS\system32\UCPDMgr.exe"C:\Windows\System32\UCPDMgr.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
User Choice Protection Manager
Exit code:
0
Version:
1.0.0.414301
Modules
Images
c:\windows\system32\ucpdmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2616"C:\Users\admin\AppData\Local\Temp\6106733c42\nudwee.exe"C:\Users\admin\AppData\Local\Temp\6106733c42\nudwee.exe—svchost.exe
User:
admin
Company:
ASUSTeK COMPUTER INC.
Integrity Level:
MEDIUM
Exit code:
0
Version:
22.140.0.4
Modules
Images
c:\users\admin\appdata\local\temp\6106733c42\nudwee.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
3300"C:\Users\admin\AppData\Local\Temp\6106733c42\nudwee.exe"C:\Users\admin\AppData\Local\Temp\6106733c42\nudwee.exe—svchost.exe
User:
admin
Company:
ASUSTeK COMPUTER INC.
Integrity Level:
MEDIUM
Exit code:
0
Version:
22.140.0.4
Modules
Images
c:\users\admin\appdata\local\temp\6106733c42\nudwee.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
4628C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4880\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—UCPDMgr.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5020\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—UCPDMgr.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5400"C:\Users\admin\AppData\Local\Temp\6106733c42\nudwee.exe"C:\Users\admin\AppData\Local\Temp\6106733c42\nudwee.exe—svchost.exe
User:
admin
Company:
ASUSTeK COMPUTER INC.
Integrity Level:
MEDIUM
Exit code:
0
Version:
22.140.0.4
Modules
Images
c:\users\admin\appdata\local\temp\6106733c42\nudwee.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
5800"C:\Users\admin\AppData\Local\Temp\6106733c42\nudwee.exe" C:\Users\admin\AppData\Local\Temp\6106733c42\nudwee.exe
Work.exe
User:
admin
Company:
ASUSTeK COMPUTER INC.
Integrity Level:
MEDIUM
Version:
22.140.0.4
Modules
Images
c:\users\admin\appdata\local\temp\6106733c42\nudwee.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6252"C:\WINDOWS\system32\UCPDMgr.exe"C:\Windows\System32\UCPDMgr.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
User Choice Protection Manager
Exit code:
0
Version:
1.0.0.414301
Modules
Images
c:\windows\system32\ucpdmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6392"C:\Users\admin\AppData\Local\Temp\6106733c42\nudwee.exe"C:\Users\admin\AppData\Local\Temp\6106733c42\nudwee.exe—svchost.exe
User:
admin
Company:
ASUSTeK COMPUTER INC.
Integrity Level:
MEDIUM
Exit code:
0
Version:
22.140.0.4
Modules
Images
c:\users\admin\appdata\local\temp\6106733c42\nudwee.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
Total events
1 241
Read events
1 238
Write events
3
Delete events
0

Modification events

(PID) Process:(5800) nudwee.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5800) nudwee.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5800) nudwee.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
1
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
7152Work.exeC:\Windows\Tasks\nudwee.jobbinary
MD5:8B3E3E7D06A30F577F6EA53BD464C936
SHA256:BC7DCBB156B49E059A264FF7750F9702DB86BCB9AECE0DB6D00F068C4AC364D9
7152Work.exeC:\Users\admin\AppData\Local\Temp\6106733c42\nudwee.exeexecutable
MD5:777B523753DFD477E0CB553892E403B9
SHA256:7623B74488D2413A84E80AE2C03D73C67E9B91350660BDC0C45B0D11CEF57BC6
5800nudwee.exeC:\Users\admin\AppData\Local\Temp\693682860607image
MD5:601D948397C45EA341FBB21D4A28F289
SHA256:EDCF24DF5B4EFBC40FEA8448E6F6B32D8714B3EC3B28AAB147B55347F8333750
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
44
DNS requests
19
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5800
nudwee.exe
POST
200
195.82.146.131:80
http://195.82.146.131/HthsDb74/index.php
unknown
—
—
malicious
—
—
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5892
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5892
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5800
nudwee.exe
POST
200
195.82.146.131:80
http://195.82.146.131/HthsDb74/index.php
unknown
—
—
malicious
5800
nudwee.exe
POST
200
195.82.146.131:80
http://195.82.146.131/HthsDb74/index.php?scr=1
unknown
—
—
malicious
5800
nudwee.exe
POST
200
195.82.146.131:80
http://195.82.146.131/HthsDb74/index.php
unknown
—
—
malicious
5800
nudwee.exe
POST
200
195.82.146.131:80
http://195.82.146.131/HthsDb74/index.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
5892
SIHClient.exe
172.202.163.200:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.42
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
google.com
  • 142.250.186.142
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.32.68
  • 40.126.32.138
  • 20.190.160.66
  • 20.190.160.4
  • 40.126.32.133
  • 20.190.160.14
  • 20.190.160.130
  • 20.190.160.5
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
5800
nudwee.exe
Misc Attack
ET DROP Dshield Block Listed Source group 1
5800
nudwee.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
5800
nudwee.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
5800
nudwee.exe
A Network Trojan was detected
ET MALWARE Amadey Bot Activity (POST) M1
5800
nudwee.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
5800
nudwee.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
5800
nudwee.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
5800
nudwee.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
5800
nudwee.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
5800
nudwee.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Work.exe