File name:

Amadey.exe

Full analysis: https://app.any.run/tasks/e1309b29-f3eb-4405-a335-78b37f2264e3
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: February 07, 2024, 00:11:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
amadey
botnet
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

8FAF50AA96AAD67EE1943CC9895F9648

SHA1:

779611E5CE52E3301F262B386DFDAC57B388D152

SHA256:

7DD9A37B6E185415EACA149D6069FF5A9ABF23E01295982CDB16E921D425C410

SSDEEP:

12288:0AbhwPuMHBcvqRAloUbLsEn5iWlH0c8u:BbhwPFBcyOCEn5RHMu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Amadey.exe (PID: 532)

    • Changes the autorun value in the registry

      • Utsysc.exe (PID: 1588)

    • AMADEY has been detected (SURICATA)

      • Utsysc.exe (PID: 1588)

    • Connects to the CnC server

      • Utsysc.exe (PID: 1588)

  • SUSPICIOUS

    • Starts itself from another location

      • Amadey.exe (PID: 532)

    • Checks Windows Trust Settings

      • Utsysc.exe (PID: 1588)

    • Reads security settings of Internet Explorer

      • Utsysc.exe (PID: 1588)

    • Reads settings of System Certificates

      • Utsysc.exe (PID: 1588)

    • Executable content was dropped or overwritten

      • Amadey.exe (PID: 532)

    • The process executes via Task Scheduler

      • Utsysc.exe (PID: 3756)
      • Utsysc.exe (PID: 3824)
      • Utsysc.exe (PID: 2532)
      • Utsysc.exe (PID: 3012)

    • Process requests binary or script from the Internet

      • Utsysc.exe (PID: 1588)

    • Reads the Internet Settings

      • Utsysc.exe (PID: 1588)
      • Amadey.exe (PID: 532)

  • INFO

    • Create files in a temporary directory

      • Utsysc.exe (PID: 1588)
      • Amadey.exe (PID: 532)

    • Reads the machine GUID from the registry

      • Utsysc.exe (PID: 1588)
      • Amadey.exe (PID: 532)

    • Checks proxy server information

      • Utsysc.exe (PID: 1588)

    • Reads the computer name

      • Amadey.exe (PID: 532)
      • wmpnscfg.exe (PID: 3876)
      • Utsysc.exe (PID: 1588)

    • Checks supported languages

      • Amadey.exe (PID: 532)
      • Utsysc.exe (PID: 1588)
      • Utsysc.exe (PID: 3012)
      • wmpnscfg.exe (PID: 3876)
      • Utsysc.exe (PID: 3756)
      • Utsysc.exe (PID: 3824)
      • Utsysc.exe (PID: 2532)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3876)

    • Creates files or folders in the user directory

      • Utsysc.exe (PID: 1588)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:12:05 18:15:10+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.24
CodeSize: 338432
InitializedDataSize: 112640
UninitializedDataSize: -
EntryPoint: 0x2135b
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
8
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start amadey.exe #AMADEY utsysc.exe schtasks.exe no specs utsysc.exe no specs utsysc.exe no specs utsysc.exe no specs wmpnscfg.exe no specs utsysc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
532"C:\Users\admin\AppData\Local\Temp\Amadey.exe" C:\Users\admin\AppData\Local\Temp\Amadey.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\amadey.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1588"C:\Users\admin\AppData\Local\Temp\6ceb860674\Utsysc.exe" C:\Users\admin\AppData\Local\Temp\6ceb860674\Utsysc.exe
Amadey.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\6ceb860674\utsysc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2532C:\Users\admin\AppData\Local\Temp\6ceb860674\Utsysc.exe C:\Users\admin\AppData\Local\Temp\6ceb860674\Utsysc.exe—taskeng.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\6ceb860674\utsysc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2736"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\admin\AppData\Local\Temp\6ceb860674\Utsysc.exe" /FC:\Windows\System32\schtasks.exe—Utsysc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
3012C:\Users\admin\AppData\Local\Temp\6ceb860674\Utsysc.exe C:\Users\admin\AppData\Local\Temp\6ceb860674\Utsysc.exe—taskeng.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\6ceb860674\utsysc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3756C:\Users\admin\AppData\Local\Temp\6ceb860674\Utsysc.exe C:\Users\admin\AppData\Local\Temp\6ceb860674\Utsysc.exe—taskeng.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\6ceb860674\utsysc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3824C:\Users\admin\AppData\Local\Temp\6ceb860674\Utsysc.exe C:\Users\admin\AppData\Local\Temp\6ceb860674\Utsysc.exe—taskeng.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\6ceb860674\utsysc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3876"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
6 795
Read events
6 703
Write events
92
Delete events
0

Modification events

(PID) Process:(532) Amadey.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(532) Amadey.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(532) Amadey.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(532) Amadey.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1588) Utsysc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Operation:writeName:Startup
Value:
%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
(PID) Process:(1588) Utsysc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1588) Utsysc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1588) Utsysc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1588) Utsysc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1588) Utsysc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
1
Suspicious files
9
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
1588Utsysc.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751der
MD5:60FE01DF86BE2E5331B0CDBE86165686
SHA256:C08CCBC876CD5A7CDFA9670F9637DA57F6A1282198A9BC71FC7D7247A6E5B7A8
1588Utsysc.exeC:\Users\admin\AppData\Local\Temp\Tar44DE.tmpbinary
MD5:9C0C641C06238516F27941AA1166D427
SHA256:4276AF3669A141A59388BC56A87F6614D9A9BDDDF560636C264219A7EB11256F
1588Utsysc.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:AC05D27423A85ADC1622C714F2CB6184
SHA256:C6456E12E5E53287A547AF4103E0397CB9697E466CF75844312DC296D43D144D
1588Utsysc.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:6ABF15209DDA95884B4A1702CE51A0E7
SHA256:36B694E869F9BEEBEC632F624D652FCF384D70F60BA0EE5031A083DB754B9A75
532Amadey.exeC:\Users\admin\AppData\Local\Temp\6ceb860674\Utsysc.exeexecutable
MD5:8FAF50AA96AAD67EE1943CC9895F9648
SHA256:7DD9A37B6E185415EACA149D6069FF5A9ABF23E01295982CDB16E921D425C410
1588Utsysc.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CBDDA84193C95FE27F6CBFFCB1FFF7F6binary
MD5:C9CE4FE14F32175DF31BCEA4D6CD14C5
SHA256:7F8F4C4880CC90506F10506AFDC9D900D5ACE9E5F271813D1FCF010149C114CA
1588Utsysc.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CBDDA84193C95FE27F6CBFFCB1FFF7F6binary
MD5:7BE2FE5E3EA50CB78E7A72117EA65A7E
SHA256:267BA866C140298FF4BF8A4F6ED38636BB5658B6E65417C5AA10EE9154A1FB30
1588Utsysc.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:7B6355D2BFB2CCF05325A573EEC869C7
SHA256:236EC5369350A59922D2CE81AF399AC974C4A04B0AAD92D86E0ADB9CFA4E575F
1588Utsysc.exeC:\Users\admin\AppData\Local\Temp\302019708150image
MD5:8DCF56D8B48180B260E25D7986F9186D
SHA256:BD434297C7B193323C4708BD1C4E52731475A009F8E1A0EEA33497F87382A99E
1588Utsysc.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:6F96A818A2121C843A009683F4516723
SHA256:787131A065FA8C882A1B61EAE3B76EA2EB3C2ADB8DD5CB1F031C0093E19472AF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
56
DNS requests
7
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1588
Utsysc.exe
GET
304
184.24.77.202:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?869c554e2deacf03
unknown
—
—
unknown
1588
Utsysc.exe
POST
—
38.60.224.126:80
http://codefly.cc/k92lsA3dpb/index.php
unknown
—
—
unknown
1588
Utsysc.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
1588
Utsysc.exe
GET
200
195.138.255.18:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgSbWL1kD1x6mh1VBd%2Fxh1PD4w%3D%3D
unknown
binary
503 b
unknown
1588
Utsysc.exe
GET
200
184.24.77.202:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?f3448ca8d15d9b7a
unknown
compressed
65.2 Kb
unknown
1588
Utsysc.exe
GET
—
38.60.224.126:80
http://codefly.cc/k92lsA3dpb/Plugins/cred.dll
unknown
—
—
unknown
1080
svchost.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e90c163b6659448e
unknown
—
—
unknown
1588
Utsysc.exe
POST
—
38.60.224.126:80
http://codefly.cc/k92lsA3dpb/index.php?scr=1
unknown
—
—
unknown
1588
Utsysc.exe
GET
—
38.60.224.126:80
http://codefly.cc/k92lsA3dpb/Plugins/cred.dll
unknown
—
—
unknown
1588
Utsysc.exe
POST
—
38.60.224.126:80
http://codefly.cc/k92lsA3dpb/index.php
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1588
Utsysc.exe
38.60.224.126:80
codefly.cc
COGENT-174
US
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1588
Utsysc.exe
154.17.8.103:443
sjssr.fun
DMIT
US
unknown
1588
Utsysc.exe
184.24.77.202:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
1588
Utsysc.exe
69.192.161.44:80
x1.c.lencr.org
AKAMAI-AS
DE
unknown
1588
Utsysc.exe
195.138.255.18:80
r3.o.lencr.org
AS33891 Netzbetrieb GmbH
DE
unknown
1588
Utsysc.exe
154.17.11.75:443
sjssr.fun
DMIT
US
unknown
1080
svchost.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted

DNS requests

Domain
IP
Reputation
codefly.cc
  • 38.60.224.126
unknown
sjssr.fun
  • 154.17.8.103
  • 154.17.11.75
  • 202.144.192.86
  • 154.17.8.104
unknown
ctldl.windowsupdate.com
  • 184.24.77.202
  • 184.24.77.194
  • 93.184.221.240
whitelisted
x1.c.lencr.org
  • 69.192.161.44
whitelisted
r3.o.lencr.org
  • 195.138.255.18
  • 195.138.255.24
shared
xbww38261.xyz
  • 154.17.11.75
  • 154.17.8.104
  • 202.144.192.86
  • 154.17.8.100
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
1588
Utsysc.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey
1588
Utsysc.exe
A Network Trojan was detected
ET MALWARE Amadey Bot Activity (POST) M1
1588
Utsysc.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .dll file with no User-Agent
1588
Utsysc.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .dll file with no User-Agent
1588
Utsysc.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .dll file with no User-Agent
1588
Utsysc.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .dll file with no User-Agent
1588
Utsysc.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .dll file with no User-Agent
1588
Utsysc.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .dll file with no User-Agent
1588
Utsysc.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey
5 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Amadey.exe