| URL: | https://mega.nz/file/KW5z3RxR#VK12T22AyB3Y1Y9-wZ9JkcuhR_KFjRR2yJg_SEdcW2E?uel=file.zip |
| Full analysis: | https://app.any.run/tasks/be7f3105-fa36-417c-b4cc-780412134489 |
| Verdict: | Malicious activity |
| Threats: | Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks. |
| Analysis date: | December 14, 2023, 07:49:03 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 007E2A08CB5CAEE709CE96064AF73426 |
| SHA1: | 2441E3B8F87D45E10F8CDFDE7F129C5AA543F747 |
| SHA256: | B58C2E5598A568D84C591D5EEA97E4DB21DE36246F85C10D4F0E026567F866C8 |
| SSDEEP: | 3:N8X/irg2CUXxEcQaS/RGQl6usH3fQAMYV:2ig2CUXYB36usvQ3YV |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 116 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1668 --field-trial-handle=1964,i,16138432378268198214,11264646325332633625,131072 /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 111.0.1661.62 Modules
| |||||||||||||||
| 128 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 488 | "C:\Users\admin\Pictures\Minor Policy\lV3SG2WiNRxQz1eD7GGPcp15.exe" | C:\Users\admin\Pictures\Minor Policy\lV3SG2WiNRxQz1eD7GGPcp15.exe | — | svchost.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 528 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1964,i,16138432378268198214,11264646325332633625,131072 /prefetch:3 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | msedge.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 111.0.1661.62 Modules
| |||||||||||||||
| 596 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2464 --field-trial-handle=1964,i,16138432378268198214,11264646325332633625,131072 /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 111.0.1661.62 Modules
| |||||||||||||||
| 872 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5536 --field-trial-handle=1964,i,16138432378268198214,11264646325332633625,131072 /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 111.0.1661.62 Modules
| |||||||||||||||
| 880 | "C:\Users\admin/Documents\Minor Policy\ZzPTu52Dp3p6gXRktdO1e23F.exe" "" | C:\Users\admin\Documents\Minor Policy\ZzPTu52Dp3p6gXRktdO1e23F.exe | cmd.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 3221225477 Modules
| |||||||||||||||
| 896 | "C:\Users\admin/Documents\Minor Policy\KKEb5KiRt4h8VfeXgS2GBXIS.exe" "" | C:\Users\admin\Documents\Minor Policy\KKEb5KiRt4h8VfeXgS2GBXIS.exe | cmd.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 3762504530 Modules
| |||||||||||||||
| 896 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1084 | "C:\Users\admin/Documents\Minor Policy\DqT7nYPunqBMkuRLL7edn9lt.exe" "" | C:\Users\admin\Documents\Minor Policy\DqT7nYPunqBMkuRLL7edn9lt.exe | cmd.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 1998805824 Modules
| |||||||||||||||
| (PID) Process: | (3752) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (3752) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (3752) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
| (PID) Process: | (3752) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (3752) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062} |
| Operation: | write | Name: | dr |
Value: 1 | |||
| (PID) Process: | (3752) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics |
| Operation: | write | Name: | user_experience_metrics.stability.exited_cleanly |
Value: 0 | |||
| (PID) Process: | (3752) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge |
| Operation: | write | Name: | UsageStatsInSample |
Value: 1 | |||
| (PID) Process: | (3752) msedge.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault |
| Operation: | write | Name: | S-1-5-21-1693682860-607145093-2874071422-1001 |
Value: BC8CC635B5602F00 | |||
| (PID) Process: | (3752) msedge.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062} |
| Operation: | write | Name: | usagestats |
Value: 0 | |||
| (PID) Process: | (3752) msedge.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062} |
| Operation: | write | Name: | urlstats |
Value: 0 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3752 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF14e444.TMP | — | |
MD5:— | SHA256:— | |||
| 3752 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old | — | |
MD5:— | SHA256:— | |||
| 3752 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF14e444.TMP | — | |
MD5:— | SHA256:— | |||
| 3752 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old | — | |
MD5:— | SHA256:— | |||
| 3752 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF14e405.TMP | — | |
MD5:— | SHA256:— | |||
| 3752 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 3752 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Local State~RF14e3b7.TMP | binary | |
MD5:24FF6E5F1AF64C692D70F012A3E20124 | SHA256:58CCCC4BB42783B62792010C13BA4A724FCB140F082D7996626F17E533E20452 | |||
| 3752 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old~RF14e415.TMP | text | |
MD5:D480C74EE54A756F9A0AE4C42DC88EE1 | SHA256:61F10687C404E33B9D61AB49E0B9FCD809F3DA06E7471164BF8DA209A05DFF78 | |||
| 3752 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Last Version | text | |
MD5:D6DB6EA02FE506F2DA98F1C137243587 | SHA256:126173A7D7D0F54A9FCE5465180BC49DB023E723A41BB55A0F9497BE76FBAA28 | |||
| 3752 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Local State | binary | |
MD5:945543C71C06061EA24A252AD024CC58 | SHA256:E9E2449EB7A0A5DDAA1E87D291FF95CFF8739E2458F7AC46AEA3ED2714E899F5 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2556 | svchost.exe | GET | 206 | 87.248.205.0:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/26b10680-9c99-4cf8-93c0-fca56709a250?P1=1703084393&P2=404&P3=2&P4=jW0H8LoGs3n2lTnS%2f9sPkkTTj4wiXHOUgKaRbkrTWnJ4Fa1lajrpm6JkkTki57PjJCbvsDuy2Gj4eZi%2bocM2Ow%3d%3d | unknown | binary | 1.09 Kb | unknown |
2556 | svchost.exe | HEAD | 200 | 87.248.205.0:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/26b10680-9c99-4cf8-93c0-fca56709a250?P1=1703084393&P2=404&P3=2&P4=jW0H8LoGs3n2lTnS%2f9sPkkTTj4wiXHOUgKaRbkrTWnJ4Fa1lajrpm6JkkTki57PjJCbvsDuy2Gj4eZi%2bocM2Ow%3d%3d | unknown | — | — | unknown |
2556 | svchost.exe | GET | 206 | 87.248.205.0:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/36151317-54d8-4560-8ee4-12ea19526cd0?P1=1703084493&P2=404&P3=2&P4=DAfrMd%2fKvkPcVooMElEAGdWRUQ7awgrJVBqV6%2fd6eReTj%2bXlCKtIVXE4lF4mmg8yvbcyGhVRwBS%2bfMiI7nsdqg%3d%3d | unknown | binary | 101 Kb | unknown |
2556 | svchost.exe | HEAD | 200 | 87.248.205.0:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/b6784df7-c744-43b7-ad1e-24d3b6b3457d?P1=1703084393&P2=404&P3=2&P4=gIodB0yTWl%2fQnCz8J5t9kYeAUugFNr10xFGaAk6ME6VqY8Ed2eTYk9OFQhWbnTlQ4yaSQoEMQ39xvpGVCQNR6A%3d%3d | unknown | binary | 48.6 Kb | unknown |
2556 | svchost.exe | GET | 206 | 87.248.205.0:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/26b10680-9c99-4cf8-93c0-fca56709a250?P1=1703084393&P2=404&P3=2&P4=jW0H8LoGs3n2lTnS%2f9sPkkTTj4wiXHOUgKaRbkrTWnJ4Fa1lajrpm6JkkTki57PjJCbvsDuy2Gj4eZi%2bocM2Ow%3d%3d | unknown | binary | 236 b | unknown |
6504 | WW13_64.exe | GET | — | 195.20.16.45:80 | http://195.20.16.45/api/tracemap.php | unknown | — | — | unknown |
2556 | svchost.exe | GET | 206 | 87.248.205.0:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/26b10680-9c99-4cf8-93c0-fca56709a250?P1=1703084393&P2=404&P3=2&P4=jW0H8LoGs3n2lTnS%2f9sPkkTTj4wiXHOUgKaRbkrTWnJ4Fa1lajrpm6JkkTki57PjJCbvsDuy2Gj4eZi%2bocM2Ow%3d%3d | unknown | binary | 3.30 Kb | unknown |
6504 | WW13_64.exe | GET | 200 | 46.35.111.154:80 | http://46.35.111.154/UserCheck/PortalMain?IID=4ABE1015-5037-4E91-63A5-13E80B548392&origUrl=aHR0cDovLzE5NS4yMC4xNi40NS9hcGkvdHJhY2VtYXAucGhw | unknown | html | 106 Kb | unknown |
2556 | svchost.exe | GET | 206 | 87.248.205.0:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/26b10680-9c99-4cf8-93c0-fca56709a250?P1=1703084393&P2=404&P3=2&P4=jW0H8LoGs3n2lTnS%2f9sPkkTTj4wiXHOUgKaRbkrTWnJ4Fa1lajrpm6JkkTki57PjJCbvsDuy2Gj4eZi%2bocM2Ow%3d%3d | unknown | binary | 9.81 Kb | unknown |
6504 | WW13_64.exe | GET | 200 | 46.35.111.154:80 | http://46.35.111.154/UserCheck/PortalMain?IID=DE5C2409-4C10-75E6-B8CA-F22DF6071B93&origUrl=aHR0cDovLzc3LjEwNS4xNDcuMTMwL2FwaS90cmFjZW1hcC5waHA | unknown | html | 106 Kb | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3240 | svchost.exe | 4.231.128.59:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3752 | msedge.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
528 | msedge.exe | 31.216.144.5:443 | mega.nz | Datacenter Luxembourg S.A. | LU | unknown |
528 | msedge.exe | 13.107.42.16:443 | config.edge.skype.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
528 | msedge.exe | 20.105.95.163:443 | nav-edge.smartscreen.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
528 | msedge.exe | 51.104.176.40:443 | data-edge.smartscreen.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
3764 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
528 | msedge.exe | 204.79.197.239:443 | edge.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
528 | msedge.exe | 89.44.169.134:443 | eu.static.mega.co.nz | Datacenter Luxembourg S.A. | LU | unknown |
Domain | IP | Reputation |
|---|---|---|
mega.nz |
| whitelisted |
config.edge.skype.com |
| whitelisted |
nav-edge.smartscreen.microsoft.com |
| whitelisted |
data-edge.smartscreen.microsoft.com |
| whitelisted |
edge.microsoft.com |
| whitelisted |
eu.static.mega.co.nz |
| shared |
settings-win.data.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
g.api.mega.co.nz |
| shared |
edgeassetservice.azureedge.net |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
528 | msedge.exe | Misc activity | ET INFO File Sharing Related Domain in DNS Lookup (mega .nz) |
528 | msedge.exe | Misc activity | ET INFO File Sharing Related Domain in DNS Lookup (mega .nz) |
528 | msedge.exe | Misc activity | ET INFO File Sharing Domain Observed in TLS SNI (mega .nz) |
528 | msedge.exe | Misc activity | ET INFO Observed DNS Query to Filesharing Service (mega .co .nz) |
528 | msedge.exe | Misc activity | ET INFO Observed DNS Query to Filesharing Service (mega .co .nz) |
528 | msedge.exe | Misc activity | ET INFO File Sharing Domain Observed in TLS SNI (mega .nz) |
528 | msedge.exe | Misc activity | ET INFO Observed DNS Query to Filesharing Service (mega .co .nz) |
528 | msedge.exe | Misc activity | ET INFO Observed DNS Query to Filesharing Service (mega .co .nz) |
528 | msedge.exe | Misc activity | ET INFO File Sharing Related Domain in DNS Lookup (mega .nz) |
528 | msedge.exe | Misc activity | ET INFO File Sharing Domain Observed in TLS SNI (mega .nz) |