Reverse engineering Amadey Loader with x64dbg: dynamic API resolution, token privilege escalation, keylogger hooks, clipboard capture, and command-line abuse for stealer staging.
The Amadey Loader sample was loaded into x64dbg. At the entry point, the loader performs dynamic API resolution through jmp thunks pointing to GetProcAddressForCaller and VirtualAlloc. The dump view below reveals decrypted strings and API names used by the loader's keylogger and persistence routines.
jmp qword ptr ds:[] – dynamic API lookup, avoids static imports. jmp qword ptr ds:[] – allocates RWX memory for unpacked payload / shellcode. SetWindowsHookExW / CallNextHookEx / UnhookWindowsHookEx – keylogger hook chain (WH_KEYBOARD_LL) GetForegroundWindow / GetWindowTextW / GetWindowThreadProcessId – captures the active window title with each keystroke. GetKeyState / GetAsyncKeyState – raw key state polling. GetUserObjectInformationW / wndProc /UnregisterClassW – window class handling for the hidden keylogger window. GetTickCount / timeGetTime / GetSystemTimeAsFileTime – timing routines used for beacon intervals and keystroke buffering.
Dynamic API Resolution: GetProcAddressForCaller bypasses static import analysis, defeating signature-based detection. Keylogger Confirmation: The SetWindowsHookExW + CallNextHookEx chain is the classic low-level keyboard hook used to intercept every keystroke system-wide. Context-Aware Logging: GetForegroundWindow + GetWindowTextW capture the active window title, giving context to each keystroke (usernames, passwords, chats). RWX Allocation: VirtualAlloc is used to unpack and execute the next-stage payload in memory, leaving no on-disk artifact. Amadey Behavior Match: This API set is consistent with Amadey's known credential-stealing and keylogging behavior.
A closer look at the same x64dbg session reveals that the Amadey Loader resolves a second batch of Windows APIs focused on privilege escalation, token manipulation, and process enumeration. The VirtualAlloc thunk at the top of the disassembly is used to allocate memory for the resolved API table, while the dump view below exposes the loader's intent to escalate to SYSTEM-level access before executing its payload.
OpenProcessToken / DuplicateTokenEx / ImpersonateLoggedOnUser – token duplication and impersonation for privilege escalation. LookupPrivilegeValueW / AdjustTokenPrivileges – enables SeDebugPrivilege and other sensitive privileges. GetTokenInformation / SetTokenInformation – reads and modifies the current process token. OpenProcess / Process32FirstW / Process32NextW – process enumeration to locate high-value targets (e.g., lsass.exe, AV processes). CreateFileW / CreateToolhelp32Snapshot / Module32FirstW – used for file operations and module enumeration. RegCreateKeyExW / RegSetValueExW / Persistence: RegCreateKeyExW + RegSetValueExW under Run keys allow Amadey to auto-start after reboot. GetProcAddress / LoadLibraryW / GetModuleHandleW – dynamic API resolution. CreateProcessW / ShellExecuteExW / WinExec – launches next-stage payloads. IsDebuggerPresent / CheckRemoteDebuggerPresent – anti-debugging checks.
Token Impersonation: DuplicateTokenEx + ImpersonateLoggedOnUser allow Amadey to run with higher privileges (often SYSTEM), giving full control over the system. SeDebugPrivilege Abuse: LookupPrivilegeValueW + AdjustTokenPrivileges enable SeDebugPrivilege, which is required to inject into protected processes like lsass.exe. Process Targeting: Process32FirstW / Process32NextW are used to enumerate and pick high-value targets (AV, browsers, credential stores). Anti-Debugging: IsDebuggerPresent + CheckRemoteDebuggerPresent actively detect analysis environments and terminate or alter behavior. Chain Execution: CreateProcessW / ShellExecuteExW confirm Amadey's role as a loader — it drops and executes the next-stage payload (e.g., Lumma Stealer, Vidar, or ransomware).
A third view of the same x64dbg session shows the Amadey Loader resolving APIs for file I/O, timer management, and input/keyboard handling. Together with the dump strings, this points to a payload that behaves like a keylogger/stealer hybrid — capturing input, writing logs, and cleaning up timers to reduce its footprint.
jmp qword ptr ds:[] – writes captured data / dropped payload to disk. jmp qword ptr ds:[] – asynchronous file write (used for stealthy log flushing). jmp qword ptr ds:[] – scattered write operation (used for fragmented payload drops). jmp qword ptr ds:[] – removes timer queues to erase timing-based traces. SetSystemTime / SetLocalTime – potential timestamp manipulation. SetWindowsHookEx / CallNextHookEx / UnhookWindowsHookEx – keyboard hook chain. GetForegroundWindow / GetWindowTextW / GetClassNameW – captures the active window context. GetSystemInfo / EnumWindows / EnumChildWindows – environment enumeration.
Keylogger Confirmation (Strengthened): The combination of SetWindowsHookEx, CallNextHookEx, ToUnicodeEx, and GetForegroundWindow is a textbook keylogger implementation that logs both keystrokes and the window they were typed in. Stealer Behavior: WriteFile + WriteFileEx + WriteFileGather indicate captured data (keystrokes, credentials) is written to disk in fragmented, asynchronous chunks to avoid detection. Anti-Forensic Cleanup: DeleteTimerQueue and SetSystemTime help the loader erase its own timing artifacts and potentially modify file timestamps. Synthetic Input: SendInput + RegisterHotKey suggest the payload can also inject keystrokes — useful for persistence or triggering actions remotely. Amadey Payload Pattern: This API set confirms the loader is preparing to deploy a keylogger/stealer payload (commonly Vidar, Lumma, or similar).
The fourth x64dbg view shows the Amadey Loader actively using CommandLineToArgvW inside kernelbase.dll to parse and manipulate command-line arguments at runtime. This is a strong indicator that the loader spawns child processes with crafted arguments (e.g., rundll32, regsvr32, PowerShell). The dump below also reveals strings related to AV/EDR bypass and OS version targeting (os.name, os.version, bypass, bypassUac, pitou).
