amadey | f1dc32d9d1065e929bea07b26b09210056271a74dcf0e6b4e2d9705590b3753e

General

Target
manage_address-09058355.exe
Size 185KB
Sample201005-xzze74msl6
SHA256 f1dc32d9d1065e929bea07b26b09210056271a74dcf0e6b4e2d9705590b3753e
MD5 efd7aaf116a402162f527d2dbb59ab16
SHA1 02daf20b5f81f875494b1a79391becd09ddf1e6c
SHA512 687a84761c61f902a2ae470b271dde84cfbd1c608a88675c5d4123a35b37de827c415273a74be765280969f329e49f59b0278e5af6fd6db010e4b8222c18cc48
MD5 SHA1 SHA512

Score

10^/10

amadey discovery persistence spyware stealer trojan

Malware Config

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Blocklisted process makes network request 2 IoCs

flow	pid	Process
14	3056	rundll32.exe
16	196	rundll32.exe

Executes dropped EXE 2 IoCs

pid	Process
2228	bdif.exe
4084	1.exe

Loads dropped DLL 2 IoCs

pid	Process
3056	rundll32.exe
196	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\scr = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\scr.dll, Main"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\cred = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\cred.dll, Main"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3404	SCHTASKS.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2192	timeout.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	\??\c:\programdata\32b1a07b8f\bdif.exe:Zone.Identifier	manage_address-09058355.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3056	rundll32.exe
3056	rundll32.exe
3056	rundll32.exe
3056	rundll32.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 3404	3952	manage_address-09058355.exe	72
PID 3952 wrote to memory of 3404	3952	manage_address-09058355.exe	72
PID 3952 wrote to memory of 3404	3952	manage_address-09058355.exe	72
PID 2228 wrote to memory of 2440	2228	bdif.exe	78
PID 2228 wrote to memory of 2440	2228	bdif.exe	78
PID 2228 wrote to memory of 2440	2228	bdif.exe	78
PID 2228 wrote to memory of 3780	2228	bdif.exe	80
PID 2228 wrote to memory of 3780	2228	bdif.exe	80
PID 2228 wrote to memory of 3780	2228	bdif.exe	80
PID 2228 wrote to memory of 3056	2228	bdif.exe	82
PID 2228 wrote to memory of 3056	2228	bdif.exe	82
PID 2228 wrote to memory of 3056	2228	bdif.exe	82
PID 2228 wrote to memory of 1156	2228	bdif.exe	83
PID 2228 wrote to memory of 1156	2228	bdif.exe	83
PID 2228 wrote to memory of 1156	2228	bdif.exe	83
PID 2228 wrote to memory of 196	2228	bdif.exe	84
PID 2228 wrote to memory of 196	2228	bdif.exe	84
PID 2228 wrote to memory of 196	2228	bdif.exe	84
PID 2228 wrote to memory of 4084	2228	bdif.exe	86
PID 2228 wrote to memory of 4084	2228	bdif.exe	86
PID 2228 wrote to memory of 4084	2228	bdif.exe	86
PID 4084 wrote to memory of 1280	4084	1.exe	87
PID 4084 wrote to memory of 1280	4084	1.exe	87
PID 4084 wrote to memory of 1280	4084	1.exe	87
PID 1280 wrote to memory of 2192	1280	cmd.exe	89
PID 1280 wrote to memory of 2192	1280	cmd.exe	89
PID 1280 wrote to memory of 2192	1280	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\manage_address-09058355.exe
"C:\Users\Admin\AppData\Local\Temp\manage_address-09058355.exe"
1⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Windows\SysWOW64\SCHTASKS.exe
  SCHTASKS /Create /SC MINUTE /MO 1 /TN 38c862e85f7d0128d5e737524f052e1b /TR c:\programdata\32b1a07b8f\bdif.exe /F
  2⤵
  - Creates scheduled task(s)
  PID:3404

\??\c:\programdata\32b1a07b8f\bdif.exe
c:\programdata\32b1a07b8f\bdif.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d c:\programdata\32b1a07b8f
  2⤵
  PID:2440
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v cred /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\cred.dll, Main"
  2⤵
  - Adds Run key to start application
  PID:3780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cred.dll, Main
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3056
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v scr /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\scr.dll, Main"
  2⤵
  - Adds Run key to start application
  PID:1156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\scr.dll, Main
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:196
- C:\Users\Admin\AppData\Local\Temp\1.exe
  C:\Users\Admin\AppData\Local\Temp\1.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Windows\SysWOW64\cmd.exe
    /c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\Temp\1.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1280
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 3
      4⤵
      Delays execution with timeout.exe
      PID:2192