amadey | b58f6d597c88e79bb34ee776227be235121b7a0f6b99170ff57ff66a96a940ed

Analysis

max time kernel
129s
max time network
145s
platform
windows7_x64
resource
win7v20201028
submitted
17-02-2021 09:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OOO Tochka.exe
Size

198KB
MD5

de602f032c362bdc1440d7a92874cd6f
SHA1

2682a13d58b90bbeeb722e5494924f86d083ff90
SHA256

b58f6d597c88e79bb34ee776227be235121b7a0f6b99170ff57ff66a96a940ed
SHA512

a33f99cc8d3af10a4341002a45f3f5055c29442dd05bccb1e705dcb6f01781964bc2048b15c05b871909289706c59a6df2b15ff14e5ec9d6069358844614a12f

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

2.11

185.215.113.17/jG3cs2rP/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exerundll32.exe

flow pid process

7 1204 rundll32.exe
8 1264 rundll32.exe
Executes dropped EXE 1 IoCs

Processes:

rween.exe

pid process

592 rween.exe

flow	pid	process
7	1204	rundll32.exe
8	1264	rundll32.exe

pid	process
592	rween.exe

Loads dropped DLL 10 IoCs

Processes:

OOO Tochka.exerundll32.exerundll32.exe

pid	process
1824	OOO Tochka.exe
1824	OOO Tochka.exe
1204	rundll32.exe
1204	rundll32.exe
1204	rundll32.exe
1204	rundll32.exe
1264	rundll32.exe
1264	rundll32.exe
1264	rundll32.exe
1264	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

1204 rundll32.exe
1204 rundll32.exe
1204 rundll32.exe
1204 rundll32.exe

pid	process
1204	rundll32.exe
1204	rundll32.exe
1204	rundll32.exe
1204	rundll32.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

OOO Tochka.exerween.execmd.exe

description	pid	process	target process
PID 1824 wrote to memory of 592	1824	OOO Tochka.exe	rween.exe
PID 1824 wrote to memory of 592	1824	OOO Tochka.exe	rween.exe
PID 1824 wrote to memory of 592	1824	OOO Tochka.exe	rween.exe
PID 1824 wrote to memory of 592	1824	OOO Tochka.exe	rween.exe
PID 592 wrote to memory of 1724	592	rween.exe	cmd.exe
PID 592 wrote to memory of 1724	592	rween.exe	cmd.exe
PID 592 wrote to memory of 1724	592	rween.exe	cmd.exe
PID 592 wrote to memory of 1724	592	rween.exe	cmd.exe
PID 1724 wrote to memory of 1292	1724	cmd.exe	reg.exe
PID 1724 wrote to memory of 1292	1724	cmd.exe	reg.exe
PID 1724 wrote to memory of 1292	1724	cmd.exe	reg.exe
PID 1724 wrote to memory of 1292	1724	cmd.exe	reg.exe
PID 592 wrote to memory of 1204	592	rween.exe	rundll32.exe
PID 592 wrote to memory of 1204	592	rween.exe	rundll32.exe
PID 592 wrote to memory of 1204	592	rween.exe	rundll32.exe
PID 592 wrote to memory of 1204	592	rween.exe	rundll32.exe
PID 592 wrote to memory of 1204	592	rween.exe	rundll32.exe
PID 592 wrote to memory of 1204	592	rween.exe	rundll32.exe
PID 592 wrote to memory of 1204	592	rween.exe	rundll32.exe
PID 592 wrote to memory of 1264	592	rween.exe	rundll32.exe
PID 592 wrote to memory of 1264	592	rween.exe	rundll32.exe
PID 592 wrote to memory of 1264	592	rween.exe	rundll32.exe
PID 592 wrote to memory of 1264	592	rween.exe	rundll32.exe
PID 592 wrote to memory of 1264	592	rween.exe	rundll32.exe
PID 592 wrote to memory of 1264	592	rween.exe	rundll32.exe
PID 592 wrote to memory of 1264	592	rween.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\OOO Tochka.exe
"C:\Users\Admin\AppData\Local\Temp\OOO Tochka.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1824
- C:\ProgramData\80373760c0\rween.exe
  "C:\ProgramData\80373760c0\rween.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:592
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\80373760c0\
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1724
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\80373760c0\
      4⤵
      PID:1292
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\ProgramData\0141f24c463d89\cred.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1204
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\ProgramData\0141f24c463d89\scr.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    PID:1264

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\0141f24c463d89\cred.dll

MD5
58aa6a0e1923c2ae8687002f99ae11e7

SHA1
aff5b58ade42b0b7f94cfccd4add1f90ee3625af

SHA256
a0e73f0fa699b65d0c5b64eaa3ca5d34c05cff8ce1508f97708bcea9525d8925

SHA512
20ac81ae8fac45868889549c3788f77e70a92f274d59a51c1f3616512dd88e7500d98c4ca701458d85ae07bdde288c19d179b6f584fac2a796501efb89c435df

Download Submit
C:\ProgramData\0141f24c463d89\scr.dll

MD5
245f28842136da057208ab20cb12c61a

SHA1
2abcffe6b5c431fe398ac43b2aaddd41c6ca6f07

SHA256
e5e8cbb2152b17973025214732bd0abc8a416ecd8a42a7b7e4e766cc10adf45b

SHA512
c1e6dbedf6a4bee7d78bfa2904c3f9218d5df67fd0f86f9539743858a444c265036a310ffded0d8829162b92240049a7591a21a419982adc7fa6c749ba7828e4

Download Submit
C:\ProgramData\152129327895926991267923

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\ProgramData\80373760c0\rween.exe

MD5
de602f032c362bdc1440d7a92874cd6f

SHA1
2682a13d58b90bbeeb722e5494924f86d083ff90

SHA256
b58f6d597c88e79bb34ee776227be235121b7a0f6b99170ff57ff66a96a940ed

SHA512
a33f99cc8d3af10a4341002a45f3f5055c29442dd05bccb1e705dcb6f01781964bc2048b15c05b871909289706c59a6df2b15ff14e5ec9d6069358844614a12f

Download Submit
\ProgramData\0141f24c463d89\cred.dll

MD5
58aa6a0e1923c2ae8687002f99ae11e7

SHA1
aff5b58ade42b0b7f94cfccd4add1f90ee3625af

SHA256
a0e73f0fa699b65d0c5b64eaa3ca5d34c05cff8ce1508f97708bcea9525d8925

SHA512
20ac81ae8fac45868889549c3788f77e70a92f274d59a51c1f3616512dd88e7500d98c4ca701458d85ae07bdde288c19d179b6f584fac2a796501efb89c435df

Download Submit
\ProgramData\0141f24c463d89\cred.dll

MD5
58aa6a0e1923c2ae8687002f99ae11e7

SHA1
aff5b58ade42b0b7f94cfccd4add1f90ee3625af

SHA256
a0e73f0fa699b65d0c5b64eaa3ca5d34c05cff8ce1508f97708bcea9525d8925

SHA512
20ac81ae8fac45868889549c3788f77e70a92f274d59a51c1f3616512dd88e7500d98c4ca701458d85ae07bdde288c19d179b6f584fac2a796501efb89c435df

Download Submit
\ProgramData\0141f24c463d89\cred.dll

MD5
58aa6a0e1923c2ae8687002f99ae11e7

SHA1
aff5b58ade42b0b7f94cfccd4add1f90ee3625af

SHA256
a0e73f0fa699b65d0c5b64eaa3ca5d34c05cff8ce1508f97708bcea9525d8925

SHA512
20ac81ae8fac45868889549c3788f77e70a92f274d59a51c1f3616512dd88e7500d98c4ca701458d85ae07bdde288c19d179b6f584fac2a796501efb89c435df

Download Submit
\ProgramData\0141f24c463d89\cred.dll

MD5
58aa6a0e1923c2ae8687002f99ae11e7

SHA1
aff5b58ade42b0b7f94cfccd4add1f90ee3625af

SHA256
a0e73f0fa699b65d0c5b64eaa3ca5d34c05cff8ce1508f97708bcea9525d8925

SHA512
20ac81ae8fac45868889549c3788f77e70a92f274d59a51c1f3616512dd88e7500d98c4ca701458d85ae07bdde288c19d179b6f584fac2a796501efb89c435df

Download Submit
\ProgramData\0141f24c463d89\scr.dll

MD5
245f28842136da057208ab20cb12c61a

SHA1
2abcffe6b5c431fe398ac43b2aaddd41c6ca6f07

SHA256
e5e8cbb2152b17973025214732bd0abc8a416ecd8a42a7b7e4e766cc10adf45b

SHA512
c1e6dbedf6a4bee7d78bfa2904c3f9218d5df67fd0f86f9539743858a444c265036a310ffded0d8829162b92240049a7591a21a419982adc7fa6c749ba7828e4

Download Submit
\ProgramData\0141f24c463d89\scr.dll

MD5
245f28842136da057208ab20cb12c61a

SHA1
2abcffe6b5c431fe398ac43b2aaddd41c6ca6f07

SHA256
e5e8cbb2152b17973025214732bd0abc8a416ecd8a42a7b7e4e766cc10adf45b

SHA512
c1e6dbedf6a4bee7d78bfa2904c3f9218d5df67fd0f86f9539743858a444c265036a310ffded0d8829162b92240049a7591a21a419982adc7fa6c749ba7828e4

Download Submit
\ProgramData\0141f24c463d89\scr.dll

MD5
245f28842136da057208ab20cb12c61a

SHA1
2abcffe6b5c431fe398ac43b2aaddd41c6ca6f07

SHA256
e5e8cbb2152b17973025214732bd0abc8a416ecd8a42a7b7e4e766cc10adf45b

SHA512
c1e6dbedf6a4bee7d78bfa2904c3f9218d5df67fd0f86f9539743858a444c265036a310ffded0d8829162b92240049a7591a21a419982adc7fa6c749ba7828e4

Download Submit
\ProgramData\0141f24c463d89\scr.dll

MD5
245f28842136da057208ab20cb12c61a

SHA1
2abcffe6b5c431fe398ac43b2aaddd41c6ca6f07

SHA256
e5e8cbb2152b17973025214732bd0abc8a416ecd8a42a7b7e4e766cc10adf45b

SHA512
c1e6dbedf6a4bee7d78bfa2904c3f9218d5df67fd0f86f9539743858a444c265036a310ffded0d8829162b92240049a7591a21a419982adc7fa6c749ba7828e4

Download Submit
\ProgramData\80373760c0\rween.exe

MD5
de602f032c362bdc1440d7a92874cd6f

SHA1
2682a13d58b90bbeeb722e5494924f86d083ff90

SHA256
b58f6d597c88e79bb34ee776227be235121b7a0f6b99170ff57ff66a96a940ed

SHA512
a33f99cc8d3af10a4341002a45f3f5055c29442dd05bccb1e705dcb6f01781964bc2048b15c05b871909289706c59a6df2b15ff14e5ec9d6069358844614a12f

Download Submit
\ProgramData\80373760c0\rween.exe

MD5
de602f032c362bdc1440d7a92874cd6f

SHA1
2682a13d58b90bbeeb722e5494924f86d083ff90

SHA256
b58f6d597c88e79bb34ee776227be235121b7a0f6b99170ff57ff66a96a940ed

SHA512
a33f99cc8d3af10a4341002a45f3f5055c29442dd05bccb1e705dcb6f01781964bc2048b15c05b871909289706c59a6df2b15ff14e5ec9d6069358844614a12f

Download Submit
memory/592-10-0x0000000000AF0000-0x0000000000B01000-memory.dmp

Filesize
68KB

Download
memory/592-6-0x0000000000000000-mapping.dmp

Download
memory/1204-18-0x0000000000000000-mapping.dmp

Download
memory/1264-25-0x0000000000000000-mapping.dmp

Download
memory/1292-14-0x0000000000000000-mapping.dmp

Download
memory/1564-17-0x000007FEF7FE0000-0x000007FEF825A000-memory.dmp

Filesize
2.5MB

Download
memory/1724-13-0x0000000000000000-mapping.dmp

Download
memory/1824-2-0x0000000000A70000-0x0000000000A81000-memory.dmp

Filesize
68KB

Download
memory/1824-9-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1824-8-0x00000000001B0000-0x00000000001E2000-memory.dmp

Filesize
200KB

Download
memory/1824-3-0x00000000760F1000-0x00000000760F3000-memory.dmp

Filesize
8KB

Download