amadey | b58f6d597c88e79bb34ee776227be235121b7a0f6b99170ff57ff66a96a940ed

General

Target

OOO Tochka.exe
Size

198KB
MD5

de602f032c362bdc1440d7a92874cd6f
SHA1

2682a13d58b90bbeeb722e5494924f86d083ff90
SHA256

b58f6d597c88e79bb34ee776227be235121b7a0f6b99170ff57ff66a96a940ed
SHA512

a33f99cc8d3af10a4341002a45f3f5055c29442dd05bccb1e705dcb6f01781964bc2048b15c05b871909289706c59a6df2b15ff14e5ec9d6069358844614a12f

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

2.11

C2

185.215.113.17/jG3cs2rP/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Blocklisted process makes network request 2 IoCs

flow	pid	Process
7	1204	rundll32.exe
8	1264	rundll32.exe

Executes dropped EXE 1 IoCs

pid	Process
592	rween.exe

Loads dropped DLL 10 IoCs

pid	Process
1824	OOO Tochka.exe
1824	OOO Tochka.exe
1204	rundll32.exe
1204	rundll32.exe
1204	rundll32.exe
1204	rundll32.exe
1264	rundll32.exe
1264	rundll32.exe
1264	rundll32.exe
1264	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1204	rundll32.exe
1204	rundll32.exe
1204	rundll32.exe
1204	rundll32.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 592	1824	OOO Tochka.exe	27
PID 1824 wrote to memory of 592	1824	OOO Tochka.exe	27
PID 1824 wrote to memory of 592	1824	OOO Tochka.exe	27
PID 1824 wrote to memory of 592	1824	OOO Tochka.exe	27
PID 592 wrote to memory of 1724	592	rween.exe	30
PID 592 wrote to memory of 1724	592	rween.exe	30
PID 592 wrote to memory of 1724	592	rween.exe	30
PID 592 wrote to memory of 1724	592	rween.exe	30
PID 1724 wrote to memory of 1292	1724	cmd.exe	32
PID 1724 wrote to memory of 1292	1724	cmd.exe	32
PID 1724 wrote to memory of 1292	1724	cmd.exe	32
PID 1724 wrote to memory of 1292	1724	cmd.exe	32
PID 592 wrote to memory of 1204	592	rween.exe	35
PID 592 wrote to memory of 1204	592	rween.exe	35
PID 592 wrote to memory of 1204	592	rween.exe	35
PID 592 wrote to memory of 1204	592	rween.exe	35
PID 592 wrote to memory of 1204	592	rween.exe	35
PID 592 wrote to memory of 1204	592	rween.exe	35
PID 592 wrote to memory of 1204	592	rween.exe	35
PID 592 wrote to memory of 1264	592	rween.exe	36
PID 592 wrote to memory of 1264	592	rween.exe	36
PID 592 wrote to memory of 1264	592	rween.exe	36
PID 592 wrote to memory of 1264	592	rween.exe	36
PID 592 wrote to memory of 1264	592	rween.exe	36
PID 592 wrote to memory of 1264	592	rween.exe	36
PID 592 wrote to memory of 1264	592	rween.exe	36

C:\Users\Admin\AppData\Local\Temp\OOO Tochka.exe
"C:\Users\Admin\AppData\Local\Temp\OOO Tochka.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1824
- C:\ProgramData\80373760c0\rween.exe
  "C:\ProgramData\80373760c0\rween.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:592
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\80373760c0\
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1724
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\80373760c0\
      4⤵
      PID:1292
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\ProgramData\0141f24c463d89\cred.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1204
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\ProgramData\0141f24c463d89\scr.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    PID:1264

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/592-10-0x0000000000AF0000-0x0000000000B01000-memory.dmp

Filesize
68KB

Download
memory/1564-17-0x000007FEF7FE0000-0x000007FEF825A000-memory.dmp

Filesize
2.5MB

Download
memory/1824-2-0x0000000000A70000-0x0000000000A81000-memory.dmp

Filesize
68KB

Download
memory/1824-9-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1824-8-0x00000000001B0000-0x00000000001E2000-memory.dmp

Filesize
200KB

Download
memory/1824-3-0x00000000760F1000-0x00000000760F3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing