amadey | b58f6d597c88e79bb34ee776227be235121b7a0f6b99170ff57ff66a96a940ed

General

Target

OOO Tochka.exe
Size

198KB
MD5

de602f032c362bdc1440d7a92874cd6f
SHA1

2682a13d58b90bbeeb722e5494924f86d083ff90
SHA256

b58f6d597c88e79bb34ee776227be235121b7a0f6b99170ff57ff66a96a940ed
SHA512

a33f99cc8d3af10a4341002a45f3f5055c29442dd05bccb1e705dcb6f01781964bc2048b15c05b871909289706c59a6df2b15ff14e5ec9d6069358844614a12f

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

2.11

C2

185.215.113.17/jG3cs2rP/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Blocklisted process makes network request 2 IoCs

flow	pid	Process
18	2136	rundll32.exe
19	3868	rundll32.exe

Executes dropped EXE 1 IoCs

pid	Process
3884	rween.exe

Loads dropped DLL 3 IoCs

pid	Process
2136	rundll32.exe
2136	rundll32.exe
3868	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 492 wrote to memory of 3884	492	OOO Tochka.exe	75
PID 492 wrote to memory of 3884	492	OOO Tochka.exe	75
PID 492 wrote to memory of 3884	492	OOO Tochka.exe	75
PID 3884 wrote to memory of 2896	3884	rween.exe	78
PID 3884 wrote to memory of 2896	3884	rween.exe	78
PID 3884 wrote to memory of 2896	3884	rween.exe	78
PID 2896 wrote to memory of 504	2896	cmd.exe	80
PID 2896 wrote to memory of 504	2896	cmd.exe	80
PID 2896 wrote to memory of 504	2896	cmd.exe	80
PID 3884 wrote to memory of 2136	3884	rween.exe	82
PID 3884 wrote to memory of 2136	3884	rween.exe	82
PID 3884 wrote to memory of 2136	3884	rween.exe	82
PID 3884 wrote to memory of 3868	3884	rween.exe	83
PID 3884 wrote to memory of 3868	3884	rween.exe	83
PID 3884 wrote to memory of 3868	3884	rween.exe	83

C:\Users\Admin\AppData\Local\Temp\OOO Tochka.exe
"C:\Users\Admin\AppData\Local\Temp\OOO Tochka.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:492
- C:\ProgramData\80373760c0\rween.exe
  "C:\ProgramData\80373760c0\rween.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\80373760c0\
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\80373760c0\
      4⤵
      PID:504
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\ProgramData\0141f24c463d89\cred.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2136
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\ProgramData\0141f24c463d89\scr.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    PID:3868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/492-7-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/492-6-0x0000000000A80000-0x0000000000AB2000-memory.dmp

Filesize
200KB

Download
memory/492-2-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

Filesize
4KB

Download
memory/2136-18-0x0000000002641000-0x000000000265B000-memory.dmp

Filesize
104KB

Download
memory/3884-8-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing