amadey | b58f6d597c88e79bb34ee776227be235121b7a0f6b99170ff57ff66a96a940ed

General

Target

OOO Tochka.exe
Size

198KB
MD5

de602f032c362bdc1440d7a92874cd6f
SHA1

2682a13d58b90bbeeb722e5494924f86d083ff90
SHA256

b58f6d597c88e79bb34ee776227be235121b7a0f6b99170ff57ff66a96a940ed
SHA512

a33f99cc8d3af10a4341002a45f3f5055c29442dd05bccb1e705dcb6f01781964bc2048b15c05b871909289706c59a6df2b15ff14e5ec9d6069358844614a12f

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

2.11

C2

185.215.113.17/jG3cs2rP/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exerundll32.exe

flow pid process

18 2136 rundll32.exe
19 3868 rundll32.exe
Executes dropped EXE 1 IoCs

Processes:

rween.exe

pid process

3884 rween.exe
Loads dropped DLL 3 IoCs

Processes:

rundll32.exerundll32.exe

pid process

2136 rundll32.exe
2136 rundll32.exe
3868 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

2136 rundll32.exe
2136 rundll32.exe
2136 rundll32.exe
2136 rundll32.exe

flow	pid	process
18	2136	rundll32.exe
19	3868	rundll32.exe

pid	process
3884	rween.exe

pid	process
2136	rundll32.exe
2136	rundll32.exe
3868	rundll32.exe

pid	process
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe
2136	rundll32.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

OOO Tochka.exerween.execmd.exe

description	pid	process	target process
PID 492 wrote to memory of 3884	492	OOO Tochka.exe	rween.exe
PID 492 wrote to memory of 3884	492	OOO Tochka.exe	rween.exe
PID 492 wrote to memory of 3884	492	OOO Tochka.exe	rween.exe
PID 3884 wrote to memory of 2896	3884	rween.exe	cmd.exe
PID 3884 wrote to memory of 2896	3884	rween.exe	cmd.exe
PID 3884 wrote to memory of 2896	3884	rween.exe	cmd.exe
PID 2896 wrote to memory of 504	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 504	2896	cmd.exe	reg.exe
PID 2896 wrote to memory of 504	2896	cmd.exe	reg.exe
PID 3884 wrote to memory of 2136	3884	rween.exe	rundll32.exe
PID 3884 wrote to memory of 2136	3884	rween.exe	rundll32.exe
PID 3884 wrote to memory of 2136	3884	rween.exe	rundll32.exe
PID 3884 wrote to memory of 3868	3884	rween.exe	rundll32.exe
PID 3884 wrote to memory of 3868	3884	rween.exe	rundll32.exe
PID 3884 wrote to memory of 3868	3884	rween.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\OOO Tochka.exe
"C:\Users\Admin\AppData\Local\Temp\OOO Tochka.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:492
- C:\ProgramData\80373760c0\rween.exe
  "C:\ProgramData\80373760c0\rween.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\80373760c0\
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\80373760c0\
      4⤵
      PID:504
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\ProgramData\0141f24c463d89\cred.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2136
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\ProgramData\0141f24c463d89\scr.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    PID:3868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\0141f24c463d89\cred.dll

MD5
58aa6a0e1923c2ae8687002f99ae11e7

SHA1
aff5b58ade42b0b7f94cfccd4add1f90ee3625af

SHA256
a0e73f0fa699b65d0c5b64eaa3ca5d34c05cff8ce1508f97708bcea9525d8925

SHA512
20ac81ae8fac45868889549c3788f77e70a92f274d59a51c1f3616512dd88e7500d98c4ca701458d85ae07bdde288c19d179b6f584fac2a796501efb89c435df

Download Submit
C:\ProgramData\0141f24c463d89\scr.dll

MD5
245f28842136da057208ab20cb12c61a

SHA1
2abcffe6b5c431fe398ac43b2aaddd41c6ca6f07

SHA256
e5e8cbb2152b17973025214732bd0abc8a416ecd8a42a7b7e4e766cc10adf45b

SHA512
c1e6dbedf6a4bee7d78bfa2904c3f9218d5df67fd0f86f9539743858a444c265036a310ffded0d8829162b92240049a7591a21a419982adc7fa6c749ba7828e4

Download Submit
C:\ProgramData\152133414903337197415362

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\ProgramData\80373760c0\rween.exe

MD5
de602f032c362bdc1440d7a92874cd6f

SHA1
2682a13d58b90bbeeb722e5494924f86d083ff90

SHA256
b58f6d597c88e79bb34ee776227be235121b7a0f6b99170ff57ff66a96a940ed

SHA512
a33f99cc8d3af10a4341002a45f3f5055c29442dd05bccb1e705dcb6f01781964bc2048b15c05b871909289706c59a6df2b15ff14e5ec9d6069358844614a12f

Download Submit
C:\ProgramData\80373760c0\rween.exe

MD5
de602f032c362bdc1440d7a92874cd6f

SHA1
2682a13d58b90bbeeb722e5494924f86d083ff90

SHA256
b58f6d597c88e79bb34ee776227be235121b7a0f6b99170ff57ff66a96a940ed

SHA512
a33f99cc8d3af10a4341002a45f3f5055c29442dd05bccb1e705dcb6f01781964bc2048b15c05b871909289706c59a6df2b15ff14e5ec9d6069358844614a12f

Download Submit
\ProgramData\0141f24c463d89\cred.dll

MD5
58aa6a0e1923c2ae8687002f99ae11e7

SHA1
aff5b58ade42b0b7f94cfccd4add1f90ee3625af

SHA256
a0e73f0fa699b65d0c5b64eaa3ca5d34c05cff8ce1508f97708bcea9525d8925

SHA512
20ac81ae8fac45868889549c3788f77e70a92f274d59a51c1f3616512dd88e7500d98c4ca701458d85ae07bdde288c19d179b6f584fac2a796501efb89c435df

Download Submit
\ProgramData\0141f24c463d89\cred.dll

MD5
58aa6a0e1923c2ae8687002f99ae11e7

SHA1
aff5b58ade42b0b7f94cfccd4add1f90ee3625af

SHA256
a0e73f0fa699b65d0c5b64eaa3ca5d34c05cff8ce1508f97708bcea9525d8925

SHA512
20ac81ae8fac45868889549c3788f77e70a92f274d59a51c1f3616512dd88e7500d98c4ca701458d85ae07bdde288c19d179b6f584fac2a796501efb89c435df

Download Submit
\ProgramData\0141f24c463d89\scr.dll

MD5
245f28842136da057208ab20cb12c61a

SHA1
2abcffe6b5c431fe398ac43b2aaddd41c6ca6f07

SHA256
e5e8cbb2152b17973025214732bd0abc8a416ecd8a42a7b7e4e766cc10adf45b

SHA512
c1e6dbedf6a4bee7d78bfa2904c3f9218d5df67fd0f86f9539743858a444c265036a310ffded0d8829162b92240049a7591a21a419982adc7fa6c749ba7828e4

Download Submit
memory/492-7-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/492-6-0x0000000000A80000-0x0000000000AB2000-memory.dmp

Filesize
200KB

Download
memory/492-2-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

Filesize
4KB

Download
memory/504-11-0x0000000000000000-mapping.dmp

Download
memory/2136-14-0x0000000000000000-mapping.dmp

Download
memory/2136-18-0x0000000002641000-0x000000000265B000-memory.dmp

Filesize
104KB

Download
memory/2896-10-0x0000000000000000-mapping.dmp

Download
memory/3868-19-0x0000000000000000-mapping.dmp

Download
memory/3884-8-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download
memory/3884-3-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing