Analysis

  • max time kernel
    125s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    20-02-2021 09:13

General

  • Target

    5522f4b9234aea8bbc17670cb1cfd322.exe

  • Size

    295KB

  • MD5

    5522f4b9234aea8bbc17670cb1cfd322

  • SHA1

    cabd799a2db28208367acc365227f3916d4e0cd0

  • SHA256

    3abf0b6da06a8740f91acf87b964de2b314220cf14226b003af9c97acd2ce926

  • SHA512

    589ab3896a4af81a100844d4b12c17c355b10f850b73827bfb4c5e88c3e7aa445c79411463b7e91e8110c0d1823585c80bbb53c579094d585e218188b1f4b365

Score
10/10

Malware Config

Extracted

Family

amadey

Version

2.11

C2

176.111.174.67/7Ndd3SnW/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Blocklisted process makes network request 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5522f4b9234aea8bbc17670cb1cfd322.exe
    "C:\Users\Admin\AppData\Local\Temp\5522f4b9234aea8bbc17670cb1cfd322.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\ProgramData\011ab573a3\rween.exe
      "C:\ProgramData\011ab573a3\rween.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1984
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\011ab573a3\
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1936
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\011ab573a3\
          4⤵
            PID:1728
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\ProgramData\5eba991cccd123\cred.dll, Main
          3⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          PID:636
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\ProgramData\5eba991cccd123\scr.dll, Main
          3⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          PID:796

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\011ab573a3\rween.exe
      MD5

      5522f4b9234aea8bbc17670cb1cfd322

      SHA1

      cabd799a2db28208367acc365227f3916d4e0cd0

      SHA256

      3abf0b6da06a8740f91acf87b964de2b314220cf14226b003af9c97acd2ce926

      SHA512

      589ab3896a4af81a100844d4b12c17c355b10f850b73827bfb4c5e88c3e7aa445c79411463b7e91e8110c0d1823585c80bbb53c579094d585e218188b1f4b365

    • C:\ProgramData\152138250354662522850611
      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    • C:\ProgramData\5eba991cccd123\cred.dll
      MD5

      69b7615f2767c3435f2479efdca30177

      SHA1

      a6d8c6d2bdef56a7197fef6fe79774338df50531

      SHA256

      6f917b86c623a4ef2326de062cb206208b25d93f6d7a2911bc7c10f7c83ffd64

      SHA512

      749ef5551228d6b92288e4a725a27cb0023f5e3d73d7b76b9e42cbb88d3ff8a5cf12978da46b814f921fd850570a94194b571fb330f09ad4fc7540ecf823fcee

    • C:\ProgramData\5eba991cccd123\scr.dll
      MD5

      f1c71bbc5b99ab01a8ec7c63a2e12242

      SHA1

      ad9b2fd325fff790b732be40d3b2182daa43cfa2

      SHA256

      3d0efa67d54ee1452aa53f35db5552fe079adfd14f1fe312097b266943dd9644

      SHA512

      50b3909ff042b8bb20b87fbb6a29ffb102b83519845f36d99d7ffb0d0441354e7c77dd5db10662b6f6bb7ff9761104bc2243b2616b8ade90119ad79b430f1fc2

    • \ProgramData\011ab573a3\rween.exe
      MD5

      5522f4b9234aea8bbc17670cb1cfd322

      SHA1

      cabd799a2db28208367acc365227f3916d4e0cd0

      SHA256

      3abf0b6da06a8740f91acf87b964de2b314220cf14226b003af9c97acd2ce926

      SHA512

      589ab3896a4af81a100844d4b12c17c355b10f850b73827bfb4c5e88c3e7aa445c79411463b7e91e8110c0d1823585c80bbb53c579094d585e218188b1f4b365

    • \ProgramData\011ab573a3\rween.exe
      MD5

      5522f4b9234aea8bbc17670cb1cfd322

      SHA1

      cabd799a2db28208367acc365227f3916d4e0cd0

      SHA256

      3abf0b6da06a8740f91acf87b964de2b314220cf14226b003af9c97acd2ce926

      SHA512

      589ab3896a4af81a100844d4b12c17c355b10f850b73827bfb4c5e88c3e7aa445c79411463b7e91e8110c0d1823585c80bbb53c579094d585e218188b1f4b365

    • \ProgramData\5eba991cccd123\cred.dll
      MD5

      69b7615f2767c3435f2479efdca30177

      SHA1

      a6d8c6d2bdef56a7197fef6fe79774338df50531

      SHA256

      6f917b86c623a4ef2326de062cb206208b25d93f6d7a2911bc7c10f7c83ffd64

      SHA512

      749ef5551228d6b92288e4a725a27cb0023f5e3d73d7b76b9e42cbb88d3ff8a5cf12978da46b814f921fd850570a94194b571fb330f09ad4fc7540ecf823fcee

    • \ProgramData\5eba991cccd123\cred.dll
      MD5

      69b7615f2767c3435f2479efdca30177

      SHA1

      a6d8c6d2bdef56a7197fef6fe79774338df50531

      SHA256

      6f917b86c623a4ef2326de062cb206208b25d93f6d7a2911bc7c10f7c83ffd64

      SHA512

      749ef5551228d6b92288e4a725a27cb0023f5e3d73d7b76b9e42cbb88d3ff8a5cf12978da46b814f921fd850570a94194b571fb330f09ad4fc7540ecf823fcee

    • \ProgramData\5eba991cccd123\cred.dll
      MD5

      69b7615f2767c3435f2479efdca30177

      SHA1

      a6d8c6d2bdef56a7197fef6fe79774338df50531

      SHA256

      6f917b86c623a4ef2326de062cb206208b25d93f6d7a2911bc7c10f7c83ffd64

      SHA512

      749ef5551228d6b92288e4a725a27cb0023f5e3d73d7b76b9e42cbb88d3ff8a5cf12978da46b814f921fd850570a94194b571fb330f09ad4fc7540ecf823fcee

    • \ProgramData\5eba991cccd123\cred.dll
      MD5

      69b7615f2767c3435f2479efdca30177

      SHA1

      a6d8c6d2bdef56a7197fef6fe79774338df50531

      SHA256

      6f917b86c623a4ef2326de062cb206208b25d93f6d7a2911bc7c10f7c83ffd64

      SHA512

      749ef5551228d6b92288e4a725a27cb0023f5e3d73d7b76b9e42cbb88d3ff8a5cf12978da46b814f921fd850570a94194b571fb330f09ad4fc7540ecf823fcee

    • \ProgramData\5eba991cccd123\scr.dll
      MD5

      f1c71bbc5b99ab01a8ec7c63a2e12242

      SHA1

      ad9b2fd325fff790b732be40d3b2182daa43cfa2

      SHA256

      3d0efa67d54ee1452aa53f35db5552fe079adfd14f1fe312097b266943dd9644

      SHA512

      50b3909ff042b8bb20b87fbb6a29ffb102b83519845f36d99d7ffb0d0441354e7c77dd5db10662b6f6bb7ff9761104bc2243b2616b8ade90119ad79b430f1fc2

    • \ProgramData\5eba991cccd123\scr.dll
      MD5

      f1c71bbc5b99ab01a8ec7c63a2e12242

      SHA1

      ad9b2fd325fff790b732be40d3b2182daa43cfa2

      SHA256

      3d0efa67d54ee1452aa53f35db5552fe079adfd14f1fe312097b266943dd9644

      SHA512

      50b3909ff042b8bb20b87fbb6a29ffb102b83519845f36d99d7ffb0d0441354e7c77dd5db10662b6f6bb7ff9761104bc2243b2616b8ade90119ad79b430f1fc2

    • \ProgramData\5eba991cccd123\scr.dll
      MD5

      f1c71bbc5b99ab01a8ec7c63a2e12242

      SHA1

      ad9b2fd325fff790b732be40d3b2182daa43cfa2

      SHA256

      3d0efa67d54ee1452aa53f35db5552fe079adfd14f1fe312097b266943dd9644

      SHA512

      50b3909ff042b8bb20b87fbb6a29ffb102b83519845f36d99d7ffb0d0441354e7c77dd5db10662b6f6bb7ff9761104bc2243b2616b8ade90119ad79b430f1fc2

    • \ProgramData\5eba991cccd123\scr.dll
      MD5

      f1c71bbc5b99ab01a8ec7c63a2e12242

      SHA1

      ad9b2fd325fff790b732be40d3b2182daa43cfa2

      SHA256

      3d0efa67d54ee1452aa53f35db5552fe079adfd14f1fe312097b266943dd9644

      SHA512

      50b3909ff042b8bb20b87fbb6a29ffb102b83519845f36d99d7ffb0d0441354e7c77dd5db10662b6f6bb7ff9761104bc2243b2616b8ade90119ad79b430f1fc2

    • memory/636-18-0x0000000000000000-mapping.dmp
    • memory/796-25-0x0000000000000000-mapping.dmp
    • memory/1684-15-0x0000000000400000-0x0000000000430000-memory.dmp
      Filesize

      192KB

    • memory/1684-2-0x0000000006A00000-0x0000000006A11000-memory.dmp
      Filesize

      68KB

    • memory/1684-14-0x0000000000240000-0x000000000026C000-memory.dmp
      Filesize

      176KB

    • memory/1684-3-0x00000000756A1000-0x00000000756A3000-memory.dmp
      Filesize

      8KB

    • memory/1696-13-0x000007FEF7C10000-0x000007FEF7E8A000-memory.dmp
      Filesize

      2.5MB

    • memory/1728-12-0x0000000000000000-mapping.dmp
    • memory/1936-11-0x0000000000000000-mapping.dmp
    • memory/1984-8-0x0000000006B80000-0x0000000006B91000-memory.dmp
      Filesize

      68KB

    • memory/1984-6-0x0000000000000000-mapping.dmp