amadey | 98d1aae2b75e1bc8086558b25489e6a808ecb1cbd361b2ddd9cc8c8ac6d7f03b

General

Target

4EB21D088F620A9F5C312849430476F6.exe
Size

292KB
MD5

4eb21d088f620a9f5c312849430476f6
SHA1

3b882b42b65067530fc51f490dd06b4ce2966acd
SHA256

98d1aae2b75e1bc8086558b25489e6a808ecb1cbd361b2ddd9cc8c8ac6d7f03b
SHA512

163e02345376d5730cb7b11b1514a4edeee776ff4d8756cb56fe152844297e26cbe1c4d71f17c6e1a790ddbcc83ad5636e1260b45212a75870742b46171954c3

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

2.15

C2

umbrelladownload.uno/gp6GbqVce/index.php

umbrelladownload.fun/gp6GbqVce/index.php

umbrelladownload.host/gp6GbqVce/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Executes dropped EXE 1 IoCs

Processes:

jmgas.exe

pid process

2040 jmgas.exe
Loads dropped DLL 2 IoCs

Processes:

4EB21D088F620A9F5C312849430476F6.exe

pid process

1848 4EB21D088F620A9F5C312849430476F6.exe
1848 4EB21D088F620A9F5C312849430476F6.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
2040	jmgas.exe

pid	process
1848	4EB21D088F620A9F5C312849430476F6.exe
1848	4EB21D088F620A9F5C312849430476F6.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

4EB21D088F620A9F5C312849430476F6.exejmgas.execmd.exe

description	pid	process	target process
PID 1848 wrote to memory of 2040	1848	4EB21D088F620A9F5C312849430476F6.exe	jmgas.exe
PID 1848 wrote to memory of 2040	1848	4EB21D088F620A9F5C312849430476F6.exe	jmgas.exe
PID 1848 wrote to memory of 2040	1848	4EB21D088F620A9F5C312849430476F6.exe	jmgas.exe
PID 1848 wrote to memory of 2040	1848	4EB21D088F620A9F5C312849430476F6.exe	jmgas.exe
PID 2040 wrote to memory of 1076	2040	jmgas.exe	cmd.exe
PID 2040 wrote to memory of 1076	2040	jmgas.exe	cmd.exe
PID 2040 wrote to memory of 1076	2040	jmgas.exe	cmd.exe
PID 2040 wrote to memory of 1076	2040	jmgas.exe	cmd.exe
PID 1076 wrote to memory of 1728	1076	cmd.exe	reg.exe
PID 1076 wrote to memory of 1728	1076	cmd.exe	reg.exe
PID 1076 wrote to memory of 1728	1076	cmd.exe	reg.exe
PID 1076 wrote to memory of 1728	1076	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\4EB21D088F620A9F5C312849430476F6.exe
"C:\Users\Admin\AppData\Local\Temp\4EB21D088F620A9F5C312849430476F6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1848

C:\ProgramData\a3ec9f3b74\jmgas.exe
"C:\ProgramData\a3ec9f3b74\jmgas.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\a3ec9f3b74\
3⤵
- Suspicious use of WriteProcessMemory
PID:1076

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\a3ec9f3b74\
4⤵
PID:1728

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\152124553523681077083310
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\ProgramData\a3ec9f3b74\jmgas.exe
MD5
4eb21d088f620a9f5c312849430476f6

SHA1
3b882b42b65067530fc51f490dd06b4ce2966acd

SHA256
98d1aae2b75e1bc8086558b25489e6a808ecb1cbd361b2ddd9cc8c8ac6d7f03b

SHA512
163e02345376d5730cb7b11b1514a4edeee776ff4d8756cb56fe152844297e26cbe1c4d71f17c6e1a790ddbcc83ad5636e1260b45212a75870742b46171954c3

Download Submit
\ProgramData\a3ec9f3b74\jmgas.exe
MD5
4eb21d088f620a9f5c312849430476f6

SHA1
3b882b42b65067530fc51f490dd06b4ce2966acd

SHA256
98d1aae2b75e1bc8086558b25489e6a808ecb1cbd361b2ddd9cc8c8ac6d7f03b

SHA512
163e02345376d5730cb7b11b1514a4edeee776ff4d8756cb56fe152844297e26cbe1c4d71f17c6e1a790ddbcc83ad5636e1260b45212a75870742b46171954c3

Download Submit
\ProgramData\a3ec9f3b74\jmgas.exe
MD5
4eb21d088f620a9f5c312849430476f6

SHA1
3b882b42b65067530fc51f490dd06b4ce2966acd

SHA256
98d1aae2b75e1bc8086558b25489e6a808ecb1cbd361b2ddd9cc8c8ac6d7f03b

SHA512
163e02345376d5730cb7b11b1514a4edeee776ff4d8756cb56fe152844297e26cbe1c4d71f17c6e1a790ddbcc83ad5636e1260b45212a75870742b46171954c3

Download Submit
memory/1076-68-0x0000000000000000-mapping.dmp

Download
memory/1728-69-0x0000000000000000-mapping.dmp

Download
memory/1848-59-0x00000000757C1000-0x00000000757C3000-memory.dmp

Filesize
8KB

Download
memory/1848-64-0x0000000000310000-0x0000000000341000-memory.dmp

Filesize
196KB

Download
memory/1848-65-0x0000000000400000-0x0000000000A22000-memory.dmp

Filesize
6.1MB

Download
memory/2040-62-0x0000000000000000-mapping.dmp

Download
memory/2040-71-0x0000000000400000-0x0000000000A22000-memory.dmp

Filesize
6.1MB

Download

Analysis

Sharing