amadey | 2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7

General

Target

2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe
Size

333KB
MD5

b77d9cf0898f11009292cdddbeaf379d
SHA1

2af64c3097373bf1a583d43d4ff30487ad5b9646
SHA256

2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7
SHA512

9e06f410a7c3a6712a601de289d7172f4473825f052ac1fc1b5a6cb9633feaaa8aac33e59114c0237907576b316cc3e393563bd3f7e66df287b3f0c3c45303a3

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

2.14

C2

cdn12-web-security.com/gf4EdsW/index.php

shegw583reg.hopto.org/gf4EdsW/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Executes dropped EXE 2 IoCs

Processes:

brdm.exebrdm.exe

pid process

2004 brdm.exe
1780 brdm.exe

pid	process
2004	brdm.exe
1780	brdm.exe

Loads dropped DLL 3 IoCs

Processes:

2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exebrdm.exe

pid	process
1964	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe
1964	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe
2004	brdm.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exebrdm.exe

pid	process
1964	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe
1964	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe
1780	brdm.exe
1780	brdm.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exebrdm.exe

description	pid	process	target process
PID 1688 set thread context of 1964	1688	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe
PID 2004 set thread context of 1780	2004	brdm.exe	brdm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

brdm.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	brdm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	brdm.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exebrdm.exe

pid process

1688 2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe
2004 brdm.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exebrdm.exe

pid process

1688 2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe
2004 brdm.exe

pid	process
1688	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe
2004	brdm.exe

pid	process
1688	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe
2004	brdm.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exebrdm.exebrdm.execmd.exe

description	pid	process	target process
PID 1688 wrote to memory of 1964	1688	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe
PID 1688 wrote to memory of 1964	1688	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe
PID 1688 wrote to memory of 1964	1688	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe
PID 1688 wrote to memory of 1964	1688	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe
PID 1688 wrote to memory of 1964	1688	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe
PID 1964 wrote to memory of 2004	1964	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe	brdm.exe
PID 1964 wrote to memory of 2004	1964	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe	brdm.exe
PID 1964 wrote to memory of 2004	1964	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe	brdm.exe
PID 1964 wrote to memory of 2004	1964	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe	brdm.exe
PID 2004 wrote to memory of 1780	2004	brdm.exe	brdm.exe
PID 2004 wrote to memory of 1780	2004	brdm.exe	brdm.exe
PID 2004 wrote to memory of 1780	2004	brdm.exe	brdm.exe
PID 2004 wrote to memory of 1780	2004	brdm.exe	brdm.exe
PID 2004 wrote to memory of 1780	2004	brdm.exe	brdm.exe
PID 1780 wrote to memory of 2036	1780	brdm.exe	cmd.exe
PID 1780 wrote to memory of 2036	1780	brdm.exe	cmd.exe
PID 1780 wrote to memory of 2036	1780	brdm.exe	cmd.exe
PID 1780 wrote to memory of 2036	1780	brdm.exe	cmd.exe
PID 2036 wrote to memory of 884	2036	cmd.exe	reg.exe
PID 2036 wrote to memory of 884	2036	cmd.exe	reg.exe
PID 2036 wrote to memory of 884	2036	cmd.exe	reg.exe
PID 2036 wrote to memory of 884	2036	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe
"C:\Users\Admin\AppData\Local\Temp\2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688

C:\Users\Admin\AppData\Local\Temp\2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe
"C:\Users\Admin\AppData\Local\Temp\2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe"
2⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1964

C:\ProgramData\04bbb7d123\brdm.exe
"C:\ProgramData\04bbb7d123\brdm.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004

C:\ProgramData\04bbb7d123\brdm.exe
"C:\ProgramData\04bbb7d123\brdm.exe"
4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1780

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\04bbb7d123\
5⤵
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\04bbb7d123\
6⤵
PID:884

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1

T1130

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\04bbb7d123\brdm.exe
MD5
b77d9cf0898f11009292cdddbeaf379d

SHA1
2af64c3097373bf1a583d43d4ff30487ad5b9646

SHA256
2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7

SHA512
9e06f410a7c3a6712a601de289d7172f4473825f052ac1fc1b5a6cb9633feaaa8aac33e59114c0237907576b316cc3e393563bd3f7e66df287b3f0c3c45303a3

Download Submit
C:\ProgramData\04bbb7d123\brdm.exe
MD5
b77d9cf0898f11009292cdddbeaf379d

SHA1
2af64c3097373bf1a583d43d4ff30487ad5b9646

SHA256
2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7

SHA512
9e06f410a7c3a6712a601de289d7172f4473825f052ac1fc1b5a6cb9633feaaa8aac33e59114c0237907576b316cc3e393563bd3f7e66df287b3f0c3c45303a3

Download Submit
C:\ProgramData\04bbb7d123\brdm.exe
MD5
b77d9cf0898f11009292cdddbeaf379d

SHA1
2af64c3097373bf1a583d43d4ff30487ad5b9646

SHA256
2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7

SHA512
9e06f410a7c3a6712a601de289d7172f4473825f052ac1fc1b5a6cb9633feaaa8aac33e59114c0237907576b316cc3e393563bd3f7e66df287b3f0c3c45303a3

Download Submit
C:\ProgramData\152125132832309319232775
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\ProgramData\04bbb7d123\brdm.exe
MD5
b77d9cf0898f11009292cdddbeaf379d

SHA1
2af64c3097373bf1a583d43d4ff30487ad5b9646

SHA256
2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7

SHA512
9e06f410a7c3a6712a601de289d7172f4473825f052ac1fc1b5a6cb9633feaaa8aac33e59114c0237907576b316cc3e393563bd3f7e66df287b3f0c3c45303a3

Download Submit
\ProgramData\04bbb7d123\brdm.exe
MD5
b77d9cf0898f11009292cdddbeaf379d

SHA1
2af64c3097373bf1a583d43d4ff30487ad5b9646

SHA256
2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7

SHA512
9e06f410a7c3a6712a601de289d7172f4473825f052ac1fc1b5a6cb9633feaaa8aac33e59114c0237907576b316cc3e393563bd3f7e66df287b3f0c3c45303a3

Download Submit
\ProgramData\04bbb7d123\brdm.exe
MD5
b77d9cf0898f11009292cdddbeaf379d

SHA1
2af64c3097373bf1a583d43d4ff30487ad5b9646

SHA256
2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7

SHA512
9e06f410a7c3a6712a601de289d7172f4473825f052ac1fc1b5a6cb9633feaaa8aac33e59114c0237907576b316cc3e393563bd3f7e66df287b3f0c3c45303a3

Download Submit
memory/884-81-0x0000000000000000-mapping.dmp

Download
memory/1688-78-0x00000000001F0000-0x00000000001F8000-memory.dmp

Filesize
32KB

Download
memory/1688-61-0x0000000075011000-0x0000000075013000-memory.dmp

Filesize
8KB

Download
memory/1688-79-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1780-86-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/1780-73-0x000000000040F4EB-mapping.dmp

Download
memory/1964-82-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1964-80-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1964-62-0x000000000040F4EB-mapping.dmp

Download
memory/2004-66-0x0000000000000000-mapping.dmp

Download
memory/2004-84-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2036-77-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads