amadey | 2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7

General

Target

2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe
Size

333KB
MD5

b77d9cf0898f11009292cdddbeaf379d
SHA1

2af64c3097373bf1a583d43d4ff30487ad5b9646
SHA256

2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7
SHA512

9e06f410a7c3a6712a601de289d7172f4473825f052ac1fc1b5a6cb9633feaaa8aac33e59114c0237907576b316cc3e393563bd3f7e66df287b3f0c3c45303a3

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

2.14

C2

cdn12-web-security.com/gf4EdsW/index.php

shegw583reg.hopto.org/gf4EdsW/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Executes dropped EXE 2 IoCs

Processes:

brdm.exebrdm.exe

pid process

2252 brdm.exe
3492 brdm.exe

pid	process
2252	brdm.exe
3492	brdm.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exebrdm.exe

pid	process
2408	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe
2408	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe
3492	brdm.exe
3492	brdm.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exebrdm.exe

description	pid	process	target process
PID 3016 set thread context of 2408	3016	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe
PID 2252 set thread context of 3492	2252	brdm.exe	brdm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exebrdm.exe

pid process

3016 2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe
2252 brdm.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exebrdm.exe

pid process

3016 2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe
2252 brdm.exe

pid	process
3016	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe
2252	brdm.exe

pid	process
3016	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe
2252	brdm.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exebrdm.exebrdm.execmd.exe

description	pid	process	target process
PID 3016 wrote to memory of 2408	3016	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe
PID 3016 wrote to memory of 2408	3016	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe
PID 3016 wrote to memory of 2408	3016	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe
PID 3016 wrote to memory of 2408	3016	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe
PID 2408 wrote to memory of 2252	2408	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe	brdm.exe
PID 2408 wrote to memory of 2252	2408	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe	brdm.exe
PID 2408 wrote to memory of 2252	2408	2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe	brdm.exe
PID 2252 wrote to memory of 3492	2252	brdm.exe	brdm.exe
PID 2252 wrote to memory of 3492	2252	brdm.exe	brdm.exe
PID 2252 wrote to memory of 3492	2252	brdm.exe	brdm.exe
PID 2252 wrote to memory of 3492	2252	brdm.exe	brdm.exe
PID 3492 wrote to memory of 1360	3492	brdm.exe	cmd.exe
PID 3492 wrote to memory of 1360	3492	brdm.exe	cmd.exe
PID 3492 wrote to memory of 1360	3492	brdm.exe	cmd.exe
PID 1360 wrote to memory of 2656	1360	cmd.exe	reg.exe
PID 1360 wrote to memory of 2656	1360	cmd.exe	reg.exe
PID 1360 wrote to memory of 2656	1360	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe
"C:\Users\Admin\AppData\Local\Temp\2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016

C:\Users\Admin\AppData\Local\Temp\2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe
"C:\Users\Admin\AppData\Local\Temp\2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2408

C:\ProgramData\04bbb7d123\brdm.exe
"C:\ProgramData\04bbb7d123\brdm.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252

C:\ProgramData\04bbb7d123\brdm.exe
"C:\ProgramData\04bbb7d123\brdm.exe"
4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3492

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\04bbb7d123\
5⤵
- Suspicious use of WriteProcessMemory
PID:1360

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\04bbb7d123\
6⤵
PID:2656

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\04bbb7d123\brdm.exe
MD5
b77d9cf0898f11009292cdddbeaf379d

SHA1
2af64c3097373bf1a583d43d4ff30487ad5b9646

SHA256
2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7

SHA512
9e06f410a7c3a6712a601de289d7172f4473825f052ac1fc1b5a6cb9633feaaa8aac33e59114c0237907576b316cc3e393563bd3f7e66df287b3f0c3c45303a3

Download Submit
C:\ProgramData\04bbb7d123\brdm.exe
MD5
b77d9cf0898f11009292cdddbeaf379d

SHA1
2af64c3097373bf1a583d43d4ff30487ad5b9646

SHA256
2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7

SHA512
9e06f410a7c3a6712a601de289d7172f4473825f052ac1fc1b5a6cb9633feaaa8aac33e59114c0237907576b316cc3e393563bd3f7e66df287b3f0c3c45303a3

Download Submit
C:\ProgramData\04bbb7d123\brdm.exe
MD5
b77d9cf0898f11009292cdddbeaf379d

SHA1
2af64c3097373bf1a583d43d4ff30487ad5b9646

SHA256
2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7

SHA512
9e06f410a7c3a6712a601de289d7172f4473825f052ac1fc1b5a6cb9633feaaa8aac33e59114c0237907576b316cc3e393563bd3f7e66df287b3f0c3c45303a3

Download Submit
C:\ProgramData\152136866457237103368804
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1360-130-0x0000000000000000-mapping.dmp

Download
memory/2252-126-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download
memory/2252-118-0x0000000000000000-mapping.dmp

Download
memory/2408-124-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2408-125-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/2408-117-0x000000000040F4EB-mapping.dmp

Download
memory/2656-131-0x0000000000000000-mapping.dmp

Download
memory/3016-122-0x0000000000650000-0x0000000000658000-memory.dmp

Filesize
32KB

Download
memory/3016-116-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/3492-127-0x000000000040F4EB-mapping.dmp

Download
memory/3492-133-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3492-134-0x00000000004A0000-0x00000000005EA000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads