amadey | 37ad471d4b3ea1644bb111bacdf6306189214c900ee8882c3b85cab7d5a67351

General

Target

92ece8f284c4ce928877ec8352206284.exe
Size

265KB
MD5

92ece8f284c4ce928877ec8352206284
SHA1

8386f3af52aa8505d1e668dc7bfecf48c37e8387
SHA256

37ad471d4b3ea1644bb111bacdf6306189214c900ee8882c3b85cab7d5a67351
SHA512

1244cb322a2b7b4dca51301f23e7fcd0bab5c0c39e371244100b7e1eb79d54d8eea49ae34facf56f397b5991907bb3f1e8de07fc99731306f710066905fb53f8

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

2.14

C2

cdn12-web-security.com/gf4EdsW/index.php

shegw583reg.hopto.org/gf4EdsW/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Executes dropped EXE 2 IoCs

Processes:

brdm.exebrdm.exe

pid process

1676 brdm.exe
3832 brdm.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

92ece8f284c4ce928877ec8352206284.exebrdm.exe

pid process

3120 92ece8f284c4ce928877ec8352206284.exe
3120 92ece8f284c4ce928877ec8352206284.exe
3832 brdm.exe
3832 brdm.exe

pid	process
1676	brdm.exe
3832	brdm.exe

pid	process
3120	92ece8f284c4ce928877ec8352206284.exe
3120	92ece8f284c4ce928877ec8352206284.exe
3832	brdm.exe
3832	brdm.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

92ece8f284c4ce928877ec8352206284.exebrdm.exe

description	pid	process	target process
PID 2232 set thread context of 3120	2232	92ece8f284c4ce928877ec8352206284.exe	92ece8f284c4ce928877ec8352206284.exe
PID 1676 set thread context of 3832	1676	brdm.exe	brdm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

92ece8f284c4ce928877ec8352206284.exebrdm.exe

pid process

2232 92ece8f284c4ce928877ec8352206284.exe
1676 brdm.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

92ece8f284c4ce928877ec8352206284.exebrdm.exe

pid process

2232 92ece8f284c4ce928877ec8352206284.exe
1676 brdm.exe

pid	process
2232	92ece8f284c4ce928877ec8352206284.exe
1676	brdm.exe

pid	process
2232	92ece8f284c4ce928877ec8352206284.exe
1676	brdm.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

92ece8f284c4ce928877ec8352206284.exe92ece8f284c4ce928877ec8352206284.exebrdm.exebrdm.execmd.exe

description	pid	process	target process
PID 2232 wrote to memory of 3120	2232	92ece8f284c4ce928877ec8352206284.exe	92ece8f284c4ce928877ec8352206284.exe
PID 2232 wrote to memory of 3120	2232	92ece8f284c4ce928877ec8352206284.exe	92ece8f284c4ce928877ec8352206284.exe
PID 2232 wrote to memory of 3120	2232	92ece8f284c4ce928877ec8352206284.exe	92ece8f284c4ce928877ec8352206284.exe
PID 2232 wrote to memory of 3120	2232	92ece8f284c4ce928877ec8352206284.exe	92ece8f284c4ce928877ec8352206284.exe
PID 3120 wrote to memory of 1676	3120	92ece8f284c4ce928877ec8352206284.exe	brdm.exe
PID 3120 wrote to memory of 1676	3120	92ece8f284c4ce928877ec8352206284.exe	brdm.exe
PID 3120 wrote to memory of 1676	3120	92ece8f284c4ce928877ec8352206284.exe	brdm.exe
PID 1676 wrote to memory of 3832	1676	brdm.exe	brdm.exe
PID 1676 wrote to memory of 3832	1676	brdm.exe	brdm.exe
PID 1676 wrote to memory of 3832	1676	brdm.exe	brdm.exe
PID 1676 wrote to memory of 3832	1676	brdm.exe	brdm.exe
PID 3832 wrote to memory of 1496	3832	brdm.exe	cmd.exe
PID 3832 wrote to memory of 1496	3832	brdm.exe	cmd.exe
PID 3832 wrote to memory of 1496	3832	brdm.exe	cmd.exe
PID 1496 wrote to memory of 4028	1496	cmd.exe	reg.exe
PID 1496 wrote to memory of 4028	1496	cmd.exe	reg.exe
PID 1496 wrote to memory of 4028	1496	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\92ece8f284c4ce928877ec8352206284.exe
"C:\Users\Admin\AppData\Local\Temp\92ece8f284c4ce928877ec8352206284.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232

C:\Users\Admin\AppData\Local\Temp\92ece8f284c4ce928877ec8352206284.exe
"C:\Users\Admin\AppData\Local\Temp\92ece8f284c4ce928877ec8352206284.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3120

C:\ProgramData\04bbb7d123\brdm.exe
"C:\ProgramData\04bbb7d123\brdm.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676

C:\ProgramData\04bbb7d123\brdm.exe
"C:\ProgramData\04bbb7d123\brdm.exe"
4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3832

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\04bbb7d123\
5⤵
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\04bbb7d123\
6⤵
PID:4028

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\04bbb7d123\brdm.exe
MD5
92ece8f284c4ce928877ec8352206284

SHA1
8386f3af52aa8505d1e668dc7bfecf48c37e8387

SHA256
37ad471d4b3ea1644bb111bacdf6306189214c900ee8882c3b85cab7d5a67351

SHA512
1244cb322a2b7b4dca51301f23e7fcd0bab5c0c39e371244100b7e1eb79d54d8eea49ae34facf56f397b5991907bb3f1e8de07fc99731306f710066905fb53f8

Download Submit
C:\ProgramData\04bbb7d123\brdm.exe
MD5
92ece8f284c4ce928877ec8352206284

SHA1
8386f3af52aa8505d1e668dc7bfecf48c37e8387

SHA256
37ad471d4b3ea1644bb111bacdf6306189214c900ee8882c3b85cab7d5a67351

SHA512
1244cb322a2b7b4dca51301f23e7fcd0bab5c0c39e371244100b7e1eb79d54d8eea49ae34facf56f397b5991907bb3f1e8de07fc99731306f710066905fb53f8

Download Submit
C:\ProgramData\04bbb7d123\brdm.exe
MD5
92ece8f284c4ce928877ec8352206284

SHA1
8386f3af52aa8505d1e668dc7bfecf48c37e8387

SHA256
37ad471d4b3ea1644bb111bacdf6306189214c900ee8882c3b85cab7d5a67351

SHA512
1244cb322a2b7b4dca51301f23e7fcd0bab5c0c39e371244100b7e1eb79d54d8eea49ae34facf56f397b5991907bb3f1e8de07fc99731306f710066905fb53f8

Download Submit
C:\ProgramData\152136866457237103368804
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1496-130-0x0000000000000000-mapping.dmp

Download
memory/1676-126-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/1676-118-0x0000000000000000-mapping.dmp

Download
memory/2232-123-0x0000000000600000-0x0000000000605000-memory.dmp

Filesize
20KB

Download
memory/2232-116-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/3120-124-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3120-125-0x0000000000440000-0x00000000004EE000-memory.dmp

Filesize
696KB

Download
memory/3120-117-0x000000000040F4EB-mapping.dmp

Download
memory/3832-127-0x000000000040F4EB-mapping.dmp

Download
memory/3832-133-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3832-134-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/4028-131-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing