amadey | 37d0ea7fa1d8eedd74c2982488f00429f92c3ffae9d82bdf0bd4c253532f06de

General

Target

d60c34a516621348b92917e01675161a7d6c0b81ab30df97af8e9d659b119468.exe
Size

200KB
MD5

a492dda14b06e37210725e1c6982416f
SHA1

8baf52a2e6776cfb48fd8821d439f10dbdb5f751
SHA256

d60c34a516621348b92917e01675161a7d6c0b81ab30df97af8e9d659b119468
SHA512

c7e242abb629100b20a8c0c7d0efbdad3deccbcc373a309084c75ce891148f93184b0e1862500f83a46e1f3c6f8e219e129ca99d4c9b81cf45508edb8561a90d

Score

10^/10

amadey trojan

Malware Config

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Executes dropped EXE 1 IoCs

Processes:

bdif.exe

pid process

3612 bdif.exe

pid	process
3612	bdif.exe

NTFS ADS 1 IoCs

Processes:

d60c34a516621348b92917e01675161a7d6c0b81ab30df97af8e9d659b119468.exe

description	ioc	process
File created	\??\c:\programdata\a043022f13\bdif.exe:Zone.Identifier	d60c34a516621348b92917e01675161a7d6c0b81ab30df97af8e9d659b119468.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

d60c34a516621348b92917e01675161a7d6c0b81ab30df97af8e9d659b119468.exebdif.exe

description	pid	process	target process
PID 4660 wrote to memory of 3612	4660	d60c34a516621348b92917e01675161a7d6c0b81ab30df97af8e9d659b119468.exe	bdif.exe
PID 4660 wrote to memory of 3612	4660	d60c34a516621348b92917e01675161a7d6c0b81ab30df97af8e9d659b119468.exe	bdif.exe
PID 4660 wrote to memory of 3612	4660	d60c34a516621348b92917e01675161a7d6c0b81ab30df97af8e9d659b119468.exe	bdif.exe
PID 3612 wrote to memory of 540	3612	bdif.exe	REG.exe
PID 3612 wrote to memory of 540	3612	bdif.exe	REG.exe
PID 3612 wrote to memory of 540	3612	bdif.exe	REG.exe

C:\Users\Admin\AppData\Local\Temp\d60c34a516621348b92917e01675161a7d6c0b81ab30df97af8e9d659b119468.exe
"C:\Users\Admin\AppData\Local\Temp\d60c34a516621348b92917e01675161a7d6c0b81ab30df97af8e9d659b119468.exe"
1⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:4660

\??\c:\programdata\a043022f13\bdif.exe
c:\programdata\a043022f13\bdif.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\a043022f13
3⤵
PID:540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\a043022f13\bdif.exe
MD5
a492dda14b06e37210725e1c6982416f

SHA1
8baf52a2e6776cfb48fd8821d439f10dbdb5f751

SHA256
d60c34a516621348b92917e01675161a7d6c0b81ab30df97af8e9d659b119468

SHA512
c7e242abb629100b20a8c0c7d0efbdad3deccbcc373a309084c75ce891148f93184b0e1862500f83a46e1f3c6f8e219e129ca99d4c9b81cf45508edb8561a90d

Download Submit
C:\ProgramData\ad614a361b6a01b307b49efaeff97543
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\c:\programdata\a043022f13\bdif.exe
MD5
a492dda14b06e37210725e1c6982416f

SHA1
8baf52a2e6776cfb48fd8821d439f10dbdb5f751

SHA256
d60c34a516621348b92917e01675161a7d6c0b81ab30df97af8e9d659b119468

SHA512
c7e242abb629100b20a8c0c7d0efbdad3deccbcc373a309084c75ce891148f93184b0e1862500f83a46e1f3c6f8e219e129ca99d4c9b81cf45508edb8561a90d

Download Submit
memory/540-133-0x0000000000000000-mapping.dmp

Download
memory/3612-122-0x0000000000000000-mapping.dmp

Download
memory/3612-125-0x0000000000560000-0x0000000000570000-memory.dmp

Filesize
64KB

Download
memory/3612-128-0x0000000002070000-0x0000000002095000-memory.dmp

Filesize
148KB

Download
memory/4660-114-0x00000000005F0000-0x0000000000600000-memory.dmp

Filesize
64KB

Download
memory/4660-117-0x0000000000480000-0x000000000048D000-memory.dmp

Filesize
52KB

Download
memory/4660-118-0x00000000021C0000-0x00000000021E5000-memory.dmp

Filesize
148KB

Download
memory/4660-121-0x00000000021E4000-0x00000000021E5000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing