amadey | d60c34a516621348b92917e01675161a7d6c0b81ab30df97af8e9d659b119468

General

Target

a492dda14b06e37210725e1c6982416f.exe
Size

200KB
MD5

a492dda14b06e37210725e1c6982416f
SHA1

8baf52a2e6776cfb48fd8821d439f10dbdb5f751
SHA256

d60c34a516621348b92917e01675161a7d6c0b81ab30df97af8e9d659b119468
SHA512

c7e242abb629100b20a8c0c7d0efbdad3deccbcc373a309084c75ce891148f93184b0e1862500f83a46e1f3c6f8e219e129ca99d4c9b81cf45508edb8561a90d

Score

10^/10

amadey trojan

Malware Config

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Executes dropped EXE 1 IoCs

Processes:

bdif.exe

pid process

1380 bdif.exe
Loads dropped DLL 1 IoCs

Processes:

a492dda14b06e37210725e1c6982416f.exe

pid process

1944 a492dda14b06e37210725e1c6982416f.exe
NTFS ADS 1 IoCs

Processes:

a492dda14b06e37210725e1c6982416f.exe

description ioc process

File created \??\c:\programdata\a043022f13\bdif.exe:Zone.Identifier a492dda14b06e37210725e1c6982416f.exe

pid	process
1380	bdif.exe

pid	process
1944	a492dda14b06e37210725e1c6982416f.exe

description	ioc	process
File created	\??\c:\programdata\a043022f13\bdif.exe:Zone.Identifier	a492dda14b06e37210725e1c6982416f.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

a492dda14b06e37210725e1c6982416f.exebdif.exe

description	pid	process	target process
PID 1944 wrote to memory of 1380	1944	a492dda14b06e37210725e1c6982416f.exe	bdif.exe
PID 1944 wrote to memory of 1380	1944	a492dda14b06e37210725e1c6982416f.exe	bdif.exe
PID 1944 wrote to memory of 1380	1944	a492dda14b06e37210725e1c6982416f.exe	bdif.exe
PID 1944 wrote to memory of 1380	1944	a492dda14b06e37210725e1c6982416f.exe	bdif.exe
PID 1380 wrote to memory of 1836	1380	bdif.exe	REG.exe
PID 1380 wrote to memory of 1836	1380	bdif.exe	REG.exe
PID 1380 wrote to memory of 1836	1380	bdif.exe	REG.exe
PID 1380 wrote to memory of 1836	1380	bdif.exe	REG.exe

C:\Users\Admin\AppData\Local\Temp\a492dda14b06e37210725e1c6982416f.exe
"C:\Users\Admin\AppData\Local\Temp\a492dda14b06e37210725e1c6982416f.exe"
1⤵
- Loads dropped DLL
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1944

\??\c:\programdata\a043022f13\bdif.exe
c:\programdata\a043022f13\bdif.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\a043022f13
3⤵
PID:1836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\a043022f13\bdif.exe
MD5
a492dda14b06e37210725e1c6982416f

SHA1
8baf52a2e6776cfb48fd8821d439f10dbdb5f751

SHA256
d60c34a516621348b92917e01675161a7d6c0b81ab30df97af8e9d659b119468

SHA512
c7e242abb629100b20a8c0c7d0efbdad3deccbcc373a309084c75ce891148f93184b0e1862500f83a46e1f3c6f8e219e129ca99d4c9b81cf45508edb8561a90d

Download Submit
C:\ProgramData\ad614a361b6a01b307b49efaeff97543
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\ProgramData\a043022f13\bdif.exe
MD5
a492dda14b06e37210725e1c6982416f

SHA1
8baf52a2e6776cfb48fd8821d439f10dbdb5f751

SHA256
d60c34a516621348b92917e01675161a7d6c0b81ab30df97af8e9d659b119468

SHA512
c7e242abb629100b20a8c0c7d0efbdad3deccbcc373a309084c75ce891148f93184b0e1862500f83a46e1f3c6f8e219e129ca99d4c9b81cf45508edb8561a90d

Download Submit
memory/1380-69-0x0000000000000000-mapping.dmp

Download
memory/1380-72-0x0000000000260000-0x0000000000270000-memory.dmp

Filesize
64KB

Download
memory/1380-76-0x0000000000300000-0x0000000000325000-memory.dmp

Filesize
148KB

Download
memory/1836-81-0x0000000000000000-mapping.dmp

Download
memory/1944-60-0x00000000002E0000-0x00000000002F0000-memory.dmp

Filesize
64KB

Download
memory/1944-63-0x0000000076691000-0x0000000076693000-memory.dmp

Filesize
8KB

Download
memory/1944-64-0x00000000002F0000-0x0000000000315000-memory.dmp

Filesize
148KB

Download
memory/1944-67-0x0000000000314000-0x0000000000315000-memory.dmp

Filesize
4KB

Download
memory/1944-71-0x00000000002D0000-0x00000000002DD000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads