amadey | d04ec4f0546f476d13d8ac05da68cd58c395c93e13c83eb8c5f44ed273064bb6

General

Target
AF96260D874638083E3C7335933227E7.exe
Size 191KB
Sample210506-5cwe3dmpe6
SHA256 d04ec4f0546f476d13d8ac05da68cd58c395c93e13c83eb8c5f44ed273064bb6
MD5 af96260d874638083e3c7335933227e7
SHA1 98a4f387a46cba1a88fc95063a01a9c4579cc40a
SHA512 0ebd10262c6bed3c342b85b05d8567e13d0d46c8fa51b742682866394b82860ce291d1889872f94ace629eee6daea06ef818bc0805d6c57177b8b97cc231f9ba
MD5 SHA1 SHA512

Score

10^/10

amadey spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

2.16

C2

45.155.205.172/4dcYcWsw3/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Blocklisted process makes network request 2 IoCs

flow	pid	Process
16	2104	rundll32.exe
19	3852	rundll32.exe

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1140	blfte.exe

Loads dropped DLL 3 IoCs

pid	Process
2104	rundll32.exe
3852	rundll32.exe
3852	rundll32.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2104	rundll32.exe
2104	rundll32.exe
2104	rundll32.exe
2104	rundll32.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 1140	1832	AF96260D874638083E3C7335933227E7.exe	75
PID 1832 wrote to memory of 1140	1832	AF96260D874638083E3C7335933227E7.exe	75
PID 1832 wrote to memory of 1140	1832	AF96260D874638083E3C7335933227E7.exe	75
PID 1140 wrote to memory of 1640	1140	blfte.exe	76
PID 1140 wrote to memory of 1640	1140	blfte.exe	76
PID 1140 wrote to memory of 1640	1140	blfte.exe	76
PID 1640 wrote to memory of 2368	1640	cmd.exe	78
PID 1640 wrote to memory of 2368	1640	cmd.exe	78
PID 1640 wrote to memory of 2368	1640	cmd.exe	78
PID 1140 wrote to memory of 2104	1140	blfte.exe	82
PID 1140 wrote to memory of 2104	1140	blfte.exe	82
PID 1140 wrote to memory of 2104	1140	blfte.exe	82
PID 1140 wrote to memory of 3852	1140	blfte.exe	84
PID 1140 wrote to memory of 3852	1140	blfte.exe	84
PID 1140 wrote to memory of 3852	1140	blfte.exe	84

C:\Users\Admin\AppData\Local\Temp\AF96260D874638083E3C7335933227E7.exe
"C:\Users\Admin\AppData\Local\Temp\AF96260D874638083E3C7335933227E7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Users\Admin\AppData\Local\Temp\c2ff7e01a0\blfte.exe
  "C:\Users\Admin\AppData\Local\Temp\c2ff7e01a0\blfte.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\c2ff7e01a0\
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1640
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\c2ff7e01a0\
      4⤵
      PID:2368
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\ProgramData\c9c2592926ae12\cred.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2104
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\ProgramData\c9c2592926ae12\scr.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    PID:3852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads