amadey | 2d495c79c56b525f230fbbb786d0b95ab3924dfcfc2ea3883882b257ab4263f3

General

Target
2d495c79c56b525f230fbbb786d0b95ab3924dfcfc2ea.exe
Size 261KB
Sample210718-p4ny14dv3e
SHA256 2d495c79c56b525f230fbbb786d0b95ab3924dfcfc2ea3883882b257ab4263f3
MD5 05e5ba03f9941bd4cd83cb4cccc073ff
SHA1 2172367badf5b569fa6b4bd806309b61d9a54c92
SHA512 fdb46d60b14ab69f481803583c144ff0f08aa0346f2f7b9d52b0077ea73f6f5c6f6e75ef9ae44ae8adbc18353b15b5c75152d863d828c2023c43a20a35afe061
MD5 SHA1 SHA512

Score

10^/10

Family

Version

C2

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Downloads MZ/PE file

Executes dropped EXE 5 IoCs

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	rgbux.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\a_upd.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a_upd.exe"	rgbux.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
220	schtasks.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 2776	1892	2d495c79c56b525f230fbbb786d0b95ab3924dfcfc2ea.exe	75
PID 1892 wrote to memory of 2776	1892	2d495c79c56b525f230fbbb786d0b95ab3924dfcfc2ea.exe	75
PID 1892 wrote to memory of 2776	1892	2d495c79c56b525f230fbbb786d0b95ab3924dfcfc2ea.exe	75
PID 2776 wrote to memory of 2736	2776	rgbux.exe	76
PID 2776 wrote to memory of 2736	2776	rgbux.exe	76
PID 2776 wrote to memory of 2736	2776	rgbux.exe	76
PID 2776 wrote to memory of 220	2776	rgbux.exe	77
PID 2776 wrote to memory of 220	2776	rgbux.exe	77
PID 2776 wrote to memory of 220	2776	rgbux.exe	77
PID 2736 wrote to memory of 3124	2736	cmd.exe	80
PID 2736 wrote to memory of 3124	2736	cmd.exe	80
PID 2736 wrote to memory of 3124	2736	cmd.exe	80
PID 2776 wrote to memory of 1432	2776	rgbux.exe	84
PID 2776 wrote to memory of 1432	2776	rgbux.exe	84
PID 2776 wrote to memory of 1432	2776	rgbux.exe	84

C:\Users\Admin\AppData\Local\Temp\2d495c79c56b525f230fbbb786d0b95ab3924dfcfc2ea.exe
"C:\Users\Admin\AppData\Local\Temp\2d495c79c56b525f230fbbb786d0b95ab3924dfcfc2ea.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Users\Admin\AppData\Local\Temp\152c6d54a1\rgbux.exe
  "C:\Users\Admin\AppData\Local\Temp\152c6d54a1\rgbux.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\152c6d54a1\
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2736
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\152c6d54a1\
      4⤵
      PID:3124
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rgbux.exe /TR "C:\Users\Admin\AppData\Local\Temp\152c6d54a1\rgbux.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:220
- - C:\Users\Admin\AppData\Local\Temp\a_upd.exe
    "C:\Users\Admin\AppData\Local\Temp\a_upd.exe"
    3⤵
    - Executes dropped EXE
    PID:1432