amadey | db148eccfdeedddeca41eb2ac092db09e6c568b714e5f2d9b2560bf5b2551952

Analysis

max time kernel
23s
max time network
115s
platform
windows10_x64
resource
win10v20210408
submitted
29/08/2021, 19:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ebf15c6db0a62d32a2a15a8f13e1c88f.exe
Size 214KB
Sample210829-6p1dev7wnn
SHA256 db148eccfdeedddeca41eb2ac092db09e6c568b714e5f2d9b2560bf5b2551952
MD5 ebf15c6db0a62d32a2a15a8f13e1c88f
SHA1 254f6d8896b865d6b35413c838c6a1779267f044
SHA512 fc687c040053d40115ee17b88e781bb1fb943c9d46ee276eb55e72b4987c7ae675457c3149ed97469a3a4336cfa97990b24087c76e26e1ab120754f15d9f0b0b
MD5 SHA1 SHA512

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

2.50

185.215.113.206/k8FppT/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3644 created 1212	3644	WerFault.exe	84

Executes dropped EXE 1 IoCs

pid	Process
1212	hnbux.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 15 IoCs

pid	pid_target	Process	procid_target
1980	4796	WerFault.exe	67
512	4796	WerFault.exe	67
632	4796	WerFault.exe	67
396	4796	WerFault.exe	67
1032	4796	WerFault.exe	67
1148	4796	WerFault.exe	67
1800	1212	WerFault.exe	84
1988	1212	WerFault.exe	84
2172	1212	WerFault.exe	84
2372	1212	WerFault.exe	84
2528	1212	WerFault.exe	84
2776	1212	WerFault.exe	84
2824	1212	WerFault.exe	84
2912	1212	WerFault.exe	84
3644	1212	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1980	WerFault.exe
1980	WerFault.exe
1980	WerFault.exe
1980	WerFault.exe
1980	WerFault.exe
1980	WerFault.exe
1980	WerFault.exe
1980	WerFault.exe
1980	WerFault.exe
1980	WerFault.exe
1980	WerFault.exe
1980	WerFault.exe
1980	WerFault.exe
1980	WerFault.exe
1980	WerFault.exe
512	WerFault.exe
512	WerFault.exe
512	WerFault.exe
512	WerFault.exe
512	WerFault.exe
512	WerFault.exe
512	WerFault.exe
512	WerFault.exe
512	WerFault.exe
512	WerFault.exe
512	WerFault.exe
512	WerFault.exe
512	WerFault.exe
512	WerFault.exe
632	WerFault.exe
632	WerFault.exe
632	WerFault.exe
632	WerFault.exe
632	WerFault.exe
632	WerFault.exe
632	WerFault.exe
632	WerFault.exe
632	WerFault.exe
632	WerFault.exe
632	WerFault.exe
632	WerFault.exe
632	WerFault.exe
632	WerFault.exe
396	WerFault.exe
396	WerFault.exe
396	WerFault.exe
396	WerFault.exe
396	WerFault.exe
396	WerFault.exe
396	WerFault.exe
396	WerFault.exe
396	WerFault.exe
396	WerFault.exe
396	WerFault.exe
396	WerFault.exe
396	WerFault.exe
396	WerFault.exe
1032	WerFault.exe
1032	WerFault.exe
1032	WerFault.exe
1032	WerFault.exe
1032	WerFault.exe
1032	WerFault.exe
1032	WerFault.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeRestorePrivilege	1980	WerFault.exe
Token: SeBackupPrivilege	1980	WerFault.exe
Token: SeDebugPrivilege	1980	WerFault.exe
Token: SeDebugPrivilege	512	WerFault.exe
Token: SeDebugPrivilege	632	WerFault.exe
Token: SeDebugPrivilege	396	WerFault.exe
Token: SeDebugPrivilege	1032	WerFault.exe
Token: SeDebugPrivilege	1148	WerFault.exe
Token: SeDebugPrivilege	1800	WerFault.exe
Token: SeDebugPrivilege	1988	WerFault.exe
Token: SeDebugPrivilege	2172	WerFault.exe
Token: SeDebugPrivilege	2372	WerFault.exe
Token: SeDebugPrivilege	2528	WerFault.exe
Token: SeDebugPrivilege	2776	WerFault.exe
Token: SeDebugPrivilege	2824	WerFault.exe
Token: SeDebugPrivilege	2912	WerFault.exe
Token: SeDebugPrivilege	3644	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 1212	4796	ebf15c6db0a62d32a2a15a8f13e1c88f.exe	84
PID 4796 wrote to memory of 1212	4796	ebf15c6db0a62d32a2a15a8f13e1c88f.exe	84
PID 4796 wrote to memory of 1212	4796	ebf15c6db0a62d32a2a15a8f13e1c88f.exe	84

C:\Users\Admin\AppData\Local\Temp\ebf15c6db0a62d32a2a15a8f13e1c88f.exe
"C:\Users\Admin\AppData\Local\Temp\ebf15c6db0a62d32a2a15a8f13e1c88f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 884
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 896
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 968
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 1008
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 976
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 956
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1148
- C:\Users\Admin\AppData\Local\Temp\bd1299733e\hnbux.exe
  "C:\Users\Admin\AppData\Local\Temp\bd1299733e\hnbux.exe"
  2⤵
  - Executes dropped EXE
  PID:1212
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 608
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:1800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 684
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:1988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 736
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:2172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 860
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:2372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 872
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:2528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 972
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:2776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 920
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:2824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 1060
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:2912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 1052
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:3644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1212-120-0x0000000001E10000-0x0000000001EBE000-memory.dmp

Download

memory/1212-121-0x0000000000400000-0x0000000001D82000-memory.dmp

Download

memory/4796-114-0x0000000003AD0000-0x0000000003B03000-memory.dmp

Download

memory/4796-115-0x0000000000400000-0x0000000001D82000-memory.dmp

Download