Overview

overview

10

Static

static

14e49fdc63...bd.exe

windows7_x64

10

14e49fdc63...bd.exe

windows10_x64

10

Analysis

  • max time kernel
    26s
  • max time network
    89s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    29/08/2021, 18:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    14e49fdc633ad3d97e49018ee297acbd.exe
  • Size 213KB
  • Sample210829-ll8msvpyz6
  • SHA256 4bd36b789602423d666b1479913bfbd5a32a8fcf20edb88ffad10ca4c1b90e38
  • MD5 SHA1 SHA512
Score
10/10
amadeytrojan

Malware Config

Extracted

Family

  • amadey

Version

  • 2.50

C2

  • 185.215.113.206/k8FppT/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\14e49fdc633ad3d97e49018ee297acbd.exe
    "C:\Users\Admin\AppData\Local\Temp\14e49fdc633ad3d97e49018ee297acbd.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:652
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 884
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:204
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 920
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2208
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 984
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1424
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 816
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1188
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 1004
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1420
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 888
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:740
    • C:\Users\Admin\AppData\Local\Temp\bd1299733e\hnbux.exe
      "C:\Users\Admin\AppData\Local\Temp\bd1299733e\hnbux.exe"
      2⤵
      • Executes dropped EXE
      PID:3936
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 608
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:4060
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 684
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:4092
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 736
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:972
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 812
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:2184
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 880
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:3984
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 972
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:904
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 964
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:1840
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 1060
        3⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:640
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 1040
        3⤵
        • Suspicious use of NtCreateProcessExOtherParentProcess
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:2304

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/652-114-0x0000000003AB0000-0x0000000003AE3000-memory.dmp
        Download

        memory/652-115-0x0000000000400000-0x0000000001D82000-memory.dmp
        Download

        memory/3936-120-0x0000000001EE0000-0x000000000202A000-memory.dmp
        Download

        memory/3936-121-0x0000000000400000-0x0000000001D82000-memory.dmp
        Download