a26595e04bbad90731a04c1195c34d92.exe

General
Target

a26595e04bbad90731a04c1195c34d92.exe

Filesize

1MB

Completed

29-09-2021 00:07

Score
10/10
MD5

a26595e04bbad90731a04c1195c34d92

SHA1

0b295fa12e6bd596ba0071a58370966c6a4551c3

SHA256

c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573

Malware Config

Extracted

Family amadey
Version 2.61
C2

185.215.113.33/hBF6ds2D/index.php

Signatures 7

Filter: none

Discovery
Persistence
  • Amadey

    Description

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • suricata: ET MALWARE Amadey CnC Check-In

    Description

    suricata: ET MALWARE Amadey CnC Check-In

    Tags

  • Executes dropped EXE
    sqtvvs.exesqtvvs.exesqtvvs.exesqtvvs.exesqtvvs.exesqtvvs.exe

    Reported IOCs

    pidprocess
    836sqtvvs.exe
    1116sqtvvs.exe
    1432sqtvvs.exe
    1768sqtvvs.exe
    1784sqtvvs.exe
    1416sqtvvs.exe
  • Suspicious use of SetThreadContext
    a26595e04bbad90731a04c1195c34d92.exesqtvvs.exesqtvvs.exesqtvvs.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 648 set thread context of 668648a26595e04bbad90731a04c1195c34d92.exea26595e04bbad90731a04c1195c34d92.exe
    PID 836 set thread context of 1116836sqtvvs.exesqtvvs.exe
    PID 1432 set thread context of 17681432sqtvvs.exesqtvvs.exe
    PID 1784 set thread context of 14161784sqtvvs.exesqtvvs.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Creates scheduled task(s)
    schtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    1508schtasks.exe
  • Suspicious use of WriteProcessMemory
    a26595e04bbad90731a04c1195c34d92.exea26595e04bbad90731a04c1195c34d92.exesqtvvs.exesqtvvs.execmd.exesqtvvs.exesqtvvs.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 648 wrote to memory of 668648a26595e04bbad90731a04c1195c34d92.exea26595e04bbad90731a04c1195c34d92.exe
    PID 648 wrote to memory of 668648a26595e04bbad90731a04c1195c34d92.exea26595e04bbad90731a04c1195c34d92.exe
    PID 648 wrote to memory of 668648a26595e04bbad90731a04c1195c34d92.exea26595e04bbad90731a04c1195c34d92.exe
    PID 648 wrote to memory of 668648a26595e04bbad90731a04c1195c34d92.exea26595e04bbad90731a04c1195c34d92.exe
    PID 648 wrote to memory of 668648a26595e04bbad90731a04c1195c34d92.exea26595e04bbad90731a04c1195c34d92.exe
    PID 668 wrote to memory of 836668a26595e04bbad90731a04c1195c34d92.exesqtvvs.exe
    PID 668 wrote to memory of 836668a26595e04bbad90731a04c1195c34d92.exesqtvvs.exe
    PID 668 wrote to memory of 836668a26595e04bbad90731a04c1195c34d92.exesqtvvs.exe
    PID 836 wrote to memory of 1116836sqtvvs.exesqtvvs.exe
    PID 836 wrote to memory of 1116836sqtvvs.exesqtvvs.exe
    PID 836 wrote to memory of 1116836sqtvvs.exesqtvvs.exe
    PID 836 wrote to memory of 1116836sqtvvs.exesqtvvs.exe
    PID 836 wrote to memory of 1116836sqtvvs.exesqtvvs.exe
    PID 1116 wrote to memory of 14161116sqtvvs.execmd.exe
    PID 1116 wrote to memory of 14161116sqtvvs.execmd.exe
    PID 1116 wrote to memory of 14161116sqtvvs.execmd.exe
    PID 1116 wrote to memory of 15081116sqtvvs.exeschtasks.exe
    PID 1116 wrote to memory of 15081116sqtvvs.exeschtasks.exe
    PID 1116 wrote to memory of 15081116sqtvvs.exeschtasks.exe
    PID 1416 wrote to memory of 21441416cmd.exereg.exe
    PID 1416 wrote to memory of 21441416cmd.exereg.exe
    PID 1416 wrote to memory of 21441416cmd.exereg.exe
    PID 1432 wrote to memory of 17681432sqtvvs.exesqtvvs.exe
    PID 1432 wrote to memory of 17681432sqtvvs.exesqtvvs.exe
    PID 1432 wrote to memory of 17681432sqtvvs.exesqtvvs.exe
    PID 1432 wrote to memory of 17681432sqtvvs.exesqtvvs.exe
    PID 1432 wrote to memory of 17681432sqtvvs.exesqtvvs.exe
    PID 1784 wrote to memory of 14161784sqtvvs.exesqtvvs.exe
    PID 1784 wrote to memory of 14161784sqtvvs.exesqtvvs.exe
    PID 1784 wrote to memory of 14161784sqtvvs.exesqtvvs.exe
    PID 1784 wrote to memory of 14161784sqtvvs.exesqtvvs.exe
    PID 1784 wrote to memory of 14161784sqtvvs.exesqtvvs.exe
Processes 11
  • C:\Users\Admin\AppData\Local\Temp\a26595e04bbad90731a04c1195c34d92.exe
    "C:\Users\Admin\AppData\Local\Temp\a26595e04bbad90731a04c1195c34d92.exe"
    Suspicious use of SetThreadContext
    Suspicious use of WriteProcessMemory
    PID:648
    • C:\Users\Admin\AppData\Local\Temp\a26595e04bbad90731a04c1195c34d92.exe
      "C:\Users\Admin\AppData\Local\Temp\a26595e04bbad90731a04c1195c34d92.exe"
      Suspicious use of WriteProcessMemory
      PID:668
      • C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe
        "C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe"
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        PID:836
        • C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe
          "C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe"
          Executes dropped EXE
          Suspicious use of WriteProcessMemory
          PID:1116
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\7ac441486f\
            Suspicious use of WriteProcessMemory
            PID:1416
            • C:\Windows\SysWOW64\reg.exe
              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\7ac441486f\
              PID:2144
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN sqtvvs.exe /TR "C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe" /F
            Creates scheduled task(s)
            PID:1508
  • C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe
    C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe
    Executes dropped EXE
    Suspicious use of SetThreadContext
    Suspicious use of WriteProcessMemory
    PID:1432
    • C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe
      C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe
      Executes dropped EXE
      PID:1768
  • C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe
    C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe
    Executes dropped EXE
    Suspicious use of SetThreadContext
    Suspicious use of WriteProcessMemory
    PID:1784
    • C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe
      C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe
      Executes dropped EXE
      PID:1416
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Users\Admin\AppData\Local\Temp\15211594587808204709

                        MD5

                        d41d8cd98f00b204e9800998ecf8427e

                        SHA1

                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                        SHA256

                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                        SHA512

                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                      • C:\Users\Admin\AppData\Local\Temp\15211594587808204709

                        MD5

                        d41d8cd98f00b204e9800998ecf8427e

                        SHA1

                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                        SHA256

                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                        SHA512

                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                      • C:\Users\Admin\AppData\Local\Temp\15211594587808204709

                        MD5

                        d41d8cd98f00b204e9800998ecf8427e

                        SHA1

                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                        SHA256

                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                        SHA512

                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                      • C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe

                        MD5

                        a26595e04bbad90731a04c1195c34d92

                        SHA1

                        0b295fa12e6bd596ba0071a58370966c6a4551c3

                        SHA256

                        c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573

                        SHA512

                        ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934

                      • C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe

                        MD5

                        a26595e04bbad90731a04c1195c34d92

                        SHA1

                        0b295fa12e6bd596ba0071a58370966c6a4551c3

                        SHA256

                        c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573

                        SHA512

                        ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934

                      • C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe

                        MD5

                        a26595e04bbad90731a04c1195c34d92

                        SHA1

                        0b295fa12e6bd596ba0071a58370966c6a4551c3

                        SHA256

                        c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573

                        SHA512

                        ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934

                      • C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe

                        MD5

                        a26595e04bbad90731a04c1195c34d92

                        SHA1

                        0b295fa12e6bd596ba0071a58370966c6a4551c3

                        SHA256

                        c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573

                        SHA512

                        ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934

                      • C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe

                        MD5

                        a26595e04bbad90731a04c1195c34d92

                        SHA1

                        0b295fa12e6bd596ba0071a58370966c6a4551c3

                        SHA256

                        c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573

                        SHA512

                        ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934

                      • C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe

                        MD5

                        a26595e04bbad90731a04c1195c34d92

                        SHA1

                        0b295fa12e6bd596ba0071a58370966c6a4551c3

                        SHA256

                        c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573

                        SHA512

                        ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934

                      • C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe

                        MD5

                        a26595e04bbad90731a04c1195c34d92

                        SHA1

                        0b295fa12e6bd596ba0071a58370966c6a4551c3

                        SHA256

                        c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573

                        SHA512

                        ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934

                      • memory/668-115-0x00000000004105EF-mapping.dmp

                      • memory/668-114-0x0000000000400000-0x0000000000439000-memory.dmp

                      • memory/668-116-0x0000000000400000-0x0000000000439000-memory.dmp

                      • memory/836-117-0x0000000000000000-mapping.dmp

                      • memory/1116-121-0x00000000004105EF-mapping.dmp

                      • memory/1116-127-0x0000000000400000-0x0000000000439000-memory.dmp

                      • memory/1416-139-0x0000000000400000-0x0000000000439000-memory.dmp

                      • memory/1416-136-0x00000000004105EF-mapping.dmp

                      • memory/1416-124-0x0000000000000000-mapping.dmp

                      • memory/1508-125-0x0000000000000000-mapping.dmp

                      • memory/1768-133-0x0000000000400000-0x0000000000439000-memory.dmp

                      • memory/1768-130-0x00000000004105EF-mapping.dmp

                      • memory/2144-126-0x0000000000000000-mapping.dmp