amadey | 250298a15ca5e40170a1feb8e639b12bbd591a448ebbfe5bc7574a1532596c46

General

Target

250298a15ca5e40170a1feb8e639b12bbd591a448ebbfe5bc7574a1532596c46.exe
Size

370KB
MD5

56dfbe78d5e7f1c1156a8dae8672a3e5
SHA1

5ca03199a0db7465ca7fb92d2d48642f4f981d17
SHA256

250298a15ca5e40170a1feb8e639b12bbd591a448ebbfe5bc7574a1532596c46
SHA512

ea0fb267a6ab6b4838dc840ed7939dce72009d91f482d0c040e5a4d0b66a865e29a8b9e49b1c758b87a396453f0de7cef897aeb6bd3045f969cb68df68ae482f

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

2.85

C2

185.215.113.35/d2VxjasuwS/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Executes dropped EXE 3 IoCs

Processes:

tkools.exetkools.exetkools.exe

pid process

3772 tkools.exe
2640 tkools.exe
1872 tkools.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1444 schtasks.exe

pid	process
3772	tkools.exe
2640	tkools.exe
1872	tkools.exe

pid	process
1444	schtasks.exe

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

250298a15ca5e40170a1feb8e639b12bbd591a448ebbfe5bc7574a1532596c46.execmd.execmd.execmd.execmd.exetkools.execmd.exe

description	pid	process	target process
PID 4212 wrote to memory of 4264	4212	250298a15ca5e40170a1feb8e639b12bbd591a448ebbfe5bc7574a1532596c46.exe	cmd.exe
PID 4212 wrote to memory of 4264	4212	250298a15ca5e40170a1feb8e639b12bbd591a448ebbfe5bc7574a1532596c46.exe	cmd.exe
PID 4212 wrote to memory of 4264	4212	250298a15ca5e40170a1feb8e639b12bbd591a448ebbfe5bc7574a1532596c46.exe	cmd.exe
PID 4264 wrote to memory of 4220	4264	cmd.exe	cmd.exe
PID 4264 wrote to memory of 4220	4264	cmd.exe	cmd.exe
PID 4264 wrote to memory of 4220	4264	cmd.exe	cmd.exe
PID 4264 wrote to memory of 512	4264	cmd.exe	cacls.exe
PID 4264 wrote to memory of 512	4264	cmd.exe	cacls.exe
PID 4264 wrote to memory of 512	4264	cmd.exe	cacls.exe
PID 4212 wrote to memory of 4432	4212	250298a15ca5e40170a1feb8e639b12bbd591a448ebbfe5bc7574a1532596c46.exe	cmd.exe
PID 4212 wrote to memory of 4432	4212	250298a15ca5e40170a1feb8e639b12bbd591a448ebbfe5bc7574a1532596c46.exe	cmd.exe
PID 4212 wrote to memory of 4432	4212	250298a15ca5e40170a1feb8e639b12bbd591a448ebbfe5bc7574a1532596c46.exe	cmd.exe
PID 4432 wrote to memory of 4472	4432	cmd.exe	cacls.exe
PID 4432 wrote to memory of 4472	4432	cmd.exe	cacls.exe
PID 4432 wrote to memory of 4472	4432	cmd.exe	cacls.exe
PID 4212 wrote to memory of 756	4212	250298a15ca5e40170a1feb8e639b12bbd591a448ebbfe5bc7574a1532596c46.exe	cmd.exe
PID 4212 wrote to memory of 756	4212	250298a15ca5e40170a1feb8e639b12bbd591a448ebbfe5bc7574a1532596c46.exe	cmd.exe
PID 4212 wrote to memory of 756	4212	250298a15ca5e40170a1feb8e639b12bbd591a448ebbfe5bc7574a1532596c46.exe	cmd.exe
PID 756 wrote to memory of 3184	756	cmd.exe	cmd.exe
PID 756 wrote to memory of 3184	756	cmd.exe	cmd.exe
PID 756 wrote to memory of 3184	756	cmd.exe	cmd.exe
PID 756 wrote to memory of 3208	756	cmd.exe	cacls.exe
PID 756 wrote to memory of 3208	756	cmd.exe	cacls.exe
PID 756 wrote to memory of 3208	756	cmd.exe	cacls.exe
PID 4212 wrote to memory of 3716	4212	250298a15ca5e40170a1feb8e639b12bbd591a448ebbfe5bc7574a1532596c46.exe	cmd.exe
PID 4212 wrote to memory of 3716	4212	250298a15ca5e40170a1feb8e639b12bbd591a448ebbfe5bc7574a1532596c46.exe	cmd.exe
PID 4212 wrote to memory of 3716	4212	250298a15ca5e40170a1feb8e639b12bbd591a448ebbfe5bc7574a1532596c46.exe	cmd.exe
PID 4212 wrote to memory of 3772	4212	250298a15ca5e40170a1feb8e639b12bbd591a448ebbfe5bc7574a1532596c46.exe	tkools.exe
PID 4212 wrote to memory of 3772	4212	250298a15ca5e40170a1feb8e639b12bbd591a448ebbfe5bc7574a1532596c46.exe	tkools.exe
PID 4212 wrote to memory of 3772	4212	250298a15ca5e40170a1feb8e639b12bbd591a448ebbfe5bc7574a1532596c46.exe	tkools.exe
PID 3716 wrote to memory of 3140	3716	cmd.exe	cacls.exe
PID 3716 wrote to memory of 3140	3716	cmd.exe	cacls.exe
PID 3716 wrote to memory of 3140	3716	cmd.exe	cacls.exe
PID 3772 wrote to memory of 1248	3772	tkools.exe	cmd.exe
PID 3772 wrote to memory of 1248	3772	tkools.exe	cmd.exe
PID 3772 wrote to memory of 1248	3772	tkools.exe	cmd.exe
PID 3772 wrote to memory of 1444	3772	tkools.exe	schtasks.exe
PID 3772 wrote to memory of 1444	3772	tkools.exe	schtasks.exe
PID 3772 wrote to memory of 1444	3772	tkools.exe	schtasks.exe
PID 1248 wrote to memory of 1976	1248	cmd.exe	reg.exe
PID 1248 wrote to memory of 1976	1248	cmd.exe	reg.exe
PID 1248 wrote to memory of 1976	1248	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\250298a15ca5e40170a1feb8e639b12bbd591a448ebbfe5bc7574a1532596c46.exe
"C:\Users\Admin\AppData\Local\Temp\250298a15ca5e40170a1feb8e639b12bbd591a448ebbfe5bc7574a1532596c46.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4212

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:N"
2⤵
- Suspicious use of WriteProcessMemory
PID:4264

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
3⤵
PID:4220

C:\Windows\SysWOW64\cacls.exe
CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:N"
3⤵
PID:512

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:R" /E
2⤵
- Suspicious use of WriteProcessMemory
PID:4432

C:\Windows\SysWOW64\cacls.exe
CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:R" /E
3⤵
PID:4472

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:N"
2⤵
- Suspicious use of WriteProcessMemory
PID:756

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
3⤵
PID:3184

C:\Windows\SysWOW64\cacls.exe
CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:N"
3⤵
PID:3208

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:R" /E
2⤵
- Suspicious use of WriteProcessMemory
PID:3716

C:\Windows\SysWOW64\cacls.exe
CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:R" /E
3⤵
PID:3140

C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
"C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\6829558ede\
3⤵
- Suspicious use of WriteProcessMemory
PID:1248

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\6829558ede\
4⤵
PID:1976

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN tkools.exe /TR "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /F
3⤵
- Creates scheduled task(s)
PID:1444

C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
1⤵
- Executes dropped EXE
PID:2640

C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
1⤵
- Executes dropped EXE
PID:1872

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
MD5
56dfbe78d5e7f1c1156a8dae8672a3e5

SHA1
5ca03199a0db7465ca7fb92d2d48642f4f981d17

SHA256
250298a15ca5e40170a1feb8e639b12bbd591a448ebbfe5bc7574a1532596c46

SHA512
ea0fb267a6ab6b4838dc840ed7939dce72009d91f482d0c040e5a4d0b66a865e29a8b9e49b1c758b87a396453f0de7cef897aeb6bd3045f969cb68df68ae482f

Download Submit
C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
MD5
56dfbe78d5e7f1c1156a8dae8672a3e5

SHA1
5ca03199a0db7465ca7fb92d2d48642f4f981d17

SHA256
250298a15ca5e40170a1feb8e639b12bbd591a448ebbfe5bc7574a1532596c46

SHA512
ea0fb267a6ab6b4838dc840ed7939dce72009d91f482d0c040e5a4d0b66a865e29a8b9e49b1c758b87a396453f0de7cef897aeb6bd3045f969cb68df68ae482f

Download Submit
C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
MD5
56dfbe78d5e7f1c1156a8dae8672a3e5

SHA1
5ca03199a0db7465ca7fb92d2d48642f4f981d17

SHA256
250298a15ca5e40170a1feb8e639b12bbd591a448ebbfe5bc7574a1532596c46

SHA512
ea0fb267a6ab6b4838dc840ed7939dce72009d91f482d0c040e5a4d0b66a865e29a8b9e49b1c758b87a396453f0de7cef897aeb6bd3045f969cb68df68ae482f

Download Submit
C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
MD5
56dfbe78d5e7f1c1156a8dae8672a3e5

SHA1
5ca03199a0db7465ca7fb92d2d48642f4f981d17

SHA256
250298a15ca5e40170a1feb8e639b12bbd591a448ebbfe5bc7574a1532596c46

SHA512
ea0fb267a6ab6b4838dc840ed7939dce72009d91f482d0c040e5a4d0b66a865e29a8b9e49b1c758b87a396453f0de7cef897aeb6bd3045f969cb68df68ae482f

Download Submit
C:\Users\Admin\AppData\Local\Temp\88340284281526874389
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\88340284281526874389
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\88340284281526874389
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/512-123-0x0000000000000000-mapping.dmp

Download
memory/756-127-0x0000000000000000-mapping.dmp

Download
memory/1248-136-0x0000000000000000-mapping.dmp

Download
memory/1444-137-0x0000000000000000-mapping.dmp

Download
memory/1872-148-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/1976-138-0x0000000000000000-mapping.dmp

Download
memory/2640-144-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/3140-133-0x0000000000000000-mapping.dmp

Download
memory/3184-128-0x0000000000000000-mapping.dmp

Download
memory/3208-129-0x0000000000000000-mapping.dmp

Download
memory/3716-130-0x0000000000000000-mapping.dmp

Download
memory/3772-140-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/3772-134-0x00000000007C1000-0x00000000007E0000-memory.dmp

Filesize
124KB

Download
memory/3772-131-0x0000000000000000-mapping.dmp

Download
memory/3772-139-0x00000000001C0000-0x00000000001F9000-memory.dmp

Filesize
228KB

Download
memory/4212-118-0x0000000000891000-0x00000000008B0000-memory.dmp

Filesize
124KB

Download
memory/4212-120-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/4212-119-0x00000000004E0000-0x000000000062A000-memory.dmp

Filesize
1.3MB

Download
memory/4220-122-0x0000000000000000-mapping.dmp

Download
memory/4264-121-0x0000000000000000-mapping.dmp

Download
memory/4432-125-0x0000000000000000-mapping.dmp

Download
memory/4472-126-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads