Overview

overview

10

Static

static

10

c730063f16...5c.exe

windows7_x64

10

c730063f16...5c.exe

windows10_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    08/01/2022, 10:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    c730063f167122d2a9721c4e3eff5d5c.exe
  • Size 222KB
  • Sample220108-l43pgadchr
  • SHA256 e70a8d5fe537aa2f7bb4d014ee5c35a9c169adab64c4e034d9badd8e8641f26b
  • MD5 SHA1 SHA512
Score
10/10
amadeysuricatatrojan

Malware Config

Extracted

Family

  • amadey

Version

  • 2.85

C2

  • 185.215.113.47/Gv93xs2Nz/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • suricata: ET MALWARE Amadey CnC Check-In

    suricata: ET MALWARE Amadey CnC Check-In

    suricata
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c730063f167122d2a9721c4e3eff5d5c.exe
    "C:\Users\Admin\AppData\Local\Temp\c730063f167122d2a9721c4e3eff5d5c.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1636
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\1c26d79f8d\tkools.exe" /P "Admin:N"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:972
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        3⤵
          PID:660
        • C:\Windows\SysWOW64\cacls.exe
          CACLS "C:\Users\Admin\AppData\Local\Temp\1c26d79f8d\tkools.exe" /P "Admin:N"
          3⤵
            PID:780
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\1c26d79f8d\tkools.exe" /P "Admin:R" /E
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:732
          • C:\Windows\SysWOW64\cacls.exe
            CACLS "C:\Users\Admin\AppData\Local\Temp\1c26d79f8d\tkools.exe" /P "Admin:R" /E
            3⤵
              PID:576
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\1c26d79f8d" /P "Admin:N"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:336
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              3⤵
                PID:776
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "C:\Users\Admin\AppData\Local\Temp\1c26d79f8d" /P "Admin:N"
                3⤵
                  PID:816
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\1c26d79f8d" /P "Admin:R" /E
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1192
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "C:\Users\Admin\AppData\Local\Temp\1c26d79f8d" /P "Admin:R" /E
                  3⤵
                    PID:1312
                • C:\Users\Admin\AppData\Local\Temp\1c26d79f8d\tkools.exe
                  "C:\Users\Admin\AppData\Local\Temp\1c26d79f8d\tkools.exe"
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:1464
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\1c26d79f8d\
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1116
                    • C:\Windows\SysWOW64\reg.exe
                      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\1c26d79f8d\
                      4⤵
                        PID:856
                    • C:\Windows\SysWOW64\schtasks.exe
                      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN tkools.exe /TR "C:\Users\Admin\AppData\Local\Temp\1c26d79f8d\tkools.exe" /F
                      3⤵
                      • Creates scheduled task(s)
                      PID:960
                • C:\Windows\system32\taskeng.exe
                  taskeng.exe {DDC434BF-3CFD-4EC6-BB23-EC820E01598B} S-1-5-21-3846991908-3261386348-1409841751-1000:VQVVOAJK\Admin:Interactive:[1]
                  1⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1880
                  • C:\Users\Admin\AppData\Local\Temp\1c26d79f8d\tkools.exe
                    C:\Users\Admin\AppData\Local\Temp\1c26d79f8d\tkools.exe
                    2⤵
                    • Executes dropped EXE
                    PID:1612
                  • C:\Users\Admin\AppData\Local\Temp\1c26d79f8d\tkools.exe
                    C:\Users\Admin\AppData\Local\Temp\1c26d79f8d\tkools.exe
                    2⤵
                    • Executes dropped EXE
                    PID:1392
                  • C:\Users\Admin\AppData\Local\Temp\1c26d79f8d\tkools.exe
                    C:\Users\Admin\AppData\Local\Temp\1c26d79f8d\tkools.exe
                    2⤵
                    • Executes dropped EXE
                    PID:1316

                Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      memory/1636-54-0x0000000076421000-0x0000000076423000-memory.dmp
                      Download