Analysis

  • max time kernel
    200s
  • max time network
    212s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    12-05-2022 13:50

General

  • Target

    99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492.exe

  • Size

    312KB

  • MD5

    d5a042d15c800a5f811e993b95d64596

  • SHA1

    3ca2653f3ec0da78c094beaf3529fffc5784ef37

  • SHA256

    99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492

  • SHA512

    8c0f89be709beaac7b0584dc6f9021f4aff22291c59751b6a235b1a27f4145a860c0246df383d1135968fd0c810ff3b0bcaa74bcffb391540d549f7514cc8efd

Malware Config

Extracted

Family

amadey

Version

3.08

C2

185.215.113.35/d2VxjasuwS/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • suricata: ET MALWARE Amadey CnC Check-In

    suricata: ET MALWARE Amadey CnC Check-In

  • Blocklisted process makes network request ⋅ 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE ⋅ 3 IoCs
  • Loads dropped DLL ⋅ 6 IoCs
  • Reads local data of messenger clients ⋅ 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Accesses Microsoft Outlook profiles ⋅ 1 TTPs 1 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) ⋅ 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses ⋅ 4 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 31 IoCs
  • outlook_win_path ⋅ 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492.exe
    "C:\Users\Admin\AppData\Local\Temp\99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492.exe"
    Loads dropped DLL
    Suspicious use of WriteProcessMemory
    PID:952
    • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
      "C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe"
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1400
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\e014321378\
        Suspicious use of WriteProcessMemory
        PID:2020
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\e014321378\
          PID:596
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN ftewk.exe /TR "C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe" /F
        Creates scheduled task(s)
        PID:1352
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\9034267ed8b4ad\cred.dll, Main
        Blocklisted process makes network request
        Loads dropped DLL
        Accesses Microsoft Outlook profiles
        Suspicious behavior: EnumeratesProcesses
        outlook_win_path
        PID:1348
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {181547B6-885B-40BA-B2EF-D6C9568B5115} S-1-5-21-1083475884-596052423-1669053738-1000:WYZSGDWS\Admin:Interactive:[1]
    Suspicious use of WriteProcessMemory
    PID:1256
    • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
      C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
      Executes dropped EXE
      PID:1364
    • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
      C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
      Executes dropped EXE
      PID:112

Network

MITRE ATT&CK Matrix

Command and Control

    Credential Access

    Defense Evasion

      Execution

        Exfiltration

          Impact

            Initial Access

              Lateral Movement

                Persistence

                Privilege Escalation

                  Replay Monitor

                  00:00 00:00

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
                    MD5

                    d5a042d15c800a5f811e993b95d64596

                    SHA1

                    3ca2653f3ec0da78c094beaf3529fffc5784ef37

                    SHA256

                    99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492

                    SHA512

                    8c0f89be709beaac7b0584dc6f9021f4aff22291c59751b6a235b1a27f4145a860c0246df383d1135968fd0c810ff3b0bcaa74bcffb391540d549f7514cc8efd

                  • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
                    MD5

                    d5a042d15c800a5f811e993b95d64596

                    SHA1

                    3ca2653f3ec0da78c094beaf3529fffc5784ef37

                    SHA256

                    99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492

                    SHA512

                    8c0f89be709beaac7b0584dc6f9021f4aff22291c59751b6a235b1a27f4145a860c0246df383d1135968fd0c810ff3b0bcaa74bcffb391540d549f7514cc8efd

                  • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
                    MD5

                    d5a042d15c800a5f811e993b95d64596

                    SHA1

                    3ca2653f3ec0da78c094beaf3529fffc5784ef37

                    SHA256

                    99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492

                    SHA512

                    8c0f89be709beaac7b0584dc6f9021f4aff22291c59751b6a235b1a27f4145a860c0246df383d1135968fd0c810ff3b0bcaa74bcffb391540d549f7514cc8efd

                  • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
                    MD5

                    d5a042d15c800a5f811e993b95d64596

                    SHA1

                    3ca2653f3ec0da78c094beaf3529fffc5784ef37

                    SHA256

                    99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492

                    SHA512

                    8c0f89be709beaac7b0584dc6f9021f4aff22291c59751b6a235b1a27f4145a860c0246df383d1135968fd0c810ff3b0bcaa74bcffb391540d549f7514cc8efd

                  • C:\Users\Admin\AppData\Roaming\9034267ed8b4ad\cred.dll
                    MD5

                    d4ca12f7203548519be8455bd836274f

                    SHA1

                    7c8a18a80ba96c3944462f3a68e63b55da0e1bf4

                    SHA256

                    7bc6a9edc592553dcb9250d70816f511d43a998f95f4e0b2a347dc2b66f897c4

                    SHA512

                    e2cad4293dbb043c6d563710087e9769beeb130a80319c151e9d81d9c74b0b5017a23c3fec9cdc022b45491dc6aa6499e3898488dc9c8486e1df83e6da28e697

                  • \Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
                    MD5

                    d5a042d15c800a5f811e993b95d64596

                    SHA1

                    3ca2653f3ec0da78c094beaf3529fffc5784ef37

                    SHA256

                    99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492

                    SHA512

                    8c0f89be709beaac7b0584dc6f9021f4aff22291c59751b6a235b1a27f4145a860c0246df383d1135968fd0c810ff3b0bcaa74bcffb391540d549f7514cc8efd

                  • \Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
                    MD5

                    d5a042d15c800a5f811e993b95d64596

                    SHA1

                    3ca2653f3ec0da78c094beaf3529fffc5784ef37

                    SHA256

                    99f99978fec96a454a3c9e9f4e05d7c12dcc559d4a0f97a86828a2d324bee492

                    SHA512

                    8c0f89be709beaac7b0584dc6f9021f4aff22291c59751b6a235b1a27f4145a860c0246df383d1135968fd0c810ff3b0bcaa74bcffb391540d549f7514cc8efd

                  • \Users\Admin\AppData\Roaming\9034267ed8b4ad\cred.dll
                    MD5

                    d4ca12f7203548519be8455bd836274f

                    SHA1

                    7c8a18a80ba96c3944462f3a68e63b55da0e1bf4

                    SHA256

                    7bc6a9edc592553dcb9250d70816f511d43a998f95f4e0b2a347dc2b66f897c4

                    SHA512

                    e2cad4293dbb043c6d563710087e9769beeb130a80319c151e9d81d9c74b0b5017a23c3fec9cdc022b45491dc6aa6499e3898488dc9c8486e1df83e6da28e697

                  • \Users\Admin\AppData\Roaming\9034267ed8b4ad\cred.dll
                    MD5

                    d4ca12f7203548519be8455bd836274f

                    SHA1

                    7c8a18a80ba96c3944462f3a68e63b55da0e1bf4

                    SHA256

                    7bc6a9edc592553dcb9250d70816f511d43a998f95f4e0b2a347dc2b66f897c4

                    SHA512

                    e2cad4293dbb043c6d563710087e9769beeb130a80319c151e9d81d9c74b0b5017a23c3fec9cdc022b45491dc6aa6499e3898488dc9c8486e1df83e6da28e697

                  • \Users\Admin\AppData\Roaming\9034267ed8b4ad\cred.dll
                    MD5

                    d4ca12f7203548519be8455bd836274f

                    SHA1

                    7c8a18a80ba96c3944462f3a68e63b55da0e1bf4

                    SHA256

                    7bc6a9edc592553dcb9250d70816f511d43a998f95f4e0b2a347dc2b66f897c4

                    SHA512

                    e2cad4293dbb043c6d563710087e9769beeb130a80319c151e9d81d9c74b0b5017a23c3fec9cdc022b45491dc6aa6499e3898488dc9c8486e1df83e6da28e697

                  • \Users\Admin\AppData\Roaming\9034267ed8b4ad\cred.dll
                    MD5

                    d4ca12f7203548519be8455bd836274f

                    SHA1

                    7c8a18a80ba96c3944462f3a68e63b55da0e1bf4

                    SHA256

                    7bc6a9edc592553dcb9250d70816f511d43a998f95f4e0b2a347dc2b66f897c4

                    SHA512

                    e2cad4293dbb043c6d563710087e9769beeb130a80319c151e9d81d9c74b0b5017a23c3fec9cdc022b45491dc6aa6499e3898488dc9c8486e1df83e6da28e697

                  • memory/112-86-0x0000000000400000-0x0000000000491000-memory.dmp
                  • memory/112-85-0x000000000056E000-0x000000000058C000-memory.dmp
                  • memory/112-82-0x0000000000000000-mapping.dmp
                  • memory/596-65-0x0000000000000000-mapping.dmp
                  • memory/952-55-0x000000000030E000-0x000000000032C000-memory.dmp
                  • memory/952-54-0x0000000075711000-0x0000000075713000-memory.dmp
                  • memory/952-57-0x0000000000400000-0x0000000000491000-memory.dmp
                  • memory/952-56-0x00000000001B0000-0x00000000001E8000-memory.dmp
                  • memory/1348-68-0x0000000000000000-mapping.dmp
                  • memory/1348-75-0x0000000000121000-0x000000000013B000-memory.dmp
                  • memory/1352-64-0x0000000000000000-mapping.dmp
                  • memory/1364-77-0x0000000000000000-mapping.dmp
                  • memory/1364-80-0x000000000057E000-0x000000000059C000-memory.dmp
                  • memory/1364-81-0x0000000000400000-0x0000000000491000-memory.dmp
                  • memory/1400-60-0x0000000000000000-mapping.dmp
                  • memory/1400-67-0x0000000000400000-0x0000000000491000-memory.dmp
                  • memory/1400-66-0x00000000002CE000-0x00000000002EC000-memory.dmp
                  • memory/2020-63-0x0000000000000000-mapping.dmp