amadey | 9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1

General

Target

9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1.exe
Size

218KB
MD5

095bde1891fcd982f461157458575d96
SHA1

75e722c6a5eedb65b6b8f4800656350b463a38db
SHA256

9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1
SHA512

3b6a7b2714d9eba8cc1ec761bf6e1933da9f9e008f0aa82ad1fdf7a8e327856ddf2d68cf4ae7bd592bc447fbaa07bb7cbf1d125d3b3c1de5957e2084e6182bbe

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

3.10

C2

loader.cyou/y5vblsjve3d/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Executes dropped EXE 4 IoCs

Processes:

orxds.exeorxds.exeorxds.exeorxds.exe

pid process

5024 orxds.exe
2652 orxds.exe
1028 orxds.exe
656 orxds.exe

pid	process
5024	orxds.exe
2652	orxds.exe
1028	orxds.exe
656	orxds.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1.exeorxds.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	orxds.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1624 schtasks.exe

pid	process
1624	schtasks.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1.exeorxds.execmd.exe

description	pid	process	target process
PID 1364 wrote to memory of 5024	1364	9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1.exe	orxds.exe
PID 1364 wrote to memory of 5024	1364	9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1.exe	orxds.exe
PID 1364 wrote to memory of 5024	1364	9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1.exe	orxds.exe
PID 5024 wrote to memory of 2352	5024	orxds.exe	cmd.exe
PID 5024 wrote to memory of 2352	5024	orxds.exe	cmd.exe
PID 5024 wrote to memory of 2352	5024	orxds.exe	cmd.exe
PID 5024 wrote to memory of 1624	5024	orxds.exe	schtasks.exe
PID 5024 wrote to memory of 1624	5024	orxds.exe	schtasks.exe
PID 5024 wrote to memory of 1624	5024	orxds.exe	schtasks.exe
PID 2352 wrote to memory of 5000	2352	cmd.exe	reg.exe
PID 2352 wrote to memory of 5000	2352	cmd.exe	reg.exe
PID 2352 wrote to memory of 5000	2352	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1.exe
"C:\Users\Admin\AppData\Local\Temp\9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe
  "C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\f31995789f\
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2352
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\f31995789f\
      4⤵
      PID:5000
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN orxds.exe /TR "C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:1624

C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe
C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe
1⤵
- Executes dropped EXE
PID:2652

C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe
C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe
1⤵
- Executes dropped EXE
PID:1028

C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe
C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe
1⤵
- Executes dropped EXE
PID:656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe

Filesize
218KB

MD5
095bde1891fcd982f461157458575d96

SHA1
75e722c6a5eedb65b6b8f4800656350b463a38db

SHA256
9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1

SHA512
3b6a7b2714d9eba8cc1ec761bf6e1933da9f9e008f0aa82ad1fdf7a8e327856ddf2d68cf4ae7bd592bc447fbaa07bb7cbf1d125d3b3c1de5957e2084e6182bbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe

Filesize
218KB

MD5
095bde1891fcd982f461157458575d96

SHA1
75e722c6a5eedb65b6b8f4800656350b463a38db

SHA256
9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1

SHA512
3b6a7b2714d9eba8cc1ec761bf6e1933da9f9e008f0aa82ad1fdf7a8e327856ddf2d68cf4ae7bd592bc447fbaa07bb7cbf1d125d3b3c1de5957e2084e6182bbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe

Filesize
218KB

MD5
095bde1891fcd982f461157458575d96

SHA1
75e722c6a5eedb65b6b8f4800656350b463a38db

SHA256
9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1

SHA512
3b6a7b2714d9eba8cc1ec761bf6e1933da9f9e008f0aa82ad1fdf7a8e327856ddf2d68cf4ae7bd592bc447fbaa07bb7cbf1d125d3b3c1de5957e2084e6182bbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe

Filesize
218KB

MD5
095bde1891fcd982f461157458575d96

SHA1
75e722c6a5eedb65b6b8f4800656350b463a38db

SHA256
9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1

SHA512
3b6a7b2714d9eba8cc1ec761bf6e1933da9f9e008f0aa82ad1fdf7a8e327856ddf2d68cf4ae7bd592bc447fbaa07bb7cbf1d125d3b3c1de5957e2084e6182bbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe

Filesize
218KB

MD5
095bde1891fcd982f461157458575d96

SHA1
75e722c6a5eedb65b6b8f4800656350b463a38db

SHA256
9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1

SHA512
3b6a7b2714d9eba8cc1ec761bf6e1933da9f9e008f0aa82ad1fdf7a8e327856ddf2d68cf4ae7bd592bc447fbaa07bb7cbf1d125d3b3c1de5957e2084e6182bbe

Download Submit
memory/1624-134-0x0000000000000000-mapping.dmp

Download
memory/2352-133-0x0000000000000000-mapping.dmp

Download
memory/5000-135-0x0000000000000000-mapping.dmp

Download
memory/5024-130-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads