amadey | 9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1

General

Target

9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1.exe
Size

218KB
MD5

095bde1891fcd982f461157458575d96
SHA1

75e722c6a5eedb65b6b8f4800656350b463a38db
SHA256

9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1
SHA512

3b6a7b2714d9eba8cc1ec761bf6e1933da9f9e008f0aa82ad1fdf7a8e327856ddf2d68cf4ae7bd592bc447fbaa07bb7cbf1d125d3b3c1de5957e2084e6182bbe

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

3.10

C2

loader.cyou/y5vblsjve3d/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Executes dropped EXE 3 IoCs

Processes:

orxds.exeorxds.exeorxds.exe

pid process

928 orxds.exe
1064 orxds.exe
1836 orxds.exe
Loads dropped DLL 1 IoCs

Processes:

9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1.exe

pid process

1788 9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1988 schtasks.exe

pid	process
928	orxds.exe
1064	orxds.exe
1836	orxds.exe

pid	process
1788	9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1.exe

pid	process
1988	schtasks.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1.exeorxds.execmd.exetaskeng.exe

description	pid	process	target process
PID 1788 wrote to memory of 928	1788	9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1.exe	orxds.exe
PID 1788 wrote to memory of 928	1788	9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1.exe	orxds.exe
PID 1788 wrote to memory of 928	1788	9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1.exe	orxds.exe
PID 1788 wrote to memory of 928	1788	9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1.exe	orxds.exe
PID 928 wrote to memory of 1068	928	orxds.exe	cmd.exe
PID 928 wrote to memory of 1068	928	orxds.exe	cmd.exe
PID 928 wrote to memory of 1068	928	orxds.exe	cmd.exe
PID 928 wrote to memory of 1068	928	orxds.exe	cmd.exe
PID 928 wrote to memory of 1988	928	orxds.exe	schtasks.exe
PID 928 wrote to memory of 1988	928	orxds.exe	schtasks.exe
PID 928 wrote to memory of 1988	928	orxds.exe	schtasks.exe
PID 928 wrote to memory of 1988	928	orxds.exe	schtasks.exe
PID 1068 wrote to memory of 1980	1068	cmd.exe	reg.exe
PID 1068 wrote to memory of 1980	1068	cmd.exe	reg.exe
PID 1068 wrote to memory of 1980	1068	cmd.exe	reg.exe
PID 1068 wrote to memory of 1980	1068	cmd.exe	reg.exe
PID 576 wrote to memory of 1064	576	taskeng.exe	orxds.exe
PID 576 wrote to memory of 1064	576	taskeng.exe	orxds.exe
PID 576 wrote to memory of 1064	576	taskeng.exe	orxds.exe
PID 576 wrote to memory of 1064	576	taskeng.exe	orxds.exe
PID 576 wrote to memory of 1836	576	taskeng.exe	orxds.exe
PID 576 wrote to memory of 1836	576	taskeng.exe	orxds.exe
PID 576 wrote to memory of 1836	576	taskeng.exe	orxds.exe
PID 576 wrote to memory of 1836	576	taskeng.exe	orxds.exe

C:\Users\Admin\AppData\Local\Temp\9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1.exe
"C:\Users\Admin\AppData\Local\Temp\9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1788

C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe
"C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\f31995789f\
3⤵
- Suspicious use of WriteProcessMemory
PID:1068

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\f31995789f\
4⤵
PID:1980

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN orxds.exe /TR "C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe" /F
3⤵
- Creates scheduled task(s)
PID:1988

C:\Windows\system32\taskeng.exe
taskeng.exe {8318887E-23D9-485D-96FF-23E6FCADAFA2} S-1-5-21-1819626980-2277161760-1023733287-1000:TBHNEBSE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:576

C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe
C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe
2⤵
- Executes dropped EXE
PID:1064

C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe
C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe
2⤵
- Executes dropped EXE
PID:1836

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe
Filesize
218KB

MD5
095bde1891fcd982f461157458575d96

SHA1
75e722c6a5eedb65b6b8f4800656350b463a38db

SHA256
9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1

SHA512
3b6a7b2714d9eba8cc1ec761bf6e1933da9f9e008f0aa82ad1fdf7a8e327856ddf2d68cf4ae7bd592bc447fbaa07bb7cbf1d125d3b3c1de5957e2084e6182bbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe
Filesize
218KB

MD5
095bde1891fcd982f461157458575d96

SHA1
75e722c6a5eedb65b6b8f4800656350b463a38db

SHA256
9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1

SHA512
3b6a7b2714d9eba8cc1ec761bf6e1933da9f9e008f0aa82ad1fdf7a8e327856ddf2d68cf4ae7bd592bc447fbaa07bb7cbf1d125d3b3c1de5957e2084e6182bbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe
Filesize
218KB

MD5
095bde1891fcd982f461157458575d96

SHA1
75e722c6a5eedb65b6b8f4800656350b463a38db

SHA256
9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1

SHA512
3b6a7b2714d9eba8cc1ec761bf6e1933da9f9e008f0aa82ad1fdf7a8e327856ddf2d68cf4ae7bd592bc447fbaa07bb7cbf1d125d3b3c1de5957e2084e6182bbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe
Filesize
218KB

MD5
095bde1891fcd982f461157458575d96

SHA1
75e722c6a5eedb65b6b8f4800656350b463a38db

SHA256
9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1

SHA512
3b6a7b2714d9eba8cc1ec761bf6e1933da9f9e008f0aa82ad1fdf7a8e327856ddf2d68cf4ae7bd592bc447fbaa07bb7cbf1d125d3b3c1de5957e2084e6182bbe

Download Submit
\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe
Filesize
218KB

MD5
095bde1891fcd982f461157458575d96

SHA1
75e722c6a5eedb65b6b8f4800656350b463a38db

SHA256
9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1

SHA512
3b6a7b2714d9eba8cc1ec761bf6e1933da9f9e008f0aa82ad1fdf7a8e327856ddf2d68cf4ae7bd592bc447fbaa07bb7cbf1d125d3b3c1de5957e2084e6182bbe

Download Submit
memory/928-56-0x0000000000000000-mapping.dmp

Download
memory/1064-63-0x0000000000000000-mapping.dmp

Download
memory/1068-59-0x0000000000000000-mapping.dmp

Download
memory/1788-54-0x00000000763B1000-0x00000000763B3000-memory.dmp

Filesize
8KB

Download
memory/1836-66-0x0000000000000000-mapping.dmp

Download
memory/1980-61-0x0000000000000000-mapping.dmp

Download
memory/1988-60-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads