amadey | 983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26

General

Target

983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
Size

21KB
MD5

d5d6d152edeeb1a13020514aceaad436
SHA1

1909b7fd2f20c4c2e4ecd8c186863f0ca90867d9
SHA256

983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26
SHA512

1e398c67483e9cab11e99af590c59274d5f6c23c5a69c88a019052074890b69c8148728fd880ecd7f91ad53f310a061b86154d985948ccc12f33640a0f23b6d0

Score

10^/10

amadey collection spyware stealer suricata trojan

Malware Config

Extracted

Family

amadey

Version

3.08

C2

190.123.44.138/Qbv2ff03/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
suricata
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

9 820 rundll32.exe
Downloads MZ/PE file

flow	pid	process
9	820	rundll32.exe

Drops startup file 2 IoCs

Processes:

983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe

Loads dropped DLL 4 IoCs

Processes:

rundll32.exe

pid process

820 rundll32.exe
820 rundll32.exe
820 rundll32.exe
820 rundll32.exe
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
820	rundll32.exe
820	rundll32.exe
820	rundll32.exe
820	rundll32.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe

description	pid	process	target process
PID 1984 set thread context of 1932	1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 48 IoCs

Processes:

983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exerundll32.exe

pid	process
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
820	rundll32.exe
820	rundll32.exe
820	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe

description pid process

Token: SeDebugPrivilege 1984 983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe

description	pid	process
Token: SeDebugPrivilege	1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe

outlook_win_path 1 IoCs

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
"C:\Users\Admin\AppData\Local\Temp\983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984

C:\Users\Admin\AppData\Local\Temp\983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
"C:\Users\Admin\AppData\Local\Temp\983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\376fde80dfdc81\cred.dll, Main
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
PID:820

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\376fde80dfdc81\cred.dll
Filesize
126KB

MD5
cab629e61884212c046e0147a3585f5f

SHA1
10265561adbdfb39dac01337468f183c336fcd71

SHA256
3dfdec90c5e2ebde218405a6f6283637c12dca1b4a7bc465c9b752b8f700c6e9

SHA512
fbdfb02cf61e510690742429168db1378d7c09df7441b09d771371833861c58d673913f93c20583d66891b3883b6ecce19313a966471c2f79c3e9482bdf5e9a9

Download Submit
\Users\Admin\AppData\Roaming\376fde80dfdc81\cred.dll
Filesize
126KB

MD5
cab629e61884212c046e0147a3585f5f

SHA1
10265561adbdfb39dac01337468f183c336fcd71

SHA256
3dfdec90c5e2ebde218405a6f6283637c12dca1b4a7bc465c9b752b8f700c6e9

SHA512
fbdfb02cf61e510690742429168db1378d7c09df7441b09d771371833861c58d673913f93c20583d66891b3883b6ecce19313a966471c2f79c3e9482bdf5e9a9

Download Submit
\Users\Admin\AppData\Roaming\376fde80dfdc81\cred.dll
Filesize
126KB

MD5
cab629e61884212c046e0147a3585f5f

SHA1
10265561adbdfb39dac01337468f183c336fcd71

SHA256
3dfdec90c5e2ebde218405a6f6283637c12dca1b4a7bc465c9b752b8f700c6e9

SHA512
fbdfb02cf61e510690742429168db1378d7c09df7441b09d771371833861c58d673913f93c20583d66891b3883b6ecce19313a966471c2f79c3e9482bdf5e9a9

Download Submit
\Users\Admin\AppData\Roaming\376fde80dfdc81\cred.dll
Filesize
126KB

MD5
cab629e61884212c046e0147a3585f5f

SHA1
10265561adbdfb39dac01337468f183c336fcd71

SHA256
3dfdec90c5e2ebde218405a6f6283637c12dca1b4a7bc465c9b752b8f700c6e9

SHA512
fbdfb02cf61e510690742429168db1378d7c09df7441b09d771371833861c58d673913f93c20583d66891b3883b6ecce19313a966471c2f79c3e9482bdf5e9a9

Download Submit
\Users\Admin\AppData\Roaming\376fde80dfdc81\cred.dll
Filesize
126KB

MD5
cab629e61884212c046e0147a3585f5f

SHA1
10265561adbdfb39dac01337468f183c336fcd71

SHA256
3dfdec90c5e2ebde218405a6f6283637c12dca1b4a7bc465c9b752b8f700c6e9

SHA512
fbdfb02cf61e510690742429168db1378d7c09df7441b09d771371833861c58d673913f93c20583d66891b3883b6ecce19313a966471c2f79c3e9482bdf5e9a9

Download Submit
memory/820-75-0x0000000000000000-mapping.dmp

Download
memory/1932-60-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1932-69-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1932-67-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1932-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1932-59-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1932-70-0x000000000041344C-mapping.dmp

Download
memory/1932-73-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1932-66-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1932-74-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1932-62-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1984-54-0x0000000000840000-0x000000000084A000-memory.dmp

Filesize
40KB

Download
memory/1984-58-0x0000000001F90000-0x0000000001F98000-memory.dmp

Filesize
32KB

Download
memory/1984-57-0x00000000004D0000-0x0000000000514000-memory.dmp

Filesize
272KB

Download
memory/1984-56-0x0000000004D45000-0x0000000004D56000-memory.dmp

Filesize
68KB

Download
memory/1984-55-0x00000000764C1000-0x00000000764C3000-memory.dmp

Filesize
8KB

Download

description	pid	process	target process
PID 1984 wrote to memory of 1932	1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
PID 1984 wrote to memory of 1932	1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
PID 1984 wrote to memory of 1932	1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
PID 1984 wrote to memory of 1932	1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
PID 1984 wrote to memory of 1932	1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
PID 1984 wrote to memory of 1932	1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
PID 1984 wrote to memory of 1932	1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
PID 1984 wrote to memory of 1932	1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
PID 1984 wrote to memory of 1932	1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
PID 1984 wrote to memory of 1932	1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
PID 1984 wrote to memory of 1932	1984	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe
PID 1932 wrote to memory of 820	1932	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe	rundll32.exe
PID 1932 wrote to memory of 820	1932	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe	rundll32.exe
PID 1932 wrote to memory of 820	1932	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe	rundll32.exe
PID 1932 wrote to memory of 820	1932	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe	rundll32.exe
PID 1932 wrote to memory of 820	1932	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe	rundll32.exe
PID 1932 wrote to memory of 820	1932	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe	rundll32.exe
PID 1932 wrote to memory of 820	1932	983fe88a155bdc1b17641ff91365b1fd5cb53654d113954d16c50aed9696cf26.exe	rundll32.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads