amadey | 9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1

General

Target

9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1.exe
Size

218KB
MD5

095bde1891fcd982f461157458575d96
SHA1

75e722c6a5eedb65b6b8f4800656350b463a38db
SHA256

9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1
SHA512

3b6a7b2714d9eba8cc1ec761bf6e1933da9f9e008f0aa82ad1fdf7a8e327856ddf2d68cf4ae7bd592bc447fbaa07bb7cbf1d125d3b3c1de5957e2084e6182bbe

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

3.10

C2

loader.cyou/y5vblsjve3d/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Executes dropped EXE 4 IoCs

Processes:

orxds.exeorxds.exeorxds.exeorxds.exe

pid process

896 orxds.exe
1960 orxds.exe
1516 orxds.exe
732 orxds.exe
Loads dropped DLL 1 IoCs

Processes:

9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1.exe

pid process

1672 9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1048 schtasks.exe

pid	process
896	orxds.exe
1960	orxds.exe
1516	orxds.exe
732	orxds.exe

pid	process
1672	9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1.exe

pid	process
1048	schtasks.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1.exeorxds.execmd.exetaskeng.exe

description	pid	process	target process
PID 1672 wrote to memory of 896	1672	9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1.exe	orxds.exe
PID 1672 wrote to memory of 896	1672	9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1.exe	orxds.exe
PID 1672 wrote to memory of 896	1672	9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1.exe	orxds.exe
PID 1672 wrote to memory of 896	1672	9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1.exe	orxds.exe
PID 896 wrote to memory of 1312	896	orxds.exe	cmd.exe
PID 896 wrote to memory of 1312	896	orxds.exe	cmd.exe
PID 896 wrote to memory of 1312	896	orxds.exe	cmd.exe
PID 896 wrote to memory of 1312	896	orxds.exe	cmd.exe
PID 896 wrote to memory of 1048	896	orxds.exe	schtasks.exe
PID 896 wrote to memory of 1048	896	orxds.exe	schtasks.exe
PID 896 wrote to memory of 1048	896	orxds.exe	schtasks.exe
PID 896 wrote to memory of 1048	896	orxds.exe	schtasks.exe
PID 1312 wrote to memory of 2040	1312	cmd.exe	reg.exe
PID 1312 wrote to memory of 2040	1312	cmd.exe	reg.exe
PID 1312 wrote to memory of 2040	1312	cmd.exe	reg.exe
PID 1312 wrote to memory of 2040	1312	cmd.exe	reg.exe
PID 1968 wrote to memory of 1960	1968	taskeng.exe	orxds.exe
PID 1968 wrote to memory of 1960	1968	taskeng.exe	orxds.exe
PID 1968 wrote to memory of 1960	1968	taskeng.exe	orxds.exe
PID 1968 wrote to memory of 1960	1968	taskeng.exe	orxds.exe
PID 1968 wrote to memory of 1516	1968	taskeng.exe	orxds.exe
PID 1968 wrote to memory of 1516	1968	taskeng.exe	orxds.exe
PID 1968 wrote to memory of 1516	1968	taskeng.exe	orxds.exe
PID 1968 wrote to memory of 1516	1968	taskeng.exe	orxds.exe
PID 1968 wrote to memory of 732	1968	taskeng.exe	orxds.exe
PID 1968 wrote to memory of 732	1968	taskeng.exe	orxds.exe
PID 1968 wrote to memory of 732	1968	taskeng.exe	orxds.exe
PID 1968 wrote to memory of 732	1968	taskeng.exe	orxds.exe

C:\Users\Admin\AppData\Local\Temp\9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1.exe
"C:\Users\Admin\AppData\Local\Temp\9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1672

C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe
"C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\f31995789f\
3⤵
- Suspicious use of WriteProcessMemory
PID:1312

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\f31995789f\
4⤵
PID:2040

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN orxds.exe /TR "C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe" /F
3⤵
- Creates scheduled task(s)
PID:1048

C:\Windows\system32\taskeng.exe
taskeng.exe {C5CE6E59-59E0-4EDD-AB75-D7564D4D1297} S-1-5-21-1819626980-2277161760-1023733287-1000:TBHNEBSE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1968

C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe
C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe
2⤵
- Executes dropped EXE
PID:1960

C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe
C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe
2⤵
- Executes dropped EXE
PID:1516

C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe
C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe
2⤵
- Executes dropped EXE
PID:732

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe
Filesize
218KB

MD5
095bde1891fcd982f461157458575d96

SHA1
75e722c6a5eedb65b6b8f4800656350b463a38db

SHA256
9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1

SHA512
3b6a7b2714d9eba8cc1ec761bf6e1933da9f9e008f0aa82ad1fdf7a8e327856ddf2d68cf4ae7bd592bc447fbaa07bb7cbf1d125d3b3c1de5957e2084e6182bbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe
Filesize
218KB

MD5
095bde1891fcd982f461157458575d96

SHA1
75e722c6a5eedb65b6b8f4800656350b463a38db

SHA256
9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1

SHA512
3b6a7b2714d9eba8cc1ec761bf6e1933da9f9e008f0aa82ad1fdf7a8e327856ddf2d68cf4ae7bd592bc447fbaa07bb7cbf1d125d3b3c1de5957e2084e6182bbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe
Filesize
218KB

MD5
095bde1891fcd982f461157458575d96

SHA1
75e722c6a5eedb65b6b8f4800656350b463a38db

SHA256
9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1

SHA512
3b6a7b2714d9eba8cc1ec761bf6e1933da9f9e008f0aa82ad1fdf7a8e327856ddf2d68cf4ae7bd592bc447fbaa07bb7cbf1d125d3b3c1de5957e2084e6182bbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe
Filesize
218KB

MD5
095bde1891fcd982f461157458575d96

SHA1
75e722c6a5eedb65b6b8f4800656350b463a38db

SHA256
9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1

SHA512
3b6a7b2714d9eba8cc1ec761bf6e1933da9f9e008f0aa82ad1fdf7a8e327856ddf2d68cf4ae7bd592bc447fbaa07bb7cbf1d125d3b3c1de5957e2084e6182bbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe
Filesize
218KB

MD5
095bde1891fcd982f461157458575d96

SHA1
75e722c6a5eedb65b6b8f4800656350b463a38db

SHA256
9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1

SHA512
3b6a7b2714d9eba8cc1ec761bf6e1933da9f9e008f0aa82ad1fdf7a8e327856ddf2d68cf4ae7bd592bc447fbaa07bb7cbf1d125d3b3c1de5957e2084e6182bbe

Download Submit
\Users\Admin\AppData\Local\Temp\f31995789f\orxds.exe
Filesize
218KB

MD5
095bde1891fcd982f461157458575d96

SHA1
75e722c6a5eedb65b6b8f4800656350b463a38db

SHA256
9a97e5d42990282c168268a2ae04db384c92f69b9192bba89c4efd6f27036ef1

SHA512
3b6a7b2714d9eba8cc1ec761bf6e1933da9f9e008f0aa82ad1fdf7a8e327856ddf2d68cf4ae7bd592bc447fbaa07bb7cbf1d125d3b3c1de5957e2084e6182bbe

Download Submit
memory/732-69-0x0000000000000000-mapping.dmp

Download
memory/896-56-0x0000000000000000-mapping.dmp

Download
memory/1048-60-0x0000000000000000-mapping.dmp

Download
memory/1312-59-0x0000000000000000-mapping.dmp

Download
memory/1516-66-0x0000000000000000-mapping.dmp

Download
memory/1672-54-0x0000000075B61000-0x0000000075B63000-memory.dmp

Filesize
8KB

Download
memory/1960-63-0x0000000000000000-mapping.dmp

Download
memory/2040-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads