amadey | 4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df

General

Target

4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
Size

23KB
MD5

f6a89138844ae967a364d21960ecf30d
SHA1

49fedb666276b477e636e493be47d1011fddbf06
SHA256

4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df
SHA512

af81ed3093e5a46fad90efc073ea353bf3a192aa21081f2811d54cae2b8aaaaebf7e351f06f1d1dad22fef68ac5dc326333bdaec1ac0958fe716c111bfd25a30

Score

10^/10

amadey collection spyware stealer suricata trojan

Malware Config

Extracted

Family

amadey

Version

3.08

C2

190.123.44.138/Qbv2ff03/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
suricata
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

7 1484 rundll32.exe

flow	pid	process
7	1484	rundll32.exe

Drops startup file 2 IoCs

Processes:

4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe

Loads dropped DLL 4 IoCs

Processes:

rundll32.exe

pid process

1484 rundll32.exe
1484 rundll32.exe
1484 rundll32.exe
1484 rundll32.exe
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1484	rundll32.exe
1484	rundll32.exe
1484	rundll32.exe
1484	rundll32.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe

description	pid	process	target process
PID 892 set thread context of 2032	892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 47 IoCs

Processes:

4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exerundll32.exe

pid	process
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
1484	rundll32.exe
1484	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe

description pid process

Token: SeDebugPrivilege 892 4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe

description	pid	process
Token: SeDebugPrivilege	892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe

outlook_win_path 1 IoCs

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
"C:\Users\Admin\AppData\Local\Temp\4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:892

C:\Users\Admin\AppData\Local\Temp\4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
"C:\Users\Admin\AppData\Local\Temp\4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\376fde80dfdc81\cred.dll, Main
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
PID:1484

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\376fde80dfdc81\cred.dll
Filesize
126KB

MD5
cab629e61884212c046e0147a3585f5f

SHA1
10265561adbdfb39dac01337468f183c336fcd71

SHA256
3dfdec90c5e2ebde218405a6f6283637c12dca1b4a7bc465c9b752b8f700c6e9

SHA512
fbdfb02cf61e510690742429168db1378d7c09df7441b09d771371833861c58d673913f93c20583d66891b3883b6ecce19313a966471c2f79c3e9482bdf5e9a9

Download Submit
\Users\Admin\AppData\Roaming\376fde80dfdc81\cred.dll
Filesize
126KB

MD5
cab629e61884212c046e0147a3585f5f

SHA1
10265561adbdfb39dac01337468f183c336fcd71

SHA256
3dfdec90c5e2ebde218405a6f6283637c12dca1b4a7bc465c9b752b8f700c6e9

SHA512
fbdfb02cf61e510690742429168db1378d7c09df7441b09d771371833861c58d673913f93c20583d66891b3883b6ecce19313a966471c2f79c3e9482bdf5e9a9

Download Submit
\Users\Admin\AppData\Roaming\376fde80dfdc81\cred.dll
Filesize
126KB

MD5
cab629e61884212c046e0147a3585f5f

SHA1
10265561adbdfb39dac01337468f183c336fcd71

SHA256
3dfdec90c5e2ebde218405a6f6283637c12dca1b4a7bc465c9b752b8f700c6e9

SHA512
fbdfb02cf61e510690742429168db1378d7c09df7441b09d771371833861c58d673913f93c20583d66891b3883b6ecce19313a966471c2f79c3e9482bdf5e9a9

Download Submit
\Users\Admin\AppData\Roaming\376fde80dfdc81\cred.dll
Filesize
126KB

MD5
cab629e61884212c046e0147a3585f5f

SHA1
10265561adbdfb39dac01337468f183c336fcd71

SHA256
3dfdec90c5e2ebde218405a6f6283637c12dca1b4a7bc465c9b752b8f700c6e9

SHA512
fbdfb02cf61e510690742429168db1378d7c09df7441b09d771371833861c58d673913f93c20583d66891b3883b6ecce19313a966471c2f79c3e9482bdf5e9a9

Download Submit
\Users\Admin\AppData\Roaming\376fde80dfdc81\cred.dll
Filesize
126KB

MD5
cab629e61884212c046e0147a3585f5f

SHA1
10265561adbdfb39dac01337468f183c336fcd71

SHA256
3dfdec90c5e2ebde218405a6f6283637c12dca1b4a7bc465c9b752b8f700c6e9

SHA512
fbdfb02cf61e510690742429168db1378d7c09df7441b09d771371833861c58d673913f93c20583d66891b3883b6ecce19313a966471c2f79c3e9482bdf5e9a9

Download Submit
memory/892-55-0x00000000763B1000-0x00000000763B3000-memory.dmp

Filesize
8KB

Download
memory/892-56-0x0000000000AC0000-0x0000000000B04000-memory.dmp

Filesize
272KB

Download
memory/892-57-0x0000000000550000-0x0000000000558000-memory.dmp

Filesize
32KB

Download
memory/892-54-0x0000000000B30000-0x0000000000B3C000-memory.dmp

Filesize
48KB

Download
memory/1484-74-0x0000000000000000-mapping.dmp

Download
memory/1484-81-0x0000000000131000-0x000000000014B000-memory.dmp

Filesize
104KB

Download
memory/2032-59-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2032-72-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2032-73-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2032-69-0x000000000041344C-mapping.dmp

Download
memory/2032-68-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2032-66-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2032-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2032-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2032-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2032-58-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download

description	pid	process	target process
PID 892 wrote to memory of 2032	892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
PID 892 wrote to memory of 2032	892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
PID 892 wrote to memory of 2032	892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
PID 892 wrote to memory of 2032	892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
PID 892 wrote to memory of 2032	892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
PID 892 wrote to memory of 2032	892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
PID 892 wrote to memory of 2032	892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
PID 892 wrote to memory of 2032	892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
PID 892 wrote to memory of 2032	892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
PID 892 wrote to memory of 2032	892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
PID 892 wrote to memory of 2032	892	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe
PID 2032 wrote to memory of 1484	2032	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe	rundll32.exe
PID 2032 wrote to memory of 1484	2032	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe	rundll32.exe
PID 2032 wrote to memory of 1484	2032	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe	rundll32.exe
PID 2032 wrote to memory of 1484	2032	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe	rundll32.exe
PID 2032 wrote to memory of 1484	2032	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe	rundll32.exe
PID 2032 wrote to memory of 1484	2032	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe	rundll32.exe
PID 2032 wrote to memory of 1484	2032	4c53c592ba9ac00d3a729b34c3f1847d4f2fc26174bda2eaa1cff69d16b7e4df.exe	rundll32.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads