Analysis

  • max time kernel
    148s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    22-05-2022 01:48

General

  • Target

    e085027f0a000f7be4a5ac90460b005d03a4ef4e48579c78b5582f2a99ae6c19.exe

  • Size

    307KB

  • MD5

    ee7e3d6206b8c815c7e3c30bd40e00cc

  • SHA1

    c41bd2e3c0ac545d7ba81e26743ee4f909eccb27

  • SHA256

    e085027f0a000f7be4a5ac90460b005d03a4ef4e48579c78b5582f2a99ae6c19

  • SHA512

    7a8f98e25c44d6db495eda24247e29696b4bc195566ea5d5fd3f9aedc8c792bedf9ce8d9b826d34e52302a2ab0ec82552a2007f8811688e8f84746c66af807d7

Malware Config

Extracted

Family

amadey

Version

3.08

C2

185.215.113.35/d2VxjasuwS/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • suricata: ET MALWARE Amadey CnC Check-In

    suricata: ET MALWARE Amadey CnC Check-In

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e085027f0a000f7be4a5ac90460b005d03a4ef4e48579c78b5582f2a99ae6c19.exe
    "C:\Users\Admin\AppData\Local\Temp\e085027f0a000f7be4a5ac90460b005d03a4ef4e48579c78b5582f2a99ae6c19.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:632
    • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
      "C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1480
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\e014321378\
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:992
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\e014321378\
          4⤵
            PID:2040
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN ftewk.exe /TR "C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe" /F
          3⤵
          • Creates scheduled task(s)
          PID:2012
        • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
          "C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1128
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ftewk.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
            4⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1676
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1676 CREDAT:275457 /prefetch:2
              5⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:1712
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\9034267ed8b4ad\cred.dll, Main
          3⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • outlook_win_path
          PID:1844
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {6A699D59-CC2B-4E85-B210-21A69EF07C35} S-1-5-21-1819626980-2277161760-1023733287-1000:TBHNEBSE\Admin:Interactive:[1]
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1100
      • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
        C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
        2⤵
        • Executes dropped EXE
        PID:1896
      • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
        C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
        2⤵
        • Executes dropped EXE
        PID:948

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    System Information Discovery

    1
    T1082

    Collection

    Data from Local System

    1
    T1005

    Email Collection

    1
    T1114

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
      Filesize

      60KB

      MD5

      b9f21d8db36e88831e5352bb82c438b3

      SHA1

      4a3c330954f9f65a2f5fd7e55800e46ce228a3e2

      SHA256

      998e0209690a48ed33b79af30fc13851e3e3416bed97e3679b6030c10cab361e

      SHA512

      d4a2ac7c14227fbaf8b532398fb69053f0a0d913273f6917027c8cadbba80113fdbec20c2a7eb31b7bb57c99f9fdeccf8576be5f39346d8b564fc72fb1699476

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      9e7044cccd04cd4792f8131d370e58cd

      SHA1

      1fb16e3847437d7abb33478339a555287f86a9e5

      SHA256

      e394358175987ca9ee639df31d047e7a857551c35c0750a5d661c087bae5c811

      SHA512

      970ee31eee1d5ff54335990746ca4b7974f1358cdc0d6e10169bc000786e309f5771942342ebf19d6670d5cc8c9391392c13f542c069cc1f9ec9d9dc80bc8087

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\ezmz917\imagestore.dat
      Filesize

      21KB

      MD5

      96887fbb0a955a91f481bc26417e2dcf

      SHA1

      06d6992518ad90d8d492c137a5801dcc702b28f9

      SHA256

      18458b451417de3469acb7972c4cb6169b6e1b1a4a134f1c5ffe49d3d2a3b54c

      SHA512

      8c1f9c3e43e1ba71778358de5a0ecc100e5701d16fbe291b0a51112b69693245843043deed5c3577946a16769ad8b96b17bf99d0f696afd546ddef04baecb7ca

    • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
      Filesize

      307KB

      MD5

      ee7e3d6206b8c815c7e3c30bd40e00cc

      SHA1

      c41bd2e3c0ac545d7ba81e26743ee4f909eccb27

      SHA256

      e085027f0a000f7be4a5ac90460b005d03a4ef4e48579c78b5582f2a99ae6c19

      SHA512

      7a8f98e25c44d6db495eda24247e29696b4bc195566ea5d5fd3f9aedc8c792bedf9ce8d9b826d34e52302a2ab0ec82552a2007f8811688e8f84746c66af807d7

    • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
      Filesize

      307KB

      MD5

      ee7e3d6206b8c815c7e3c30bd40e00cc

      SHA1

      c41bd2e3c0ac545d7ba81e26743ee4f909eccb27

      SHA256

      e085027f0a000f7be4a5ac90460b005d03a4ef4e48579c78b5582f2a99ae6c19

      SHA512

      7a8f98e25c44d6db495eda24247e29696b4bc195566ea5d5fd3f9aedc8c792bedf9ce8d9b826d34e52302a2ab0ec82552a2007f8811688e8f84746c66af807d7

    • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
      Filesize

      307KB

      MD5

      ee7e3d6206b8c815c7e3c30bd40e00cc

      SHA1

      c41bd2e3c0ac545d7ba81e26743ee4f909eccb27

      SHA256

      e085027f0a000f7be4a5ac90460b005d03a4ef4e48579c78b5582f2a99ae6c19

      SHA512

      7a8f98e25c44d6db495eda24247e29696b4bc195566ea5d5fd3f9aedc8c792bedf9ce8d9b826d34e52302a2ab0ec82552a2007f8811688e8f84746c66af807d7

    • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
      Filesize

      307KB

      MD5

      ee7e3d6206b8c815c7e3c30bd40e00cc

      SHA1

      c41bd2e3c0ac545d7ba81e26743ee4f909eccb27

      SHA256

      e085027f0a000f7be4a5ac90460b005d03a4ef4e48579c78b5582f2a99ae6c19

      SHA512

      7a8f98e25c44d6db495eda24247e29696b4bc195566ea5d5fd3f9aedc8c792bedf9ce8d9b826d34e52302a2ab0ec82552a2007f8811688e8f84746c66af807d7

    • C:\Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
      Filesize

      307KB

      MD5

      ee7e3d6206b8c815c7e3c30bd40e00cc

      SHA1

      c41bd2e3c0ac545d7ba81e26743ee4f909eccb27

      SHA256

      e085027f0a000f7be4a5ac90460b005d03a4ef4e48579c78b5582f2a99ae6c19

      SHA512

      7a8f98e25c44d6db495eda24247e29696b4bc195566ea5d5fd3f9aedc8c792bedf9ce8d9b826d34e52302a2ab0ec82552a2007f8811688e8f84746c66af807d7

    • C:\Users\Admin\AppData\Roaming\9034267ed8b4ad\cred.dll
      Filesize

      126KB

      MD5

      d4ca12f7203548519be8455bd836274f

      SHA1

      7c8a18a80ba96c3944462f3a68e63b55da0e1bf4

      SHA256

      7bc6a9edc592553dcb9250d70816f511d43a998f95f4e0b2a347dc2b66f897c4

      SHA512

      e2cad4293dbb043c6d563710087e9769beeb130a80319c151e9d81d9c74b0b5017a23c3fec9cdc022b45491dc6aa6499e3898488dc9c8486e1df83e6da28e697

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\HDUHGJG4.txt
      Filesize

      606B

      MD5

      895b7e28b77bb41b90a2864200b51001

      SHA1

      5318a057d01da3343ff4d454e947cb30c45ac399

      SHA256

      363fdc7a24e5af444a642363e6920fd6b631b949c5fdb0b4c65cd6d45f5224f3

      SHA512

      8d83b37c5dc5ff86f53901323450193db41490d89cceed1ddc44a9a0456c418aceccfa06c734317f47bf25c303d4cab60c591bd076c09b0aeef1bb99b23f9e38

    • \Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
      Filesize

      307KB

      MD5

      ee7e3d6206b8c815c7e3c30bd40e00cc

      SHA1

      c41bd2e3c0ac545d7ba81e26743ee4f909eccb27

      SHA256

      e085027f0a000f7be4a5ac90460b005d03a4ef4e48579c78b5582f2a99ae6c19

      SHA512

      7a8f98e25c44d6db495eda24247e29696b4bc195566ea5d5fd3f9aedc8c792bedf9ce8d9b826d34e52302a2ab0ec82552a2007f8811688e8f84746c66af807d7

    • \Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
      Filesize

      307KB

      MD5

      ee7e3d6206b8c815c7e3c30bd40e00cc

      SHA1

      c41bd2e3c0ac545d7ba81e26743ee4f909eccb27

      SHA256

      e085027f0a000f7be4a5ac90460b005d03a4ef4e48579c78b5582f2a99ae6c19

      SHA512

      7a8f98e25c44d6db495eda24247e29696b4bc195566ea5d5fd3f9aedc8c792bedf9ce8d9b826d34e52302a2ab0ec82552a2007f8811688e8f84746c66af807d7

    • \Users\Admin\AppData\Local\Temp\e014321378\ftewk.exe
      Filesize

      307KB

      MD5

      ee7e3d6206b8c815c7e3c30bd40e00cc

      SHA1

      c41bd2e3c0ac545d7ba81e26743ee4f909eccb27

      SHA256

      e085027f0a000f7be4a5ac90460b005d03a4ef4e48579c78b5582f2a99ae6c19

      SHA512

      7a8f98e25c44d6db495eda24247e29696b4bc195566ea5d5fd3f9aedc8c792bedf9ce8d9b826d34e52302a2ab0ec82552a2007f8811688e8f84746c66af807d7

    • \Users\Admin\AppData\Roaming\9034267ed8b4ad\cred.dll
      Filesize

      126KB

      MD5

      d4ca12f7203548519be8455bd836274f

      SHA1

      7c8a18a80ba96c3944462f3a68e63b55da0e1bf4

      SHA256

      7bc6a9edc592553dcb9250d70816f511d43a998f95f4e0b2a347dc2b66f897c4

      SHA512

      e2cad4293dbb043c6d563710087e9769beeb130a80319c151e9d81d9c74b0b5017a23c3fec9cdc022b45491dc6aa6499e3898488dc9c8486e1df83e6da28e697

    • \Users\Admin\AppData\Roaming\9034267ed8b4ad\cred.dll
      Filesize

      126KB

      MD5

      d4ca12f7203548519be8455bd836274f

      SHA1

      7c8a18a80ba96c3944462f3a68e63b55da0e1bf4

      SHA256

      7bc6a9edc592553dcb9250d70816f511d43a998f95f4e0b2a347dc2b66f897c4

      SHA512

      e2cad4293dbb043c6d563710087e9769beeb130a80319c151e9d81d9c74b0b5017a23c3fec9cdc022b45491dc6aa6499e3898488dc9c8486e1df83e6da28e697

    • \Users\Admin\AppData\Roaming\9034267ed8b4ad\cred.dll
      Filesize

      126KB

      MD5

      d4ca12f7203548519be8455bd836274f

      SHA1

      7c8a18a80ba96c3944462f3a68e63b55da0e1bf4

      SHA256

      7bc6a9edc592553dcb9250d70816f511d43a998f95f4e0b2a347dc2b66f897c4

      SHA512

      e2cad4293dbb043c6d563710087e9769beeb130a80319c151e9d81d9c74b0b5017a23c3fec9cdc022b45491dc6aa6499e3898488dc9c8486e1df83e6da28e697

    • \Users\Admin\AppData\Roaming\9034267ed8b4ad\cred.dll
      Filesize

      126KB

      MD5

      d4ca12f7203548519be8455bd836274f

      SHA1

      7c8a18a80ba96c3944462f3a68e63b55da0e1bf4

      SHA256

      7bc6a9edc592553dcb9250d70816f511d43a998f95f4e0b2a347dc2b66f897c4

      SHA512

      e2cad4293dbb043c6d563710087e9769beeb130a80319c151e9d81d9c74b0b5017a23c3fec9cdc022b45491dc6aa6499e3898488dc9c8486e1df83e6da28e697

    • memory/632-60-0x00000000005B8000-0x00000000005D7000-memory.dmp
      Filesize

      124KB

    • memory/632-54-0x00000000005B8000-0x00000000005D7000-memory.dmp
      Filesize

      124KB

    • memory/632-62-0x0000000000400000-0x0000000000478000-memory.dmp
      Filesize

      480KB

    • memory/632-61-0x0000000000230000-0x0000000000268000-memory.dmp
      Filesize

      224KB

    • memory/632-55-0x0000000075391000-0x0000000075393000-memory.dmp
      Filesize

      8KB

    • memory/948-103-0x0000000000000000-mapping.dmp
    • memory/948-105-0x0000000000548000-0x0000000000566000-memory.dmp
      Filesize

      120KB

    • memory/948-107-0x0000000000548000-0x0000000000566000-memory.dmp
      Filesize

      120KB

    • memory/948-108-0x0000000000400000-0x0000000000478000-memory.dmp
      Filesize

      480KB

    • memory/992-65-0x0000000000000000-mapping.dmp
    • memory/1128-79-0x00000000004B911E-mapping.dmp
    • memory/1128-72-0x0000000000400000-0x00000000004C4000-memory.dmp
      Filesize

      784KB

    • memory/1128-73-0x0000000000400000-0x00000000004C4000-memory.dmp
      Filesize

      784KB

    • memory/1128-75-0x0000000000400000-0x00000000004C4000-memory.dmp
      Filesize

      784KB

    • memory/1128-77-0x0000000000400000-0x00000000004C4000-memory.dmp
      Filesize

      784KB

    • memory/1128-78-0x0000000000400000-0x00000000004C4000-memory.dmp
      Filesize

      784KB

    • memory/1128-83-0x0000000000402000-0x00000000004B9200-memory.dmp
      Filesize

      732KB

    • memory/1128-82-0x0000000000402000-0x00000000004B9200-memory.dmp
      Filesize

      732KB

    • memory/1480-69-0x0000000000400000-0x0000000000478000-memory.dmp
      Filesize

      480KB

    • memory/1480-68-0x0000000000288000-0x00000000002A7000-memory.dmp
      Filesize

      124KB

    • memory/1480-63-0x0000000000288000-0x00000000002A7000-memory.dmp
      Filesize

      124KB

    • memory/1480-58-0x0000000000000000-mapping.dmp
    • memory/1844-92-0x0000000000000000-mapping.dmp
    • memory/1844-99-0x0000000000161000-0x000000000017B000-memory.dmp
      Filesize

      104KB

    • memory/1896-91-0x0000000000400000-0x0000000000478000-memory.dmp
      Filesize

      480KB

    • memory/1896-90-0x0000000000648000-0x0000000000666000-memory.dmp
      Filesize

      120KB

    • memory/1896-88-0x0000000000648000-0x0000000000666000-memory.dmp
      Filesize

      120KB

    • memory/1896-86-0x0000000000000000-mapping.dmp
    • memory/2012-66-0x0000000000000000-mapping.dmp
    • memory/2040-67-0x0000000000000000-mapping.dmp