Analysis

  • max time kernel
    113s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    31/10/2022, 22:03

General

  • Target

    file.exe

  • Size

    268KB

  • MD5

    5a5e87d1ca5b3b323a603ccef736119a

  • SHA1

    a52a3d51df3ad463229bc2148d6767ba60199425

  • SHA256

    e148b601cabaf0ff2242d4e204090f34e12c5f181793008125ab53c4bca8cc80

  • SHA512

    03b64cfbc98a0f10f9200271899915f57e264de49c810a1d935a7855e2a4bfbef4356e6ae319e6d91c0b0f2a12a595c53f728473d26883cfdaf3d1f65194bd16

  • SSDEEP

    6144:myNxdxQ0qLfl0H1R+4qzLR3Z69Zrsf3AKvAlx:myfdaZbS184o3Z69ZreMlx

Malware Config

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detect Amadey credential stealer module 5 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1436
    • C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
      "C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:760
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe" /F
        3⤵
        • Creates scheduled task(s)
        PID:552
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\80b59841e5c623\cred64.dll, Main
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • outlook_win_path
        PID:860
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {F02B6401-4CD8-44CA-8DF0-ABD4E98F6BA7} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1260
    • C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
      C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
      2⤵
      • Executes dropped EXE
      PID:832
    • C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
      C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
      2⤵
      • Executes dropped EXE
      PID:1980

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe

          Filesize

          268KB

          MD5

          5a5e87d1ca5b3b323a603ccef736119a

          SHA1

          a52a3d51df3ad463229bc2148d6767ba60199425

          SHA256

          e148b601cabaf0ff2242d4e204090f34e12c5f181793008125ab53c4bca8cc80

          SHA512

          03b64cfbc98a0f10f9200271899915f57e264de49c810a1d935a7855e2a4bfbef4356e6ae319e6d91c0b0f2a12a595c53f728473d26883cfdaf3d1f65194bd16

        • C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe

          Filesize

          268KB

          MD5

          5a5e87d1ca5b3b323a603ccef736119a

          SHA1

          a52a3d51df3ad463229bc2148d6767ba60199425

          SHA256

          e148b601cabaf0ff2242d4e204090f34e12c5f181793008125ab53c4bca8cc80

          SHA512

          03b64cfbc98a0f10f9200271899915f57e264de49c810a1d935a7855e2a4bfbef4356e6ae319e6d91c0b0f2a12a595c53f728473d26883cfdaf3d1f65194bd16

        • C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe

          Filesize

          268KB

          MD5

          5a5e87d1ca5b3b323a603ccef736119a

          SHA1

          a52a3d51df3ad463229bc2148d6767ba60199425

          SHA256

          e148b601cabaf0ff2242d4e204090f34e12c5f181793008125ab53c4bca8cc80

          SHA512

          03b64cfbc98a0f10f9200271899915f57e264de49c810a1d935a7855e2a4bfbef4356e6ae319e6d91c0b0f2a12a595c53f728473d26883cfdaf3d1f65194bd16

        • C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe

          Filesize

          268KB

          MD5

          5a5e87d1ca5b3b323a603ccef736119a

          SHA1

          a52a3d51df3ad463229bc2148d6767ba60199425

          SHA256

          e148b601cabaf0ff2242d4e204090f34e12c5f181793008125ab53c4bca8cc80

          SHA512

          03b64cfbc98a0f10f9200271899915f57e264de49c810a1d935a7855e2a4bfbef4356e6ae319e6d91c0b0f2a12a595c53f728473d26883cfdaf3d1f65194bd16

        • C:\Users\Admin\AppData\Roaming\80b59841e5c623\cred64.dll

          Filesize

          126KB

          MD5

          522adad0782501491314a78c7f32006b

          SHA1

          e487edceeef3a41e2a8eea1e684bcbc3b39adb97

          SHA256

          351fd9b73fa0cbbdfbce0793ca41544f5191650d79317a34024f3c09f73ac9ba

          SHA512

          5f8a103deea3ed5f8641d1f4c91a4f891a8208b679cadbfac4a068afbad0d2f777cd29ace4bdfec590e722435473e4f8465fb80d5cda792dc0236646580101a7

        • \Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe

          Filesize

          268KB

          MD5

          5a5e87d1ca5b3b323a603ccef736119a

          SHA1

          a52a3d51df3ad463229bc2148d6767ba60199425

          SHA256

          e148b601cabaf0ff2242d4e204090f34e12c5f181793008125ab53c4bca8cc80

          SHA512

          03b64cfbc98a0f10f9200271899915f57e264de49c810a1d935a7855e2a4bfbef4356e6ae319e6d91c0b0f2a12a595c53f728473d26883cfdaf3d1f65194bd16

        • \Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe

          Filesize

          268KB

          MD5

          5a5e87d1ca5b3b323a603ccef736119a

          SHA1

          a52a3d51df3ad463229bc2148d6767ba60199425

          SHA256

          e148b601cabaf0ff2242d4e204090f34e12c5f181793008125ab53c4bca8cc80

          SHA512

          03b64cfbc98a0f10f9200271899915f57e264de49c810a1d935a7855e2a4bfbef4356e6ae319e6d91c0b0f2a12a595c53f728473d26883cfdaf3d1f65194bd16

        • \Users\Admin\AppData\Roaming\80b59841e5c623\cred64.dll

          Filesize

          126KB

          MD5

          522adad0782501491314a78c7f32006b

          SHA1

          e487edceeef3a41e2a8eea1e684bcbc3b39adb97

          SHA256

          351fd9b73fa0cbbdfbce0793ca41544f5191650d79317a34024f3c09f73ac9ba

          SHA512

          5f8a103deea3ed5f8641d1f4c91a4f891a8208b679cadbfac4a068afbad0d2f777cd29ace4bdfec590e722435473e4f8465fb80d5cda792dc0236646580101a7

        • \Users\Admin\AppData\Roaming\80b59841e5c623\cred64.dll

          Filesize

          126KB

          MD5

          522adad0782501491314a78c7f32006b

          SHA1

          e487edceeef3a41e2a8eea1e684bcbc3b39adb97

          SHA256

          351fd9b73fa0cbbdfbce0793ca41544f5191650d79317a34024f3c09f73ac9ba

          SHA512

          5f8a103deea3ed5f8641d1f4c91a4f891a8208b679cadbfac4a068afbad0d2f777cd29ace4bdfec590e722435473e4f8465fb80d5cda792dc0236646580101a7

        • \Users\Admin\AppData\Roaming\80b59841e5c623\cred64.dll

          Filesize

          126KB

          MD5

          522adad0782501491314a78c7f32006b

          SHA1

          e487edceeef3a41e2a8eea1e684bcbc3b39adb97

          SHA256

          351fd9b73fa0cbbdfbce0793ca41544f5191650d79317a34024f3c09f73ac9ba

          SHA512

          5f8a103deea3ed5f8641d1f4c91a4f891a8208b679cadbfac4a068afbad0d2f777cd29ace4bdfec590e722435473e4f8465fb80d5cda792dc0236646580101a7

        • \Users\Admin\AppData\Roaming\80b59841e5c623\cred64.dll

          Filesize

          126KB

          MD5

          522adad0782501491314a78c7f32006b

          SHA1

          e487edceeef3a41e2a8eea1e684bcbc3b39adb97

          SHA256

          351fd9b73fa0cbbdfbce0793ca41544f5191650d79317a34024f3c09f73ac9ba

          SHA512

          5f8a103deea3ed5f8641d1f4c91a4f891a8208b679cadbfac4a068afbad0d2f777cd29ace4bdfec590e722435473e4f8465fb80d5cda792dc0236646580101a7

        • memory/760-68-0x0000000000400000-0x00000000005A6000-memory.dmp

          Filesize

          1.6MB

        • memory/760-69-0x000000000030B000-0x000000000032A000-memory.dmp

          Filesize

          124KB

        • memory/760-70-0x0000000000400000-0x00000000005A6000-memory.dmp

          Filesize

          1.6MB

        • memory/760-67-0x000000000030B000-0x000000000032A000-memory.dmp

          Filesize

          124KB

        • memory/832-82-0x000000000063B000-0x000000000065A000-memory.dmp

          Filesize

          124KB

        • memory/832-83-0x0000000000400000-0x00000000005A6000-memory.dmp

          Filesize

          1.6MB

        • memory/860-80-0x0000000000161000-0x000000000017B000-memory.dmp

          Filesize

          104KB

        • memory/1436-54-0x0000000075711000-0x0000000075713000-memory.dmp

          Filesize

          8KB

        • memory/1436-63-0x0000000000400000-0x00000000005A6000-memory.dmp

          Filesize

          1.6MB

        • memory/1436-62-0x00000000006FB000-0x000000000071A000-memory.dmp

          Filesize

          124KB

        • memory/1436-57-0x0000000000400000-0x00000000005A6000-memory.dmp

          Filesize

          1.6MB

        • memory/1436-56-0x0000000000220000-0x000000000025E000-memory.dmp

          Filesize

          248KB

        • memory/1436-55-0x00000000006FB000-0x000000000071A000-memory.dmp

          Filesize

          124KB

        • memory/1980-87-0x000000000069B000-0x00000000006BA000-memory.dmp

          Filesize

          124KB

        • memory/1980-88-0x0000000000400000-0x00000000005A6000-memory.dmp

          Filesize

          1.6MB