Analysis

  • max time kernel
    123s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    12-11-2022 00:32

General

  • Target

    file.exe

  • Size

    251KB

  • MD5

    9200f1ce034123708f20d0ec5e3fe24c

  • SHA1

    2f155571b16a04df0586ccdad0aa9d0f88cabc63

  • SHA256

    4d75f10d3bc192a274ec9a8b1109dbe14c8af8e00e5f060a7f85100a6d1ac4cb

  • SHA512

    3ef49149de93d9f19ee4b238ab42890dd71ed90ec2cd401ae68f0c72f586991288b236ccd2ebb6c835ae648e2745e33643006c967abf5afe38b72e9c7ca3f820

  • SSDEEP

    6144:t+V0uXaO4xLJF81mJy9Il9C9lnLuUUtqFXg:t+V0uXaO4xlF81riCHLuU9e

Malware Config

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detect Amadey credential stealer module 6 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1376
    • C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
      "C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1932
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe" /F
        3⤵
        • Creates scheduled task(s)
        PID:1624
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll, Main
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • outlook_win_path
        PID:1056
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {65DD179A-6E7A-4625-83CD-08FDE39890FF} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2000
    • C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
      C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
      2⤵
      • Executes dropped EXE
      PID:1532
    • C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
      C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
      2⤵
      • Executes dropped EXE
      PID:1300

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
    Filesize

    251KB

    MD5

    9200f1ce034123708f20d0ec5e3fe24c

    SHA1

    2f155571b16a04df0586ccdad0aa9d0f88cabc63

    SHA256

    4d75f10d3bc192a274ec9a8b1109dbe14c8af8e00e5f060a7f85100a6d1ac4cb

    SHA512

    3ef49149de93d9f19ee4b238ab42890dd71ed90ec2cd401ae68f0c72f586991288b236ccd2ebb6c835ae648e2745e33643006c967abf5afe38b72e9c7ca3f820

  • C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
    Filesize

    251KB

    MD5

    9200f1ce034123708f20d0ec5e3fe24c

    SHA1

    2f155571b16a04df0586ccdad0aa9d0f88cabc63

    SHA256

    4d75f10d3bc192a274ec9a8b1109dbe14c8af8e00e5f060a7f85100a6d1ac4cb

    SHA512

    3ef49149de93d9f19ee4b238ab42890dd71ed90ec2cd401ae68f0c72f586991288b236ccd2ebb6c835ae648e2745e33643006c967abf5afe38b72e9c7ca3f820

  • C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
    Filesize

    251KB

    MD5

    9200f1ce034123708f20d0ec5e3fe24c

    SHA1

    2f155571b16a04df0586ccdad0aa9d0f88cabc63

    SHA256

    4d75f10d3bc192a274ec9a8b1109dbe14c8af8e00e5f060a7f85100a6d1ac4cb

    SHA512

    3ef49149de93d9f19ee4b238ab42890dd71ed90ec2cd401ae68f0c72f586991288b236ccd2ebb6c835ae648e2745e33643006c967abf5afe38b72e9c7ca3f820

  • C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
    Filesize

    251KB

    MD5

    9200f1ce034123708f20d0ec5e3fe24c

    SHA1

    2f155571b16a04df0586ccdad0aa9d0f88cabc63

    SHA256

    4d75f10d3bc192a274ec9a8b1109dbe14c8af8e00e5f060a7f85100a6d1ac4cb

    SHA512

    3ef49149de93d9f19ee4b238ab42890dd71ed90ec2cd401ae68f0c72f586991288b236ccd2ebb6c835ae648e2745e33643006c967abf5afe38b72e9c7ca3f820

  • C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll
    Filesize

    126KB

    MD5

    b8d80046e28849a320a3dcd868b73d7c

    SHA1

    f15bc4a4c5189e7aa845213469c6def5afd68186

    SHA256

    d23147a448d24f81d81d4bb226f3fc968386792c0987dda75917104b5ecd9d5a

    SHA512

    b7f6d59ee55d2b579c2185560d2e660c1952f9214f3db3096b1358af3559fd985859aa3389be333c826f35b85cd63c6f65a03e65a7ad57c7834bb09abd1d853e

  • \Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
    Filesize

    251KB

    MD5

    9200f1ce034123708f20d0ec5e3fe24c

    SHA1

    2f155571b16a04df0586ccdad0aa9d0f88cabc63

    SHA256

    4d75f10d3bc192a274ec9a8b1109dbe14c8af8e00e5f060a7f85100a6d1ac4cb

    SHA512

    3ef49149de93d9f19ee4b238ab42890dd71ed90ec2cd401ae68f0c72f586991288b236ccd2ebb6c835ae648e2745e33643006c967abf5afe38b72e9c7ca3f820

  • \Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
    Filesize

    251KB

    MD5

    9200f1ce034123708f20d0ec5e3fe24c

    SHA1

    2f155571b16a04df0586ccdad0aa9d0f88cabc63

    SHA256

    4d75f10d3bc192a274ec9a8b1109dbe14c8af8e00e5f060a7f85100a6d1ac4cb

    SHA512

    3ef49149de93d9f19ee4b238ab42890dd71ed90ec2cd401ae68f0c72f586991288b236ccd2ebb6c835ae648e2745e33643006c967abf5afe38b72e9c7ca3f820

  • \Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll
    Filesize

    126KB

    MD5

    b8d80046e28849a320a3dcd868b73d7c

    SHA1

    f15bc4a4c5189e7aa845213469c6def5afd68186

    SHA256

    d23147a448d24f81d81d4bb226f3fc968386792c0987dda75917104b5ecd9d5a

    SHA512

    b7f6d59ee55d2b579c2185560d2e660c1952f9214f3db3096b1358af3559fd985859aa3389be333c826f35b85cd63c6f65a03e65a7ad57c7834bb09abd1d853e

  • \Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll
    Filesize

    126KB

    MD5

    b8d80046e28849a320a3dcd868b73d7c

    SHA1

    f15bc4a4c5189e7aa845213469c6def5afd68186

    SHA256

    d23147a448d24f81d81d4bb226f3fc968386792c0987dda75917104b5ecd9d5a

    SHA512

    b7f6d59ee55d2b579c2185560d2e660c1952f9214f3db3096b1358af3559fd985859aa3389be333c826f35b85cd63c6f65a03e65a7ad57c7834bb09abd1d853e

  • \Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll
    Filesize

    126KB

    MD5

    b8d80046e28849a320a3dcd868b73d7c

    SHA1

    f15bc4a4c5189e7aa845213469c6def5afd68186

    SHA256

    d23147a448d24f81d81d4bb226f3fc968386792c0987dda75917104b5ecd9d5a

    SHA512

    b7f6d59ee55d2b579c2185560d2e660c1952f9214f3db3096b1358af3559fd985859aa3389be333c826f35b85cd63c6f65a03e65a7ad57c7834bb09abd1d853e

  • \Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll
    Filesize

    126KB

    MD5

    b8d80046e28849a320a3dcd868b73d7c

    SHA1

    f15bc4a4c5189e7aa845213469c6def5afd68186

    SHA256

    d23147a448d24f81d81d4bb226f3fc968386792c0987dda75917104b5ecd9d5a

    SHA512

    b7f6d59ee55d2b579c2185560d2e660c1952f9214f3db3096b1358af3559fd985859aa3389be333c826f35b85cd63c6f65a03e65a7ad57c7834bb09abd1d853e

  • memory/1056-68-0x0000000000000000-mapping.dmp
  • memory/1056-75-0x0000000000360000-0x0000000000384000-memory.dmp
    Filesize

    144KB

  • memory/1300-81-0x0000000000000000-mapping.dmp
  • memory/1300-84-0x000000000062B000-0x000000000064A000-memory.dmp
    Filesize

    124KB

  • memory/1300-85-0x0000000000400000-0x000000000059A000-memory.dmp
    Filesize

    1.6MB

  • memory/1376-54-0x0000000075091000-0x0000000075093000-memory.dmp
    Filesize

    8KB

  • memory/1376-59-0x00000000006FB000-0x000000000071A000-memory.dmp
    Filesize

    124KB

  • memory/1376-60-0x0000000000220000-0x000000000025E000-memory.dmp
    Filesize

    248KB

  • memory/1376-61-0x0000000000400000-0x000000000059A000-memory.dmp
    Filesize

    1.6MB

  • memory/1532-76-0x0000000000000000-mapping.dmp
  • memory/1532-80-0x0000000000400000-0x000000000059A000-memory.dmp
    Filesize

    1.6MB

  • memory/1532-79-0x00000000006BB000-0x00000000006DA000-memory.dmp
    Filesize

    124KB

  • memory/1624-63-0x0000000000000000-mapping.dmp
  • memory/1932-57-0x0000000000000000-mapping.dmp
  • memory/1932-67-0x0000000000400000-0x000000000059A000-memory.dmp
    Filesize

    1.6MB

  • memory/1932-66-0x0000000000400000-0x000000000059A000-memory.dmp
    Filesize

    1.6MB

  • memory/1932-65-0x00000000006DB000-0x00000000006FA000-memory.dmp
    Filesize

    124KB