amadey | 86ffcaf2709ad91f8c2085ee8af23ad9958ff06014c29502f4b6a74c4fe3c778

General

Target

file.exe
Size

226KB
MD5

ce70ec8ee5758eb0da8ab34fdd09232c
SHA1

d92b0914470a74de306de1b00170159db69882bd
SHA256

86ffcaf2709ad91f8c2085ee8af23ad9958ff06014c29502f4b6a74c4fe3c778
SHA512

8058a987ea6138083bb641dc8c586a5a8de667e8d344c2da8401e1cb35e157e3f6ac7ef027321cde73435f79f5d12ac2e5cf91de52665c4cfb87d9961ff3ea69
SSDEEP

3072:tmrW3qdF2LOO3mOVu57i8DTdVceHXL2QOrYrK9PKSGopor9AmJ4:t/SOWO+i83dNHXLNOrYrK93pi9A

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

3.50

C2

193.56.146.194/h49vlBP/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

rovwer.exerovwer.exerovwer.exe

pid process

2096 rovwer.exe
1140 rovwer.exe
1580 rovwer.exe

pid	process
2096	rovwer.exe
1140	rovwer.exe
1580	rovwer.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

file.exerovwer.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	file.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	rovwer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

1128 4284 WerFault.exe file.exe
380 1140 WerFault.exe rovwer.exe
2952 1580 WerFault.exe rovwer.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4536 schtasks.exe

pid	pid_target	process	target process
1128	4284	WerFault.exe	file.exe
380	1140	WerFault.exe	rovwer.exe
2952	1580	WerFault.exe	rovwer.exe

pid	process
4536	schtasks.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

file.exerovwer.exe

description	pid	process	target process
PID 4284 wrote to memory of 2096	4284	file.exe	rovwer.exe
PID 4284 wrote to memory of 2096	4284	file.exe	rovwer.exe
PID 4284 wrote to memory of 2096	4284	file.exe	rovwer.exe
PID 2096 wrote to memory of 4536	2096	rovwer.exe	schtasks.exe
PID 2096 wrote to memory of 4536	2096	rovwer.exe	schtasks.exe
PID 2096 wrote to memory of 4536	2096	rovwer.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4284

C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
"C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2096

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe" /F
3⤵
- Creates scheduled task(s)
PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 1140
2⤵
- Program crash
PID:1128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4284 -ip 4284
1⤵
PID:3900

C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
1⤵
- Executes dropped EXE
PID:1140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 416
2⤵
- Program crash
PID:380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1140 -ip 1140
1⤵
PID:396

C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
1⤵
- Executes dropped EXE
PID:1580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 416
2⤵
- Program crash
PID:2952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1580 -ip 1580
1⤵
PID:872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe

Filesize
226KB

MD5
ce70ec8ee5758eb0da8ab34fdd09232c

SHA1
d92b0914470a74de306de1b00170159db69882bd

SHA256
86ffcaf2709ad91f8c2085ee8af23ad9958ff06014c29502f4b6a74c4fe3c778

SHA512
8058a987ea6138083bb641dc8c586a5a8de667e8d344c2da8401e1cb35e157e3f6ac7ef027321cde73435f79f5d12ac2e5cf91de52665c4cfb87d9961ff3ea69

Download Submit
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe

Filesize
226KB

MD5
ce70ec8ee5758eb0da8ab34fdd09232c

SHA1
d92b0914470a74de306de1b00170159db69882bd

SHA256
86ffcaf2709ad91f8c2085ee8af23ad9958ff06014c29502f4b6a74c4fe3c778

SHA512
8058a987ea6138083bb641dc8c586a5a8de667e8d344c2da8401e1cb35e157e3f6ac7ef027321cde73435f79f5d12ac2e5cf91de52665c4cfb87d9961ff3ea69

Download Submit
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe

Filesize
226KB

MD5
ce70ec8ee5758eb0da8ab34fdd09232c

SHA1
d92b0914470a74de306de1b00170159db69882bd

SHA256
86ffcaf2709ad91f8c2085ee8af23ad9958ff06014c29502f4b6a74c4fe3c778

SHA512
8058a987ea6138083bb641dc8c586a5a8de667e8d344c2da8401e1cb35e157e3f6ac7ef027321cde73435f79f5d12ac2e5cf91de52665c4cfb87d9961ff3ea69

Download Submit
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe

Filesize
226KB

MD5
ce70ec8ee5758eb0da8ab34fdd09232c

SHA1
d92b0914470a74de306de1b00170159db69882bd

SHA256
86ffcaf2709ad91f8c2085ee8af23ad9958ff06014c29502f4b6a74c4fe3c778

SHA512
8058a987ea6138083bb641dc8c586a5a8de667e8d344c2da8401e1cb35e157e3f6ac7ef027321cde73435f79f5d12ac2e5cf91de52665c4cfb87d9961ff3ea69

Download Submit
memory/1140-147-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/1140-146-0x0000000000940000-0x000000000095F000-memory.dmp

Filesize
124KB

Download
memory/1580-150-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/1580-149-0x00000000007C2000-0x00000000007E1000-memory.dmp

Filesize
124KB

Download
memory/2096-136-0x0000000000000000-mapping.dmp

Download
memory/2096-143-0x00000000009BC000-0x00000000009DB000-memory.dmp

Filesize
124KB

Download
memory/2096-144-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/4284-141-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/4284-140-0x0000000000980000-0x00000000009BE000-memory.dmp

Filesize
248KB

Download
memory/4284-139-0x0000000000A7D000-0x0000000000A9C000-memory.dmp

Filesize
124KB

Download
memory/4284-133-0x0000000000A7D000-0x0000000000A9C000-memory.dmp

Filesize
124KB

Download
memory/4284-135-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/4284-134-0x0000000000980000-0x00000000009BE000-memory.dmp

Filesize
248KB

Download
memory/4536-142-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads