amadey | 1466289457fd8b94f468b6a93503a9a1a3b2cb7982b6596a9a6ef4106a05b4d3

General

Target

file.exe
Size

205KB
MD5

5b5edfc24370bad200860929d26d87d0
SHA1

bd666906972f8321b5eb25b5541ea42875cc38be
SHA256

1466289457fd8b94f468b6a93503a9a1a3b2cb7982b6596a9a6ef4106a05b4d3
SHA512

1bde7e162550e4555a8aa56fc8187890fe1b7900828c1608da02d658a06d07836d6cd88887db8f4711d8a26f9e6268419d7316c951ee9f9a9da6b2ca2d81bb04
SSDEEP

3072:hdhslJFGwEiOD5srHkWiRi5k/G8JAUJxX8VdJ2WBiCB4QFjEvn2n:XSYwEzJJGEAUJtIdEWBiCB

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

3.50

C2

193.56.146.194/h49vlBP/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

rovwer.exerovwer.exelinda5.exe

pid process

3128 rovwer.exe
748 rovwer.exe
2428 linda5.exe

pid	process
3128	rovwer.exe
748	rovwer.exe
2428	linda5.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

file.exerovwer.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	file.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	rovwer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2216 2824 WerFault.exe file.exe
652 748 WerFault.exe rovwer.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

900 schtasks.exe

pid	pid_target	process	target process
2216	2824	WerFault.exe	file.exe
652	748	WerFault.exe	rovwer.exe

pid	process
900	schtasks.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

file.exerovwer.exe

description	pid	process	target process
PID 2824 wrote to memory of 3128	2824	file.exe	rovwer.exe
PID 2824 wrote to memory of 3128	2824	file.exe	rovwer.exe
PID 2824 wrote to memory of 3128	2824	file.exe	rovwer.exe
PID 3128 wrote to memory of 900	3128	rovwer.exe	schtasks.exe
PID 3128 wrote to memory of 900	3128	rovwer.exe	schtasks.exe
PID 3128 wrote to memory of 900	3128	rovwer.exe	schtasks.exe
PID 3128 wrote to memory of 2428	3128	rovwer.exe	linda5.exe
PID 3128 wrote to memory of 2428	3128	rovwer.exe	linda5.exe
PID 3128 wrote to memory of 2428	3128	rovwer.exe	linda5.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2824

C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
"C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3128

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe" /F
3⤵
- Creates scheduled task(s)
PID:900

C:\Users\Admin\AppData\Local\Temp\1000142001\linda5.exe
"C:\Users\Admin\AppData\Local\Temp\1000142001\linda5.exe"
3⤵
- Executes dropped EXE
PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 1144
2⤵
- Program crash
PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2824 -ip 2824
1⤵
PID:2632

C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
1⤵
- Executes dropped EXE
PID:748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 416
2⤵
- Program crash
PID:652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 748 -ip 748
1⤵
PID:1800

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1000142001\linda5.exe

Filesize
1.7MB

MD5
54367aed260a95eb14c1e96f63e774bf

SHA1
09275ad808c583b93085f5b4543fd051adfc9a26

SHA256
e170d1ea07e4bcb812ac8ee6bc7bc2fe75c78d883fb14d4f2cc5fd485903d9b1

SHA512
f52ffb66082908763c26a59650a66298cf4adcdff8f6972f13967e2fe4c02138a3dfebe2741dd342fb9f7672ac163c1b26b93078c504356da27ad9582f07c703

Download Submit
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe

Filesize
205KB

MD5
5b5edfc24370bad200860929d26d87d0

SHA1
bd666906972f8321b5eb25b5541ea42875cc38be

SHA256
1466289457fd8b94f468b6a93503a9a1a3b2cb7982b6596a9a6ef4106a05b4d3

SHA512
1bde7e162550e4555a8aa56fc8187890fe1b7900828c1608da02d658a06d07836d6cd88887db8f4711d8a26f9e6268419d7316c951ee9f9a9da6b2ca2d81bb04

Download Submit
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe

Filesize
205KB

MD5
5b5edfc24370bad200860929d26d87d0

SHA1
bd666906972f8321b5eb25b5541ea42875cc38be

SHA256
1466289457fd8b94f468b6a93503a9a1a3b2cb7982b6596a9a6ef4106a05b4d3

SHA512
1bde7e162550e4555a8aa56fc8187890fe1b7900828c1608da02d658a06d07836d6cd88887db8f4711d8a26f9e6268419d7316c951ee9f9a9da6b2ca2d81bb04

Download Submit
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe

Filesize
205KB

MD5
5b5edfc24370bad200860929d26d87d0

SHA1
bd666906972f8321b5eb25b5541ea42875cc38be

SHA256
1466289457fd8b94f468b6a93503a9a1a3b2cb7982b6596a9a6ef4106a05b4d3

SHA512
1bde7e162550e4555a8aa56fc8187890fe1b7900828c1608da02d658a06d07836d6cd88887db8f4711d8a26f9e6268419d7316c951ee9f9a9da6b2ca2d81bb04

Download Submit
memory/748-147-0x0000000000400000-0x0000000000AE5000-memory.dmp

Filesize
6.9MB

Download
memory/748-146-0x0000000000E70000-0x0000000000E8F000-memory.dmp

Filesize
124KB

Download
memory/900-143-0x0000000000000000-mapping.dmp

Download
memory/2428-148-0x0000000000000000-mapping.dmp

Download
memory/2824-132-0x0000000000D3D000-0x0000000000D5C000-memory.dmp

Filesize
124KB

Download
memory/2824-135-0x0000000000400000-0x0000000000AE5000-memory.dmp

Filesize
6.9MB

Download
memory/2824-134-0x0000000000D3D000-0x0000000000D5C000-memory.dmp

Filesize
124KB

Download
memory/2824-142-0x0000000000400000-0x0000000000AE5000-memory.dmp

Filesize
6.9MB

Download
memory/2824-144-0x0000000000D3D000-0x0000000000D5C000-memory.dmp

Filesize
124KB

Download
memory/2824-133-0x0000000002840000-0x000000000287E000-memory.dmp

Filesize
248KB

Download
memory/3128-136-0x0000000000000000-mapping.dmp

Download
memory/3128-141-0x0000000000400000-0x0000000000AE5000-memory.dmp

Filesize
6.9MB

Download
memory/3128-140-0x0000000000B60000-0x0000000000B9E000-memory.dmp

Filesize
248KB

Download
memory/3128-139-0x0000000000D5C000-0x0000000000D7B000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads