Analysis

  • max time kernel
    179s
  • max time network
    193s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-11-2022 11:26

General

  • Target

    file.exe

  • Size

    233KB

  • MD5

    4149b7ced64c1cb7517446aab862ceed

  • SHA1

    aacbf47e0f15775f3c35b4c0cd39861534bb4559

  • SHA256

    5ba7ff89a3887877e42f64edd509686f5e0920d5b5c2b1de219014b771810288

  • SHA512

    cae9f023f97ee98d50fcd4d1a04f7c913c9e37bf85f1ee57f847dfcc3e11fce1c67dd74d571e0f9786150b55bc9ddecdbdba23efee50885815e142fa4f654170

  • SSDEEP

    6144:G5FBs/1/P03oPswvDwJwohllMN+bW3VCf:GzB+9P0YPsw7wxhjXbWlCf

Score
10/10

Malware Config

Extracted

Family

amadey

Version

3.50

C2

193.56.146.174/g84kvj4jck/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 4 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2216
    • C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe
      "C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:4312
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe" /F
        3⤵
        • Creates scheduled task(s)
        PID:4228
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "rovwer.exe" /P "Admin:N"&&CACLS "rovwer.exe" /P "Admin:R" /E&&echo Y|CACLS "..\99e342142d" /P "Admin:N"&&CACLS "..\99e342142d" /P "Admin:R" /E&&Exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2408
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          4⤵
            PID:1808
          • C:\Windows\SysWOW64\cacls.exe
            CACLS "rovwer.exe" /P "Admin:N"
            4⤵
              PID:4864
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "rovwer.exe" /P "Admin:R" /E
              4⤵
                PID:4240
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                4⤵
                  PID:2244
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "..\99e342142d" /P "Admin:N"
                  4⤵
                    PID:440
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\99e342142d" /P "Admin:R" /E
                    4⤵
                      PID:1132
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 904
                  2⤵
                  • Program crash
                  PID:1512
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 1288
                  2⤵
                  • Program crash
                  PID:4572
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 2216 -ip 2216
                1⤵
                  PID:2092
                • C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe
                  C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe
                  1⤵
                  • Executes dropped EXE
                  PID:3780
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 416
                    2⤵
                    • Program crash
                    PID:1608
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 424
                    2⤵
                    • Program crash
                    PID:4556
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3780 -ip 3780
                  1⤵
                    PID:1932
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2216 -ip 2216
                    1⤵
                      PID:1496
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3780 -ip 3780
                      1⤵
                        PID:2700

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe

                        Filesize

                        233KB

                        MD5

                        4149b7ced64c1cb7517446aab862ceed

                        SHA1

                        aacbf47e0f15775f3c35b4c0cd39861534bb4559

                        SHA256

                        5ba7ff89a3887877e42f64edd509686f5e0920d5b5c2b1de219014b771810288

                        SHA512

                        cae9f023f97ee98d50fcd4d1a04f7c913c9e37bf85f1ee57f847dfcc3e11fce1c67dd74d571e0f9786150b55bc9ddecdbdba23efee50885815e142fa4f654170

                      • C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe

                        Filesize

                        233KB

                        MD5

                        4149b7ced64c1cb7517446aab862ceed

                        SHA1

                        aacbf47e0f15775f3c35b4c0cd39861534bb4559

                        SHA256

                        5ba7ff89a3887877e42f64edd509686f5e0920d5b5c2b1de219014b771810288

                        SHA512

                        cae9f023f97ee98d50fcd4d1a04f7c913c9e37bf85f1ee57f847dfcc3e11fce1c67dd74d571e0f9786150b55bc9ddecdbdba23efee50885815e142fa4f654170

                      • C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe

                        Filesize

                        233KB

                        MD5

                        4149b7ced64c1cb7517446aab862ceed

                        SHA1

                        aacbf47e0f15775f3c35b4c0cd39861534bb4559

                        SHA256

                        5ba7ff89a3887877e42f64edd509686f5e0920d5b5c2b1de219014b771810288

                        SHA512

                        cae9f023f97ee98d50fcd4d1a04f7c913c9e37bf85f1ee57f847dfcc3e11fce1c67dd74d571e0f9786150b55bc9ddecdbdba23efee50885815e142fa4f654170

                      • memory/440-148-0x0000000000000000-mapping.dmp

                      • memory/1132-149-0x0000000000000000-mapping.dmp

                      • memory/1808-144-0x0000000000000000-mapping.dmp

                      • memory/2216-133-0x00000000007B0000-0x00000000007EE000-memory.dmp

                        Filesize

                        248KB

                      • memory/2216-134-0x0000000000400000-0x000000000071C000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/2216-140-0x000000000080D000-0x000000000082C000-memory.dmp

                        Filesize

                        124KB

                      • memory/2216-141-0x0000000000400000-0x000000000071C000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/2216-132-0x000000000080D000-0x000000000082C000-memory.dmp

                        Filesize

                        124KB

                      • memory/2244-147-0x0000000000000000-mapping.dmp

                      • memory/2408-143-0x0000000000000000-mapping.dmp

                      • memory/3780-151-0x0000000000AB0000-0x0000000000ACF000-memory.dmp

                        Filesize

                        124KB

                      • memory/3780-152-0x0000000000400000-0x000000000071C000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/4228-142-0x0000000000000000-mapping.dmp

                      • memory/4240-146-0x0000000000000000-mapping.dmp

                      • memory/4312-139-0x0000000000400000-0x000000000071C000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/4312-138-0x00000000007CC000-0x00000000007EB000-memory.dmp

                        Filesize

                        124KB

                      • memory/4312-135-0x0000000000000000-mapping.dmp

                      • memory/4864-145-0x0000000000000000-mapping.dmp