amadey | a619972b21cc1d617d9a0c0f8492e5db3e3b5b00e097aac9693ad4d5ed239706

Analysis

max time kernel
174s
max time network
220s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a619972b21cc1d617d9a0c0f8492e5db3e3b5b00e097aac9693ad4d5ed239706.exe
Size

232KB
MD5

ea073ac32c19188dd02a83a27bc73e0c
SHA1

c7bcff3975cc93c7c9614a1c5862e2358e5cc6af
SHA256

a619972b21cc1d617d9a0c0f8492e5db3e3b5b00e097aac9693ad4d5ed239706
SHA512

b5c69aedcd37fc7c51752525c11297b9e2182e0ed91c7331d1648eefe07f69d658287e342a07cdb97e0a3c72ba5b6bc4121e5c2e5ab264f897c3e672527d637a
SSDEEP

3072:HXJTeSrCQhoctO5lhrZHDSQhaLwjXC7R//X1RH6KS97iJORn:HNOQhFyrhasDC1//lw7iJ

Score

10^/10

amadey collection persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

3.50

193.56.146.194/h49vlBP/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Amadey credential stealer module 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll	amadey_cred_module
C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll	amadey_cred_module
behavioral1/memory/1072-158-0x0000000000610000-0x0000000000634000-memory.dmp	amadey_cred_module
C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll	amadey_cred_module

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

70 1072 rundll32.exe
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

rovwer.exelinda5.exerovwer.exe

pid process

544 rovwer.exe
4280 linda5.exe
3356 rovwer.exe

flow	pid	process
70	1072	rundll32.exe

pid	process
544	rovwer.exe
4280	linda5.exe
3356	rovwer.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a619972b21cc1d617d9a0c0f8492e5db3e3b5b00e097aac9693ad4d5ed239706.exerovwer.exelinda5.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	a619972b21cc1d617d9a0c0f8492e5db3e3b5b00e097aac9693ad4d5ed239706.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	rovwer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	linda5.exe

Loads dropped DLL 4 IoCs

Processes:

msiexec.exerundll32.exe

pid process

4396 msiexec.exe
4396 msiexec.exe
1072 rundll32.exe
1072 rundll32.exe
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4396	msiexec.exe
4396	msiexec.exe
1072	rundll32.exe
1072	rundll32.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

rovwer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\linda5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000133001\\linda5.exe"	rovwer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
3688	4252	WerFault.exe	a619972b21cc1d617d9a0c0f8492e5db3e3b5b00e097aac9693ad4d5ed239706.exe
836	3356	WerFault.exe	rovwer.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3744 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

1072 rundll32.exe
1072 rundll32.exe
1072 rundll32.exe
1072 rundll32.exe

pid	process
3744	schtasks.exe

pid	process
1072	rundll32.exe
1072	rundll32.exe
1072	rundll32.exe
1072	rundll32.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

a619972b21cc1d617d9a0c0f8492e5db3e3b5b00e097aac9693ad4d5ed239706.exerovwer.exelinda5.exe

description	pid	process	target process
PID 4252 wrote to memory of 544	4252	a619972b21cc1d617d9a0c0f8492e5db3e3b5b00e097aac9693ad4d5ed239706.exe	rovwer.exe
PID 4252 wrote to memory of 544	4252	a619972b21cc1d617d9a0c0f8492e5db3e3b5b00e097aac9693ad4d5ed239706.exe	rovwer.exe
PID 4252 wrote to memory of 544	4252	a619972b21cc1d617d9a0c0f8492e5db3e3b5b00e097aac9693ad4d5ed239706.exe	rovwer.exe
PID 544 wrote to memory of 3744	544	rovwer.exe	schtasks.exe
PID 544 wrote to memory of 3744	544	rovwer.exe	schtasks.exe
PID 544 wrote to memory of 3744	544	rovwer.exe	schtasks.exe
PID 544 wrote to memory of 4280	544	rovwer.exe	linda5.exe
PID 544 wrote to memory of 4280	544	rovwer.exe	linda5.exe
PID 544 wrote to memory of 4280	544	rovwer.exe	linda5.exe
PID 4280 wrote to memory of 4396	4280	linda5.exe	msiexec.exe
PID 4280 wrote to memory of 4396	4280	linda5.exe	msiexec.exe
PID 4280 wrote to memory of 4396	4280	linda5.exe	msiexec.exe
PID 544 wrote to memory of 1072	544	rovwer.exe	rundll32.exe
PID 544 wrote to memory of 1072	544	rovwer.exe	rundll32.exe
PID 544 wrote to memory of 1072	544	rovwer.exe	rundll32.exe

outlook_win_path 1 IoCs

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\a619972b21cc1d617d9a0c0f8492e5db3e3b5b00e097aac9693ad4d5ed239706.exe
"C:\Users\Admin\AppData\Local\Temp\a619972b21cc1d617d9a0c0f8492e5db3e3b5b00e097aac9693ad4d5ed239706.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4252

C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
"C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:544

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe" /F
3⤵
- Creates scheduled task(s)
PID:3744

C:\Users\Admin\AppData\Local\Temp\1000133001\linda5.exe
"C:\Users\Admin\AppData\Local\Temp\1000133001\linda5.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4280

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\System32\msiexec.exe" -y .\WvDGWD.0
4⤵
- Loads dropped DLL
PID:4396

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll, Main
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
PID:1072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 1144
2⤵
- Program crash
PID:3688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4252 -ip 4252
1⤵
PID:4988

C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
1⤵
- Executes dropped EXE
PID:3356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 216
2⤵
- Program crash
PID:836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3356 -ip 3356
1⤵
PID:4772

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1000133001\linda5.exe
Filesize
1.5MB

MD5
6111fc071708a7aadc3e38ed5204e57a

SHA1
fccdd2af874fa395f21e065dd51144ee73446d3b

SHA256
09c79aef978be1a207b15f2fcc95e5107f429deb95110dfd6a79b3427390215b

SHA512
9d284ed9331f5cfc268591fee80cfb80aa5da3949a10d44ea547fda2f0ac6dd7454f3d782050866ed4d23924f8abb55950913665f7335118c908672cc3ec59af

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000133001\linda5.exe
Filesize
1.5MB

MD5
6111fc071708a7aadc3e38ed5204e57a

SHA1
fccdd2af874fa395f21e065dd51144ee73446d3b

SHA256
09c79aef978be1a207b15f2fcc95e5107f429deb95110dfd6a79b3427390215b

SHA512
9d284ed9331f5cfc268591fee80cfb80aa5da3949a10d44ea547fda2f0ac6dd7454f3d782050866ed4d23924f8abb55950913665f7335118c908672cc3ec59af

Download Submit
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
Filesize
232KB

MD5
ea073ac32c19188dd02a83a27bc73e0c

SHA1
c7bcff3975cc93c7c9614a1c5862e2358e5cc6af

SHA256
a619972b21cc1d617d9a0c0f8492e5db3e3b5b00e097aac9693ad4d5ed239706

SHA512
b5c69aedcd37fc7c51752525c11297b9e2182e0ed91c7331d1648eefe07f69d658287e342a07cdb97e0a3c72ba5b6bc4121e5c2e5ab264f897c3e672527d637a

Download Submit
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
Filesize
232KB

MD5
ea073ac32c19188dd02a83a27bc73e0c

SHA1
c7bcff3975cc93c7c9614a1c5862e2358e5cc6af

SHA256
a619972b21cc1d617d9a0c0f8492e5db3e3b5b00e097aac9693ad4d5ed239706

SHA512
b5c69aedcd37fc7c51752525c11297b9e2182e0ed91c7331d1648eefe07f69d658287e342a07cdb97e0a3c72ba5b6bc4121e5c2e5ab264f897c3e672527d637a

Download Submit
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
Filesize
232KB

MD5
ea073ac32c19188dd02a83a27bc73e0c

SHA1
c7bcff3975cc93c7c9614a1c5862e2358e5cc6af

SHA256
a619972b21cc1d617d9a0c0f8492e5db3e3b5b00e097aac9693ad4d5ed239706

SHA512
b5c69aedcd37fc7c51752525c11297b9e2182e0ed91c7331d1648eefe07f69d658287e342a07cdb97e0a3c72ba5b6bc4121e5c2e5ab264f897c3e672527d637a

Download Submit
C:\Users\Admin\AppData\Local\Temp\WvDGWD.0
Filesize
1.8MB

MD5
9a7fe5364b4a17ffbb1ce438b71a8174

SHA1
094cf3f6e5d09a799a5db99686a7db71801c4ce2

SHA256
f420822cb420beee839d6376541926a4ea5df09409c2186910d53c398400acee

SHA512
f0d8775828d62891241f244d63fe1f64b283767cd792a25d84b06ebab30b7e7febe6e042a9d7b70f54e425c54608f49a73565cf9b4045509b4c314c029642154

Download Submit
C:\Users\Admin\AppData\Local\Temp\WvDgWD.0
Filesize
1.8MB

MD5
9a7fe5364b4a17ffbb1ce438b71a8174

SHA1
094cf3f6e5d09a799a5db99686a7db71801c4ce2

SHA256
f420822cb420beee839d6376541926a4ea5df09409c2186910d53c398400acee

SHA512
f0d8775828d62891241f244d63fe1f64b283767cd792a25d84b06ebab30b7e7febe6e042a9d7b70f54e425c54608f49a73565cf9b4045509b4c314c029642154

Download Submit
C:\Users\Admin\AppData\Local\Temp\WvDgWD.0
Filesize
1.8MB

MD5
9a7fe5364b4a17ffbb1ce438b71a8174

SHA1
094cf3f6e5d09a799a5db99686a7db71801c4ce2

SHA256
f420822cb420beee839d6376541926a4ea5df09409c2186910d53c398400acee

SHA512
f0d8775828d62891241f244d63fe1f64b283767cd792a25d84b06ebab30b7e7febe6e042a9d7b70f54e425c54608f49a73565cf9b4045509b4c314c029642154

Download Submit
C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll
Filesize
126KB

MD5
674cec24e36e0dfaec6290db96dda86e

SHA1
581e3a7a541cc04641e751fc850d92e07236681f

SHA256
de81531468982b689451e85d249214d0aa484e2ffedfd32c58d43cf879f29ded

SHA512
6d9898169073c240fe454bd45065fd7dc8458f1d323925b57eb58fa4305bb0d5631bbceb61835593b225e887e0867186ef637c440460279378cb29e832066029

Download Submit
C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll
Filesize
126KB

MD5
674cec24e36e0dfaec6290db96dda86e

SHA1
581e3a7a541cc04641e751fc850d92e07236681f

SHA256
de81531468982b689451e85d249214d0aa484e2ffedfd32c58d43cf879f29ded

SHA512
6d9898169073c240fe454bd45065fd7dc8458f1d323925b57eb58fa4305bb0d5631bbceb61835593b225e887e0867186ef637c440460279378cb29e832066029

Download Submit
C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll
Filesize
126KB

MD5
674cec24e36e0dfaec6290db96dda86e

SHA1
581e3a7a541cc04641e751fc850d92e07236681f

SHA256
de81531468982b689451e85d249214d0aa484e2ffedfd32c58d43cf879f29ded

SHA512
6d9898169073c240fe454bd45065fd7dc8458f1d323925b57eb58fa4305bb0d5631bbceb61835593b225e887e0867186ef637c440460279378cb29e832066029

Download Submit
memory/544-139-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/544-138-0x00000000008DC000-0x00000000008FB000-memory.dmp

Filesize
124KB

Download
memory/544-135-0x0000000000000000-mapping.dmp

Download
memory/1072-154-0x0000000000000000-mapping.dmp

Download
memory/1072-158-0x0000000000610000-0x0000000000634000-memory.dmp

Filesize
144KB

Download
memory/3356-147-0x0000000000920000-0x000000000093F000-memory.dmp

Filesize
124KB

Download
memory/3356-148-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/3744-142-0x0000000000000000-mapping.dmp

Download
memory/4252-133-0x0000000002480000-0x00000000024BE000-memory.dmp

Filesize
248KB

Download
memory/4252-132-0x00000000007EE000-0x000000000080D000-memory.dmp

Filesize
124KB

Download
memory/4252-134-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/4252-141-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/4252-140-0x00000000007EE000-0x000000000080D000-memory.dmp

Filesize
124KB

Download
memory/4280-143-0x0000000000000000-mapping.dmp

Download
memory/4396-153-0x00000000028A0000-0x0000000002A65000-memory.dmp

Filesize
1.8MB

Download
memory/4396-149-0x0000000000000000-mapping.dmp

Download