amadey | ac1b14a61b42f49c95ef6e893877bec973d3108d827535ab4885b051e9fed090

General

Target

file.exe
Size

205KB
MD5

329efa3db8a908218487fc3607b73df6
SHA1

72a8b995f97eab399ccb22601fb3cf6df57e8a3b
SHA256

ac1b14a61b42f49c95ef6e893877bec973d3108d827535ab4885b051e9fed090
SHA512

058d418bab2b27612d840b52a1746ec88477326c02aeeeb200e40568a2e400219bf0ad42c9adeed8426dd55104843894699ee7e0d46a0417a978b4d5c1257e9a
SSDEEP

3072:j5DwZqXmYh5wI1vmnN4zgQB8XnlWOi5tYPh65pYQ1:JyqXmPI1v8IBBQlDi5gYT

Score

10^/10

amadey trojan

Malware Config

Extracted

Family

amadey

Version

3.50

C2

31.41.244.17/hfk3vK9/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

gntuud.exegntuud.exegntuud.exe

pid process

3684 gntuud.exe
4904 gntuud.exe
2612 gntuud.exe

pid	process
3684	gntuud.exe
4904	gntuud.exe
2612	gntuud.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

file.exegntuud.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	file.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	gntuud.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

380 2972 WerFault.exe file.exe
1500 4904 WerFault.exe gntuud.exe
3064 2612 WerFault.exe gntuud.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

372 schtasks.exe

pid	pid_target	process	target process
380	2972	WerFault.exe	file.exe
1500	4904	WerFault.exe	gntuud.exe
3064	2612	WerFault.exe	gntuud.exe

pid	process
372	schtasks.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

file.exegntuud.exe

description	pid	process	target process
PID 2972 wrote to memory of 3684	2972	file.exe	gntuud.exe
PID 2972 wrote to memory of 3684	2972	file.exe	gntuud.exe
PID 2972 wrote to memory of 3684	2972	file.exe	gntuud.exe
PID 3684 wrote to memory of 372	3684	gntuud.exe	schtasks.exe
PID 3684 wrote to memory of 372	3684	gntuud.exe	schtasks.exe
PID 3684 wrote to memory of 372	3684	gntuud.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2972

C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
"C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3684

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe" /F
3⤵
- Creates scheduled task(s)
PID:372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 1264
2⤵
- Program crash
PID:380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2972 -ip 2972
1⤵
PID:4916

C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
1⤵
- Executes dropped EXE
PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 416
2⤵
- Program crash
PID:1500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4904 -ip 4904
1⤵
PID:920

C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe
1⤵
- Executes dropped EXE
PID:2612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 420
2⤵
- Program crash
PID:3064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2612 -ip 2612
1⤵
PID:4064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe

Filesize
205KB

MD5
329efa3db8a908218487fc3607b73df6

SHA1
72a8b995f97eab399ccb22601fb3cf6df57e8a3b

SHA256
ac1b14a61b42f49c95ef6e893877bec973d3108d827535ab4885b051e9fed090

SHA512
058d418bab2b27612d840b52a1746ec88477326c02aeeeb200e40568a2e400219bf0ad42c9adeed8426dd55104843894699ee7e0d46a0417a978b4d5c1257e9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe

Filesize
205KB

MD5
329efa3db8a908218487fc3607b73df6

SHA1
72a8b995f97eab399ccb22601fb3cf6df57e8a3b

SHA256
ac1b14a61b42f49c95ef6e893877bec973d3108d827535ab4885b051e9fed090

SHA512
058d418bab2b27612d840b52a1746ec88477326c02aeeeb200e40568a2e400219bf0ad42c9adeed8426dd55104843894699ee7e0d46a0417a978b4d5c1257e9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe

Filesize
205KB

MD5
329efa3db8a908218487fc3607b73df6

SHA1
72a8b995f97eab399ccb22601fb3cf6df57e8a3b

SHA256
ac1b14a61b42f49c95ef6e893877bec973d3108d827535ab4885b051e9fed090

SHA512
058d418bab2b27612d840b52a1746ec88477326c02aeeeb200e40568a2e400219bf0ad42c9adeed8426dd55104843894699ee7e0d46a0417a978b4d5c1257e9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe

Filesize
205KB

MD5
329efa3db8a908218487fc3607b73df6

SHA1
72a8b995f97eab399ccb22601fb3cf6df57e8a3b

SHA256
ac1b14a61b42f49c95ef6e893877bec973d3108d827535ab4885b051e9fed090

SHA512
058d418bab2b27612d840b52a1746ec88477326c02aeeeb200e40568a2e400219bf0ad42c9adeed8426dd55104843894699ee7e0d46a0417a978b4d5c1257e9a

Download Submit
memory/372-143-0x0000000000000000-mapping.dmp

Download
memory/2612-149-0x0000000000400000-0x0000000000AE5000-memory.dmp

Filesize
6.9MB

Download
memory/2612-148-0x0000000000C60000-0x0000000000C7F000-memory.dmp

Filesize
124KB

Download
memory/2972-133-0x0000000000B60000-0x0000000000B9E000-memory.dmp

Filesize
248KB

Download
memory/2972-134-0x0000000000400000-0x0000000000AE5000-memory.dmp

Filesize
6.9MB

Download
memory/2972-132-0x0000000000D2D000-0x0000000000D4C000-memory.dmp

Filesize
124KB

Download
memory/2972-141-0x0000000000D2D000-0x0000000000D4C000-memory.dmp

Filesize
124KB

Download
memory/2972-142-0x0000000000400000-0x0000000000AE5000-memory.dmp

Filesize
6.9MB

Download
memory/3684-135-0x0000000000000000-mapping.dmp

Download
memory/3684-140-0x0000000000400000-0x0000000000AE5000-memory.dmp

Filesize
6.9MB

Download
memory/3684-139-0x0000000000C30000-0x0000000000C6E000-memory.dmp

Filesize
248KB

Download
memory/3684-138-0x0000000000E0C000-0x0000000000E2B000-memory.dmp

Filesize
124KB

Download
memory/4904-145-0x0000000000B50000-0x0000000000B6F000-memory.dmp

Filesize
124KB

Download
memory/4904-146-0x0000000000400000-0x0000000000AE5000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads