amadey | 72352db1cd4ce31af163a6a5f4757573ccb355402a4bdc75383c22de35625394

General

Target

72352db1cd4ce31af163a6a5f4757573ccb355402a4bdc75383c22de35625394.exe
Size

243KB
MD5

40b6b1e680f2b6956f41a4c87c393f92
SHA1

4368556425ee592e1692db8fbaf69e392daf50bf
SHA256

72352db1cd4ce31af163a6a5f4757573ccb355402a4bdc75383c22de35625394
SHA512

b261c78fbf3a3ed2b42af461e1e473e06827125ba7a5460a78b21e1fbfeab356e0d66e53ca8fe5919fbc5cfed579ba30fdf9209a0ad50c26bc0e5bc713b6f270
SSDEEP

3072:12wN0+6hseC5rPFRlKCNl6+J9HXWXIkLgsoC1kZi6Te4Mp4KHidIGa3sYDAbEaDt:WhseWi8J9SIkkso3v98CdIoEa

Score

10^/10

amadey collection spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

3.50

C2

62.204.41.252/nB8cWack3/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Amadey credential stealer module 2 IoCs

resource	yara_rule
behavioral1/files/0x0009000000022e3a-150.dat	amadey_cred_module
behavioral1/files/0x0009000000022e3a-151.dat	amadey_cred_module

Blocklisted process makes network request 1 IoCs

flow	pid	Process
34	3428	rundll32.exe

Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
1904	gntuud.exe
4456	gntuud.exe
3384	gntuud.exe
3868	gntuud.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	72352db1cd4ce31af163a6a5f4757573ccb355402a4bdc75383c22de35625394.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	gntuud.exe

Loads dropped DLL 1 IoCs

pid	Process
3428	rundll32.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 7 IoCs

pid	pid_target	Process	procid_target
4844	2140	WerFault.exe	79
4432	4456	WerFault.exe	86
4032	4456	WerFault.exe	86
4240	3384	WerFault.exe	93
3360	3384	WerFault.exe	93
2988	3868	WerFault.exe	104
2800	3868	WerFault.exe	104

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4824	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3428	rundll32.exe
3428	rundll32.exe
3428	rundll32.exe
3428	rundll32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 1904	2140	72352db1cd4ce31af163a6a5f4757573ccb355402a4bdc75383c22de35625394.exe	80
PID 2140 wrote to memory of 1904	2140	72352db1cd4ce31af163a6a5f4757573ccb355402a4bdc75383c22de35625394.exe	80
PID 2140 wrote to memory of 1904	2140	72352db1cd4ce31af163a6a5f4757573ccb355402a4bdc75383c22de35625394.exe	80
PID 1904 wrote to memory of 4824	1904	gntuud.exe	84
PID 1904 wrote to memory of 4824	1904	gntuud.exe	84
PID 1904 wrote to memory of 4824	1904	gntuud.exe	84
PID 1904 wrote to memory of 3428	1904	gntuud.exe	92
PID 1904 wrote to memory of 3428	1904	gntuud.exe	92
PID 1904 wrote to memory of 3428	1904	gntuud.exe	92

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\72352db1cd4ce31af163a6a5f4757573ccb355402a4bdc75383c22de35625394.exe
"C:\Users\Admin\AppData\Local\Temp\72352db1cd4ce31af163a6a5f4757573ccb355402a4bdc75383c22de35625394.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe
  "C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:4824
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - outlook_win_path
    PID:3428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 1136
  2⤵
  - Program crash
  PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2140 -ip 2140
1⤵
PID:4916

C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe
C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe
1⤵
- Executes dropped EXE
PID:4456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 456
  2⤵
  - Program crash
  PID:4432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 464
  2⤵
  - Program crash
  PID:4032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4456 -ip 4456
1⤵
PID:3176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4456 -ip 4456
1⤵
PID:384

C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe
C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe
1⤵
- Executes dropped EXE
PID:3384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 460
  2⤵
  - Program crash
  PID:4240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 480
  2⤵
  - Program crash
  PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3384 -ip 3384
1⤵
PID:4052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3384 -ip 3384
1⤵
PID:4176

C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe
C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe
1⤵
- Executes dropped EXE
PID:3868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 456
  2⤵
  - Program crash
  PID:2988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 476
  2⤵
  - Program crash
  PID:2800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3868 -ip 3868
1⤵
PID:1216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3868 -ip 3868
1⤵
PID:5024

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe

Filesize
243KB

MD5
40b6b1e680f2b6956f41a4c87c393f92

SHA1
4368556425ee592e1692db8fbaf69e392daf50bf

SHA256
72352db1cd4ce31af163a6a5f4757573ccb355402a4bdc75383c22de35625394

SHA512
b261c78fbf3a3ed2b42af461e1e473e06827125ba7a5460a78b21e1fbfeab356e0d66e53ca8fe5919fbc5cfed579ba30fdf9209a0ad50c26bc0e5bc713b6f270

Download Submit
C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe

Filesize
243KB

MD5
40b6b1e680f2b6956f41a4c87c393f92

SHA1
4368556425ee592e1692db8fbaf69e392daf50bf

SHA256
72352db1cd4ce31af163a6a5f4757573ccb355402a4bdc75383c22de35625394

SHA512
b261c78fbf3a3ed2b42af461e1e473e06827125ba7a5460a78b21e1fbfeab356e0d66e53ca8fe5919fbc5cfed579ba30fdf9209a0ad50c26bc0e5bc713b6f270

Download Submit
C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe

Filesize
243KB

MD5
40b6b1e680f2b6956f41a4c87c393f92

SHA1
4368556425ee592e1692db8fbaf69e392daf50bf

SHA256
72352db1cd4ce31af163a6a5f4757573ccb355402a4bdc75383c22de35625394

SHA512
b261c78fbf3a3ed2b42af461e1e473e06827125ba7a5460a78b21e1fbfeab356e0d66e53ca8fe5919fbc5cfed579ba30fdf9209a0ad50c26bc0e5bc713b6f270

Download Submit
C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe

Filesize
243KB

MD5
40b6b1e680f2b6956f41a4c87c393f92

SHA1
4368556425ee592e1692db8fbaf69e392daf50bf

SHA256
72352db1cd4ce31af163a6a5f4757573ccb355402a4bdc75383c22de35625394

SHA512
b261c78fbf3a3ed2b42af461e1e473e06827125ba7a5460a78b21e1fbfeab356e0d66e53ca8fe5919fbc5cfed579ba30fdf9209a0ad50c26bc0e5bc713b6f270

Download Submit
C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe

Filesize
243KB

MD5
40b6b1e680f2b6956f41a4c87c393f92

SHA1
4368556425ee592e1692db8fbaf69e392daf50bf

SHA256
72352db1cd4ce31af163a6a5f4757573ccb355402a4bdc75383c22de35625394

SHA512
b261c78fbf3a3ed2b42af461e1e473e06827125ba7a5460a78b21e1fbfeab356e0d66e53ca8fe5919fbc5cfed579ba30fdf9209a0ad50c26bc0e5bc713b6f270

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
126KB

MD5
d3cb6267ee9076d5aef4a2dbe0d815c8

SHA1
840218680463914d50509ed6d7858e328fc8a54c

SHA256
fea6ecd2a63044cc6be256142021fc91564c2ae1705620efc2fe6a3f4e265689

SHA512
4c10709ae5288dae7d297beecca29b7700e2926787941139e81c61eb4ad0790152991d7447c4243891c51115f5a9dd43b4c0e7dd0f9dfdbe1cc466fbe9f3841a

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
126KB

MD5
d3cb6267ee9076d5aef4a2dbe0d815c8

SHA1
840218680463914d50509ed6d7858e328fc8a54c

SHA256
fea6ecd2a63044cc6be256142021fc91564c2ae1705620efc2fe6a3f4e265689

SHA512
4c10709ae5288dae7d297beecca29b7700e2926787941139e81c61eb4ad0790152991d7447c4243891c51115f5a9dd43b4c0e7dd0f9dfdbe1cc466fbe9f3841a

Download Submit
memory/1904-139-0x0000000000738000-0x0000000000757000-memory.dmp

Filesize
124KB

Download
memory/1904-140-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1904-143-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1904-135-0x0000000000000000-mapping.dmp

Download
memory/2140-133-0x00000000021B0000-0x00000000021EE000-memory.dmp

Filesize
248KB

Download
memory/2140-141-0x0000000000618000-0x0000000000637000-memory.dmp

Filesize
124KB

Download
memory/2140-142-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2140-132-0x0000000000618000-0x0000000000637000-memory.dmp

Filesize
124KB

Download
memory/2140-134-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3384-153-0x000000000076C000-0x000000000078B000-memory.dmp

Filesize
124KB

Download
memory/3384-154-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3384-155-0x000000000076C000-0x000000000078B000-memory.dmp

Filesize
124KB

Download
memory/3384-156-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3428-149-0x0000000000000000-mapping.dmp

Download
memory/3868-158-0x000000000058C000-0x00000000005AB000-memory.dmp

Filesize
124KB

Download
memory/3868-159-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4456-148-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4456-147-0x00000000004DC000-0x00000000004FB000-memory.dmp

Filesize
124KB

Download
memory/4456-146-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4456-145-0x00000000004DC000-0x00000000004FB000-memory.dmp

Filesize
124KB

Download
memory/4824-138-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads